# CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION ## Advice Memorandum to Serena Holt **Re: Handling of the encrypted drive; wage report to the labor agency; Avenor's return demand** --- ## 0. Read this first: three immediate instructions 1. **Do not send anything to anyone.** Not the agency, not the journalist, not your prospective employer, not family, not cloud storage. Every transmission from this point runs through me. 2. **Do not delete, move, rename, decrypt-and-re-save, or "clean up" anything on the drive.** A dispute is anticipated, so your preservation duty has attached. Self-help deletion — even deletion Avenor demands — can be characterized as spoliation and is the one act that could hurt you more than the over-copying already has. 3. **Surrender custody of the drive to this office today** against a written receipt, and give me every copy, including any backup, laptop image, or thumb drive. We will forensically image it, record hash values, and hold the original in a locked, logged, offline location. From then on you have no possession and no access — which is itself a defense. Your legal position on the core issue (the overtime falsification report) is strong. Your exposure comes almost entirely from *what else* is on the drive. The single most important strategic fact available to us is that **you have disclosed nothing to anyone outside counsel.** Keep it that way and most of the risk is manageable. --- ## 1. The framing problem, stated honestly Under the governing rules, limited retention is protected when the documents are (a) lawfully accessed, (b) reasonably necessary to substantiate the report, (c) no more than reasonably necessary, and (d) disclosed only to counsel or an authorized regulator. Category A satisfies all four. But you did not take Category A — you took **nine gigabytes, by folder, indiscriminately**, and Category A is a small fraction of it. Avenor will argue that a nine-gigabyte folder-level copy *is* "mass collection" and "retention of unrelated confidential information," which the rules expressly exclude from protection. The answer is the rule that protects you: **counsel analyzes categories separately.** The presence of an improper category does not strip protection from lawfully retained items, and lawfully retained items do not immunize the improper ones. So our strategy is *segregation, not defense of the whole*. We concede nothing about the report, and we voluntarily and promptly quarantine everything that has no business being in your hands. The credibility of the concession is what protects Category A. --- ## 2. Category A — payroll spreadsheets and the VP emails **Status: preserve, and provide to counsel and the labor agency.** These 23 spreadsheets and 3 emails are the paradigm case for protected retention: - You accessed them routinely in your job as payroll manager — no hacking, no access beyond permissions. - They are not merely helpful but *essential*: the spreadsheets show original-versus-edited overtime entries, which is the falsification itself, and the VP's instruction to "move excess hours into the next period" is direct evidence of intent and direction from management. - The volume is proportionate — 26 documents to prove a records-alteration scheme is restraint, not overreach. - Disclosure has been confined to counsel. **How we handle them:** - We extract Category A from the forensic image into a segregated working set, with hash values documented, so we can prove to a court that the files were not altered after copying. Native format with metadata intact; no re-saving, no edits, no annotations on the files themselves (your commentary goes in a separate memo). - **Coworker personal information must be addressed.** Payroll spreadsheets almost certainly contain other employees' Social Security or ID numbers, bank routing data, addresses, and possibly medical or garnishment deductions. Your confidentiality obligation to *them* is legitimate and survives. We prepare two versions: a redacted set for any use outside the agency, and an unredacted set for the agency only, transmitted with an express request for non-public treatment. - **To the agency:** produced under cover letter that (i) identifies you as a complainant seeking whistleblower confidentiality and identity protection to the extent available, (ii) requests confidential/non-public treatment of the records and exemption from public-records disclosure, (iii) asks for written acknowledgment of receipt and an inventory match, and (iv) states affirmatively that we have withheld privileged and unrelated material and are working on a protocol for it. That last point costs us nothing and inoculates you against the "she stole everything" narrative. - Rule 4 is explicit: a confidentiality agreement cannot prohibit truthful reporting to a regulator or counsel. Avenor's NDA does not reach this production, and we will say so in writing. **Bottom line:** Category A stays, and it goes to the agency. This is your case. --- ## 3. Category B — the 14,000-record customer export **Status: quarantine immediately; return/destroy only under a documented protocol; do not open, ever.