Lawyer Challenges Suspension for Being Too Phishable; No Dice, Says Appellate Court

From Bedrossian v. Cal. State Pers. Bd., decided Tuesday by California Court of Appeal Justice Frances Rothschild, joined by Justices Gregory Weingart and Michelle Kim:

The [State Compensation Insurance Fund] employed Bedrossian as a staff attorney beginning in March 2004 and ultimately promoted her to attorney IV. In the latter position, she was responsible for litigating worker’s compensation cases involving “confidential and sensitive information.” A “duty statement” Bedrossian signed lists among her responsibilities as an attorney IV “[m]aintain[ing] user mastery over [the Fund’s] computer-based technology” and “communicat[ing] professionally and efficiently.” …

The Fund “require[s] that all employees take [cyber]security awareness and privacy training annually so that they can recognize external threats such as phishing and other social engineering tactics.” “Phishing” refers to the process of sending emails purporting to be from a legitimate source and encouraging the recipient to “click on … a malicious link” or attachment or provide sensitive information. “If a phishing email is successful, [it] can either steal data from the user,” “compromise the user’s account,” or “compromise the entire system” of an organization.

Over the course of her employment at the Fund, Bedrossian participated in numerous training sessions on how to identify and handle phishing emails. This training educated employees about “red flags” which should alert the reader that an email is potentially dangerous, such as asking the recipient to click a link to avoid a negative consequence. In 2019, the Fund began automatically adding an “external sender notification” banner on all emails from outside the Fund, which reminded the recipient in yellow highlighted text that the email “was sent from outside [the Fund]” and not to click on links or open attachments “unless you recognize the source and know the content is safe.” …

[1.] Phishing Email Test Campaign

In 2018, the Fund security department circulated a memorandum to all employees announcing the Fund was starting “organization-wide security phishing awareness tests … on a regular basis to test [employees’] security awareness knowledge.” These tests involved the Fund sending emails “to all 4000 [Fund] employees in a randomized fashion”—that is, in “groups of employees at a time, at different dates and times.”

The test emails “mirrored what a real phishing email might look like. When an employee clicked on links contained [therein] …, replied to the emails, or opened [an] attachment, [the employee was] deemed to have ‘failed’ the test. Simply opening the phishing test emails did not trigger a failure result, nor did hovering over a link.” The memorandum informed employees that those “who click on a phishing test email [would] receive counseling and reinforcement training,” and that “[r]epeated violations may result in formal disciplinary action.”

[2.] Bedrossian’s Failed Tests Resulting in Additional Training Effort

Between December 2021 and December 2022, Bedrossian failed three phishing tests. As a result of the first failed test, she was required to participate in remedial cybersecurity training sessions in the form of both “recorded trainings as well as one-on-one coaching.” These training sessions failed to alleviate the problem; Bedrossian failed two more tests, after which the Fund suspended her for five days. That suspension is the subject of the writ petition ruling before us on appeal.

On December 21, 2021, Bedrossian received a phishing test email purporting to be authored by a Fund employee, but from a non-Fund email address. It instructed the recipient to click on a link and enter an email address and password. Bedrossian opened the email with her Fund-issued mobile phone and clicked the link.

The Fund issued her a memorandum “remind[ing] [her] of the dangers of phishing attacks” and required her, inter alia, to participate in a one-on-one security awareness training session with a Fund security analyst. At the beginning of that February 2022 training session, the analyst informed Bedrossian that the analyst was “solely there to provide training,” and “[a]ny questions … in regards to the personnel actions” should be directed to human resources or Bedrossian’s supervisor.

Bedrossian “became very abrupt, very rude, disrespectful, [and] started … ask[ing] … all kinds of questions that had nothing to do with the training,” “making accusations,” and “being very belittling.” For example, Bedrossian asked the analyst “about the number of employees who received the test emails, and whether specific individuals were targeted to receive them. [Bedrossian] accused [the analyst] of not being a [Fund] employee and of being improperly supplied with private information about [Bedrossian].”

The analyst felt she could not continue the session and ended it “within the first few minutes.” Later that day, Bedrossian emailed the analyst and the analyst’s supervisor accusing the security department of trying to entrap employees and unfairly targeting Bedrossian with the phishing test email.

{The following is a representative excerpt from Bedrossian’s February 11, 2022 email: “You are not on the employee list and neither is your boss. You have private information that … HR or IT is supplying you with in order to ‘catch the employees’…. You would not answer my questions about how many employees you targeted on 12/21/21 at 3:50 p.m. with the phishing email. You indicated that it was not done through the whole 4000 employees. You said it was random and yet you would not give me information how you knew that my computer was having issues with hacking. When I asked about your affiliation with IT or HR and your boss[‘s] name you refused to give me an answer and hung up on me. This is not proper procedure….

“Are you an independent vendor providing services for [the Fund]. Are you hired by IT or HR to conduct these tests on their behalf. I want to know your boss[‘s] name. I want to know how many people were on the mailing list on 12/21/21 at 3:50 p.m. How did you designate who will be on the specific targeted email? Who is giving you the private information for you to gear it to those people?”}

On May 11, 2022, Bedrossian received a phishing test email purporting to be from state vehicle registration. It instructed her to click on links to renew her license and registration in order to avoid penalties. Bedrossian opened it on her Fund-issued mobile phone and clicked the link. Bedrossian again received a memorandum from her supervisor admonishing her about this failed test.

On December 9, 2022, Bedrossian received a phishing test email from wework@invite-workplace.com inviting her to accept an invitation to a new WeWork account by clicking on a link. The Fund does not use WeWork. Bedrossian opened the email and clicked on the link.

Bedrossian was suspended without pay for five days, based on “Bedrossian’s failed phishing tests and her interactions with the security analyst and Fund personnel about the December 2021 test.” She challenged that in trial court and on appeal, but lost. An excerpt:

Bedrossian argues we must reverse and grant her petition because her failed phishing tests did not harm, or create a risk of harm to, public service. [California precedent] identifies “‘[h]arm to the public service'” from an employee’s conduct, or risk thereof, as a key factor in assessing whether discipline imposed for that conduct was excessive and thus an abuse of discretion. We need not consider whether her actions actually resulted in harm, because we agree with the trial court that Bedrossian’s clicking links in emails containing red flags, “if repeated[,] is likely to result in, ‘[h]arm to the public service …'” by compromising data the Fund has a fiduciary obligation to protect. (Ibid.) In addition, because “[c]ooperation among public employees is essential to the smooth functioning of public service,” Bedrossian’s discourteous behavior toward the security analyst harms the Fund’s public service efforts as well….

Bedrossian next argues the discipline imposed was unlawful because it was the result of fraud, entrapment, and larceny, and constitutes an unconstitutional restriction on free speech. We agree with the court below that Bedrossian forfeited these arguments by not raising them before the SPB [State Personnel Board]….

Michael J. Monteiro represents the Fund.