Labor & Employment Law Daily Wrap Up, EVIDENCE, DISCOVERY—7th Cir.: Dismissal of whistleblower lawsuit as sanction for deleting phone app messages upheld, (Jul 29, 2025)

By Marjorie Johnson, J.D.

Evidence showed the employee allowed the encrypted messages with his supervisor to be deleted, his explanations for how they were deleted evolved over time, and he took no reasonable steps to preserve them.

A district court did not err in dismissing a software engineer’s lawsuit, which alleged the Chicago Transit Authority (CTA) fired him in retaliation for reporting a security vulnerability, as a sanction for his failure to preserve relevant Electronically Stored Information (ESI) by intentionally deleting messages he and his supervisor sent over a private encrypted messaging app. The Seventh Circuit also affirmed the district court’s order that the employee and his attorney jointly pay CTA over $75,000 in fees and costs resulting from the discovery violation and award of monetary penalties against the attorney for his misconduct related to his opposition to CTA’s motion to compel a second forensic imaging of the employee’s phone after the first image came back missing relevant information (Pable v. Duffy, No. 24-2572 (7th Cir. July 28, 2025)).

Cyber-security incident. On August 17, 2018, the employee discovered a cyber-security vulnerability in the real-time transit tracking application developed for CTA by a third-party software company. He advised his supervisor, who then tested it on the Dayton Regional Transit Authority (RTA), resulting in a real bridge closure notice. He disclosed the test to RTA and accepted full responsibility for initiating it. He also alerted the software company about the vulnerability and his Dayton test.

Placed on leave. On October 22, the software company sent CTA a letter asserting the supervisor and employee had “exploited” the software’s vulnerability and breached its contract with CTA. CTA officials decided termination was necessary, but initially only placed them on administrative leave with no explanation and told them they would be interviewed on November 2. Suspecting that the forced leave might be related to anticipated FMLA leave, the employee contacted counsel on October 29.

Deletion of encrypted messages. The supervisor testified that when he met with the employee on the morning of November 2 to discuss the impending interviews, he deleted their entire conversation thread on Signal—an encrypted messaging application—because the messages were personal and CTA had not told him to preserve them. The employee claimed he did not delete the thread but that it also disappeared from his phone.

Lawsuit and counterclaim. CTA subsequently terminated them both, and the employee brought this lawsuit against CTA and the software company alleging violations of the whistleblower protections in the National Transit Systems Security Act. In response, CTA filed a counterclaim under the Computer Fraud and Abuse Act alleging he had configured a “dooms-day” feature on his work computer that allowed him to wipe it remotely.

Dispute over deletion of messages. Discovery revealed that the employee and supervisor had used Signal to communicate about “what to do next” after the Dayton test and deleted those messages on November 2. Though the employee initially claimed that the messages vanished on his phone because the supervisor deleted them from his device, CTA provided evidence that the application did not work that way at that time. The employee then claimed he had specially configured the application on his device to delete threads when other users deleted the entire thread. CTA argued this later-developed justification was unworthy of credence.

CTA also learned during discovery that the employee and supervisor continued to communicate via Signal after November 2, 2018. However, on October 29, 2019, the employee activated the “disappearing messages” feature, which caused all messages in their conversation thread to automatically delete 24 hours after being read by the recipient.

Forensic image of phone. CTA requested a forensic image of the employee’s phone to recover the missing Signal messages. His attorney initially resisted but eventually complied, and CTA’s expert determined the image contained only 0.2 GB of user data, lacked messages from third-party applications, and omitted photos, browsing history, and other key information. The attorney insisted that the image was complete but later acknowledged the vendor might have imaged only relevant portions based on search terms. He also insisted there was no need for a second imaging since the first image contained all relevant information. But after a second image was produced, CTA’s expert recovered 25 GB of data, including discussions about the software vulnerability. However, his Signal messages with the supervisor post-October 29, 2019 were still missing.

Sanctions. Granting CTA’s motion for sanctions under Fed. R. Civ. P. 37(e) based on their failure to preserve the relevant ESI, the district court dismissed the employee’s lawsuit and ordered him and his attorney to jointly pay CTA $75,175.42 in fees and costs. The court also ordered the attorney to pay an additional $53,388 under 28 U.S.C. § 1927 for unreasonably and vexatiously multiplying the proceedings and another $21,367 under Rule 37(a)(5) to compensate the CTA for having to file a motion to compel.

Failure to preserve ESI. The Seventh Circuit affirmed the district court’s decision to dismiss the employee’s complaint as a sanction under Rule 37(e). Evidence of his shifting explanations supported a finding that he intentionally spoliated the ESI, and a reasonable factfinder could conclude that, although he needed to preserve the messages, he either deleted or knowingly allowed the supervisor to delete them. Moreover, the district court determined that any lesser sanctions could not substantially mitigate the prejudice to the CTA.

Monetary Rule 37(e) sanctions. The district court also did not err in awarding CTA attorney fees and costs it incurred in bringing the Rule 37(e) motion. Dismissal alone was insufficient given that the spoliation impacted not only their ability to mount a defense, but also required the employee’s second deposition, several discovery motions and a subpoena, and briefing on the Rule 37 motion. Though the Seventh Circuit had never held that Rule 37(e)(1) authorizes monetary sanctions, the court found that the statutory text allowed such an award if it is “reasonably necessary to cure the prejudice.”

Fees and costs against attorney. The district court also did not err in finding that the attorney’s opposition to CTA’s motion to compel a second forensic imaging of the employee’s phone was “not substantially justified” and ordering him to pay additional fees and costs under Rule 37(a)(5). CTA needed to seek the second imaging only because the attorney originally instructed the provider not to complete a full image of the phone, which resulted in the exclusion of relevant communications that were revealed by the second imaging. The Seventh Circuit also affirmed the monetary sanctions against the attorney under Section 1927 due to his misconduct related to the imaging of the employee’s phone.

No fees related to appeal. However, CTA lost its bid for an award of fees for defending on appeal the district court’s decision to impose Rule 37(a)(5) sanctions. “Without more developed caselaw, we cannot say that this appeal—unlike the opposition to the motion to compel in the district court—was not ‘substantially justified,’” the Seventh Circuit concluded.

The case is No. 24-2572.

Judge: Jackson-Akiwumi, C.

Attorneys: Timothy A. Duffy (Law Offices of Timothy A. Duffy) for Christopher George Pable. Elizabeth E. Babbitt (Taft Stettinius & Hollister) for Chicago Transit Authority. Michael F. Hughes (Amundsen Davis) for Clever Devices, Ltd.

Companies: Chicago Transit Authority; Clever Devices, Ltd.

MainStory: TopStory EvidenceDiscovery Procedure RemediesDamages AttorneysFees Whistleblowers IllinoisNews IndianaNews WisconsinNews GCNNews