** This is your most serious exposure, and it is worse in some ways than Category D. - It is **unrelated to payroll** and unrelated to your report. It cannot substantiate anything about overtime. It fails the "reasonably necessary" test completely. - Technical access is not authorization. That payroll and billing shared a reporting tool gave you the *ability* to pull it; you never used it in your work, which means pulling it was **access beyond job permissions** in substance, even if no password was cracked. This is the category most likely to support independent discipline and, depending on jurisdiction, computer-access or data-protection liability. - It contains **names, home addresses, bank-account data, and identification numbers** — the exact material Rule 4 identifies as legitimately protected, and the exact material that triggers statutory breach-notification and data-protection regimes. Your continued possession is an ongoing harm to 14,000 uninvolved people and an ongoing accrual of risk to you. **What we do not do:** we do not simply hit delete, however tempting. Unilateral destruction (i) forfeits our ability to prove the export was never accessed, copied, or transmitted, (ii) hands Avenor a spoliation argument, and (iii) is exactly the kind of act Rule 8 warns against. **What we do:** - Segregate the export into an encrypted, access-logged container. No one on my team reviews its contents. I will document that decision contemporaneously. - Commission a forensic report establishing, from the drive artifacts, that the export was copied as part of a bulk folder operation, was never opened, never printed, never emailed, never uploaded, and never synced. That report is your single best mitigating fact. - Offer Avenor **prompt, verified return and certified destruction** under a written protocol: hash-verified copy to Avenor or a neutral vendor, wipe-to-standard of the segregated container, certificate of destruction, and a preserved forensic image held by the neutral (not by you) solely against evidentiary need. If Avenor refuses to sign a protocol, we escrow the container with a neutral vendor or move for a court-supervised protocol and file our proposal on the record. - We volunteer this **before** Avenor's suit, not after. Prompt, unprompted remediation converts "mass collection" into "over-inclusive copy, immediately and voluntarily cured." --- ## 4. Category D — pricing models, source code, sales strategy **Status: quarantine identically; highest litigation risk; absolute wall against your prospective employer.** Everything said about Category B applies, plus one aggravating fact that changes the character of the risk: **your prospective employer competes against the very service this material describes, and has already asked you for "inside proof."** - This is core trade-secret material — pricing models and source code are the classic protected categories. It has no connection to payroll or your report, so it enjoys no protection whatsoever under Rule 2. - Rule 3 expressly excludes "use for competitive advantage." Right now you have not used it. But possession + a competing prospective employer + a request for inside information is precisely the pattern that supports a misappropriation claim, an "inevitable disclosure" theory in jurisdictions that recognize it, injunctive relief against you, and joinder of your new employer as a defendant. Your prospective employer's own counsel, if properly advised, will not want this near them. - Because this is the material most likely to draw a preliminary injunction, our voluntary sequestration-and-return offer should **name Category D first and by description**, and should offer expedited return of it even ahead of the rest. That reframes the trade-secret threat from "we need an injunction" to "there is nothing to enjoin." **Practical protection for you:** if a Category D file was never opened, we prove it forensically and say so under oath in a declaration. If, contrary to my understanding, you opened any of it, tell me today. I would far rather disclose it in our own protocol letter than have Avenor's forensic examiner surface it. --- ## 5. Category C — the outside-counsel privileged memorandum **Status: sequestered as of now. This triggers *my* duties, not just yours.** The memorandum analyzing wage exposure is exactly what we would most like to read, and it is exactly what we may not read. Under Rule 5, privilege survives your unauthorized copying. Your instinct was right — you saw the "Privileged and Confidential" label, stopped, and did not read on. That fact matters and we will document it in a declaration: what you saw (first page only), that you recognized the label, that you stopped, and that the folder was swept up in a bulk copy rather than targeted. **My obligations, which I am performing now:** 1. **Stop review.** No one in this office reads it; no one summarizes it; we do not use its substance, its conclusions, or the inference that Avenor obtained wage-exposure advice at all. 2. **Sequester it.** Isolated encrypted container, access log, no derivative notes. 3. **Notify Avenor's counsel promptly and in writing** — identifying the document by its label and general description only, stating that we have not reviewed it and will not. 4. **Seek an agreed or court-supervised protocol**: return, destruction, or in-camera adjudication of any privilege dispute (for example, if a crime-fraud or "advice at issue" argument later arises, it will be litigated by a judge on a proper record, not by us reading the memo and deciding for ourselves). Two points for you specifically. First, **do not tell me what was on the first page.** If you have already mentioned it, I will document the scope and we will address any taint. Second, if this case ever reaches discovery, the memorandum may become discoverable through legitimate channels (for example, if Avenor asserts good-faith reliance on counsel and thereby waives). That is the *right* road to its contents. Using your copy is the wrong road, and it would risk disqualification of your counsel, exclusion of evidence, and the transformation of a strong retaliation case into a sanctions hearing. --- ## 6. Category E — your dated notes and the two screenshots **Status: yours; preserve; usable.** - **Your notes** — dated contemporaneous meeting notes, including quotations from managers — are your property under Rule 6. They are your own observations of events you witnessed. Contemporaneous dated notes are frequently the most persuasive evidence in a wage-falsification case, because they corroborate the documents and are hard to attack. - **The two screenshots** of payroll screens you personally used are narrow, job-adjacent, directly relevant to the mechanics of the alteration, and proportionate. They fall comfortably within "reasonably necessary." Two screenshots is the opposite of mass collection. - **The one limit:** notes lose their protected character to the extent they *reproduce* protected company material beyond what a legal claim requires. So we review your notes for (i) verbatim transcription of confidential documents unrelated to wages, (ii) customer or coworker personal data, and (iii) anything touching Category C's substance. Anything in those buckets gets redacted from working copies. Also, do not "improve," supplement, or re-type your notes now — altering contemporaneous notes destroys the very quality that makes them valuable. Write new, separately dated recollections if you have more to add. --- ## 7. The journalist **My advice is unambiguous: no. Not a page, not a summary, not off the record, not through an intermediary.** I understand the fear behind it — that Avenor will bury this. But sending the drive to a journalist would be the single most damaging thing you could do, and it would damage the report you are trying to protect: - Rule 3 excludes **disclosure to the press** from protected activity, flatly. A press disclosure is not a gray area; it converts protected whistleblowing into breach of a valid confidentiality obligation and hands Avenor a legitimate, non-pretextual ground for its claims. - Sending the *entire drive* would additionally publish 14,000 people's bank-account and identification data, disseminate trade secrets, and distribute a privileged memorandum. Each is independently actionable, and the customer-data exposure could expose you to statutory liability and destroy your sympathetic posture in front of any judge or jury. - It would gut your retaliation case. Avenor's current position — that possession of any company file defeats your claim — is legally wrong. But "she leaked our customers' bank data to a reporter" is a defense that works. **What actually prevents burial — legitimately:** - The agency has compulsory process. Once your Category A production is in its hands with a written acknowledgment, the evidence cannot be "buried"; the agency holds it. - We serve Avenor a **litigation hold / preservation demand** identifying the payroll systems, the audit and change logs, the reporting tool, the VP's mailbox, and the relevant custodians and time period. Once that letter lands, destruction becomes spoliation with consequences, and preservation obligations run to *both* sides. - Hash values and our forensic image mean the authentic originals exist independent of Avenor's cooperation. That is real insurance. - If the agency were genuinely to stall, there may be other authorized channels and, ultimately, litigation with public filings. Those are decisions to make later, with me, on a record — not tonight, with a reporter. --- ## 8. The prospective employer **Answer, verbatim, if asked again:** *"I've raised a wage-and-hour concern with the labor agency through my lawyer, and I'm not able to discuss any of my former employer's confidential information. My lawyer has instructed me not to, and I won't."* Then stop. Do not hint, do not smile knowingly, do not say "you'd be surprised." Why this is non-negotiable: - Answering "yes, I have inside proof" — even truthfully, even without handing anything over — is **use of retained material for competitive advantage**: you would be trading on possession to obtain the job. That is expressly outside protection and is the strongest possible fact for Avenor's trade-secret suit. - It exposes the new employer to joinder, which is the fastest way to lose the offer once their counsel is involved. - Realistically, a well-run employer that hears "no, and here's why" is *reassured*; one that keeps pushing for a competitor's source code is a liability you do not need. Also: do not bring the drive, any copy, or any Category D-derived knowledge into the new employer's systems, devices, or email. If you are hired, consider a written acknowledgment to the new employer that you have brought no former-employer material — that document may later be worth a great deal. --- ## 9. Avenor's demand, and why we say no to it as written Avenor demands immediate return and deletion of **every** file, offers **no preservation protocol**, and asserts that possession of any company file defeats your retaliation claim. All three positions are defective, and we will answer each in writing. - **"Every file" is overbroad.** Rule 4 protects trade secrets, customer personal data, and unrelated proprietary material — and we will honor that fully as to Categories B, C, and D. It does not reach material lawfully accessed and reasonably necessary to substantiate a regulatory report, and it cannot prohibit truthful reporting to a regulator or counsel. Category A and Category E are not returned or deleted; they are preserved, and their disclosure is confined to counsel and the agency. - **"Immediate deletion" with no protocol is an invitation to spoliation.** Under Rule 8 both sides must preserve once a dispute is anticipated, and return or deletion must occur through a documented protocol preserving forensic integrity. We will not destroy evidence on the demand of the party it incriminates, and we will note — pointedly — that Avenor's offer of *no* protocol, coupled with a demand for total deletion, is itself a fact a fact-finder may find interesting. - **"Possession defeats the claim" is simply not the law.** Categories are analyzed separately (Rule 9). Avenor may discipline genuinely independent confidentiality or access misconduct, but only consistently with how it has treated comparators (Rule 7), and it may not use an overbroad confidentiality theory as a pretext to punish the report. Its own letter — a maximalist theory that possession of *any* file, including files you used daily, extinguishes a wage-falsification complaint — is useful pretext evidence, and we will preserve it as such. **What we affirmatively offer** (this is the posture that wins): a neutral-vendor forensic protocol under which (1) the drive is imaged with hash verification; (2) Category B, C, and D containers are quarantined, unreviewed, and returned or destroyed with certification; (3) Category C is handled under Rule 5 with no use of substance; (4) Category A and E are retained by counsel, produced to the agency, and produced to Avenor in litigation under a protective order; (5) a preserved image is held by the neutral against evidentiary need so nothing is truly destroyed; and (6) each side bears its share of vendor cost. If Avenor won't sign, we file the proposal and let the court supervise. --- ## 10. Exposure assessment — candid | Exposure | Level | Why | |---|---|---| | Retaliation claim (your affirmative case) | **Strong** | Report to a labor agency is protected activity; Category A retention is protected; Avenor's maximalist theory and refusal to offer a protocol are pretext evidence. | | Confidentiality-breach discipline | **Moderate, real** | Categories B and D are genuinely unrelated and confidential. Independent discipline is available to Avenor if consistent with comparator practice. Mitigated by non-review, non-disclosure, and voluntary return. | | Trade-secret suit (Category D) | **Moderate; controllable** | Rises sharply if you speak to the new employer; falls sharply on prompt, verified, unreviewed return. No use, no disclosure, no acquisition benefit = weak damages case. | | Data-protection / access exposure (Category B) | **Moderate** | 14,000 records of bank and ID data; technical access ≠ authorization. Cured substantially by demonstrated non-access and certified return. | | Privilege / disqualification (Category C) | **Low if we act now** | You stopped reading; we stop, sequester, notify, and seek a protocol. Becomes severe only if anyone uses the substance. | | Spoliation | **Low, unless you delete** | Preserve everything until the protocol is signed. | | Press disclosure | **Currently zero — keep it zero** | The one act that could flip the whole case. | Note also that even where misconduct is independent, it typically affects *remedies* (reinstatement, back-pay cutoff) rather than the existence of the protected activity. Avenor is conflating the two, deliberately. --- ## 11. Concrete sequence — the next ten steps 1. **Today:** you deliver the drive and all copies to me against a written receipt; you confirm in writing that no copy, backup, cloud sync, or email transmission exists elsewhere, and identify anything that does. 2. **Today:** you sign a short declaration covering the manner of copying (bulk folder copy), the Category C encounter (label seen, reading stopped), and the fact that Categories B, C, and D were never opened, used, or transmitted. Facts only. 3. **Day 1–2:** neutral forensic vendor images the drive, records hashes, and produces an access/artifact report on Categories B, C, D — specifically whether any file was opened, copied, printed, or exfiltrated. 4. **Day 1–2:** we segregate into five containers matching the categories. Only A and E are reviewable by this office. B, C, and D are locked with an access log and a written non-review instruction to my team. 5. **Day 2–3:** letter to Avenor's counsel, doing five things at once: (a) notice of the privileged memorandum, non-review, and request for an agreed Rule 5 protocol; (b) offer of prompt, unreviewed return/certified destruction of Categories B and D; (c) rejection of blanket deletion, with our proposed forensic protocol attached; (d) **litigation hold and preservation demand** listing systems, custodians, audit/change logs, and date range; (e) notice that Categories A and E are lawfully retained and that your report to the agency is protected and will not be curtailed. 6. **Day 3–5:** Category A production to the labor agency — redaction of coworker PII where appropriate, unredacted set with a confidentiality/non-public-treatment request, whistleblower identity protection request, hash-verified inventory, and a demand for written acknowledgment. 7. **Ongoing:** you say the scripted line to the prospective employer if the subject arises, and report any further request to me the same day. 8. **Ongoing:** zero press contact. If a journalist reaches you — including one who already knows something — you say nothing and call me. Do not confirm the existence of documents. 9. **Week 2:** execute the protocol; obtain certificates of destruction; ensure the neutral retains a preserved image so nothing is irretrievably lost. 10. **Then, and only then:** we assess affirmative claims, damages, and whether Avenor's threatened trade-secret suit and its "possession defeats everything" letter support a pretext or bad-faith-litigation theory. --- ## 12. The one paragraph to remember You are entitled to keep and use the 26 payroll documents and your own notes and screenshots, and to give them to your lawyer and the labor agency. You are not entitled to the customer export, the source code and pricing models, or the privileged memorandum, and holding them helps you not at all while endangering everything. So we keep what proves the wage falsification, we hand back what never belonged to you — promptly, unread, and on the record — and we send nothing to a reporter or a competitor. Do it in that order and Avenor is left arguing that a payroll manager who reported wage fraud with her own payroll files should lose because she copied a folder too many. That is an argument we will win.