Thread by @tribunaltweets

Good morning.
Day 8 morning session of the July hearing of Sandie Peggie v NHS Fife Health Board and Dr Upton will be reported on this thread.

The start time is 10am.

We expect witnesses Peter Donaldson (PD) and Jim Borwick (JB) both IT experts and Dr Maggie Currer (MC)

A reminder of our disclaimer:

Instruction from the judge for any future witnesses:

Our previous coverage of this case and press coverage can be found on our Substack below.

Please consider taking out a subscription to support out work.

tribunaltweets.substack.com/p/peggie-vs-fi…

Abbreviations used:

NEW abbreviations:

MSF - Michele Sinclair-Farrow, HR advisor
MJ - Melanie Jorgensen - HR advisor
JH - Jackie Herkes - HR advisor
RA/HCW - health care worker who witnessed "missing patient" incident.
SF - Stuart Fraser - SPs RCN union rep
CS - Caroline Somerville, UNISON officer

We begin:
J - You will take an oath
PD - * takes oath*
JR - Mr Donaldson, you've written a statement, would you describe your role in NHS Fife board 1626
PD - info security manager, NHS fife, digital info dept, since april 2022. Develop security policy, investivations

JR - para 6, desc meeting 16th May with DU and AW, a Teams meeting. Desc what you did, how long
PD - short of 2 hrs
JR - what did you do
PD - asked to assist in downloading notes from DU phone for htis tb and present in manner understandable
JR -
PD - have a bg in forensics asked

PD - to help Adam in this
JR - google notes log 1643, yours
PD - yes
JR - to 1660, 20 screenshots.
PD - yes
JR - 260 - at top is a note, weird incident last thing it says sad times another 23 Dec
PD - y
JR - first one 23rd Aug
NC - leading
JR - what were you looking at

JR - scroll you see down to 28th Oct.
PD - concerned with dates and how to get them, in a manner that presents in order, find creation times, not content I was concerned with , getting them in an order for Trib
JR - 1643 - screen shot 1 - its
NC - leading
J - best to assume will

J - be disputed
JR - what is sc1
PD - in DU account
JR - headed weird inci 26 08 23, sc2 is below
PD - that's moving on, done to show chronological flow, version histories, where taken from
JR - this says version hist
PD - yes, gives every incident of note, back to earliest

PD - record, every edit
JR - earliest date sc3
PD - Oct date, 26 Oct 23
JR - there are 4 columns, left hand last entry 3:10am download. Criticism by JB, 3669, says despite title date wasn't actually created till Oct 2023
PD - consternation on call, agree how google presents

PD - on face of it earliest is Oct date. our supplementary notes have same problem DU said sync'd at same time
JR - JB been definitive about it, your confidence in creation date?
PD - accept what I've seen, how google presents. Definitive? Not convinced DU isnt right, don't

PD - have an explanation. Time stamp is right, don't have a tech answer.
JR - you mention other notes date stamped 26th Oct, *takes to one* called terrain shopping list, version hist also has 26th Oct 23 and to R says may2nd 23, whats the may date

PD - DU said convinced made earlier
JR - whats may date
PD - edited date
??
PD - we couldn't no explanation for inaccuracy, couple of notes with same issue. accepted definitive date Oct, but others had earlier dates too - don't know tech issue, haven't been able to replicate

PD - theres a genuine belief they were earlier but can't show how
JR - why is the may edit date earlier than creation date in oct?
PD - unable to explain
JR - JB says version hist is incomplete, to your report 1670 comment on that, fig 9 what makes it not incomplete, full clip

PD - i think i know what they are saying, think he's saying we haven't produced all 4 versions of that.
JR - look at bottom rh corner word
PD - dismiss
JR - explain if that word is in your report
PD - ah was cut off, put no relevance
JR - anything else missing
PD - not that i no

JR - sc20 - 1659 - 3 creation dates here, top one says oct 26th 309am edited aug 23, first title alpha med, another £44.05 created 26th oct edited earlier. *another created oct and edited earlier* can you assist with explanation?
PD - inferred created earlier. Google says Oct

PD - but edited earlier, all of the notes edited before created, DU didn't lead us up the garden path, included to show similar notes unrelated but have predated time we can't explain
JR - looked at scs, 5 references to 26th Oct at 308, 309 or 310 in the morning can you explain

PD - no
JR - if we look at - 1644 -does that assist?
PD - are we talking about sc in row 2?
JR - page 1694 for JB criticism, last sentance, worth of note there's edited dates, each sc produced by DU lacks an edit date. explain
PD - bear with, the screenshots i thought he ref'd

the html?
JR - 1666 is fig 4, 1667 is fig 5 -
PD - no can't explain why not on screen, downloaded from laptop, data from the mobile
JR*repeats page refs*
PD - where talking about edit date, we haven't got it, can't explain
JR - can you explain? your sc shots start at 1643

JR - we have edit dates for some, not others
PD - open note in application, have date bottom right, when downloading doesn't look like that, the html edit dates are editable there are 2 parts to that
JR - sc shot 5 JB says accessed in downloads, see that 1646 file pathway

JR - says downloads. C:/user for every subsequent one we see something different. JB aligned on that saying accessed from somewhere
J - slow down
JR - 5 says downloads, 6 and rest say something else. Suggest later ones accessed from somewhere other than downloads

JR - JB says not downloaded during Teams meeting
PD - DU moved the files to
JR - slow
PD - up to screen 5 into auto folder downloads
JR - from 6 what happened
PD - she wanted to put them somewhere easily accessible for her
JR - where
PD - her work area docs/med/workarea

JR - can you help with whether these we were looking at were accessed during your meeting
PD - after they were created, they were pulled at the time of the call
JR - sc sh 4 - dates rh column what are they
PD - creation of downloads
JR - date
PD - 16th may on the call
11:24-11:40

JR - comment on sc sh not taken during call?
PD - they were taken during call

CE - hello, I'm asking qu for SP, pick up first on quandry version hist dates showing creation 26th Oct. you say no tech explanation
PD -not that I'm aware of
CE - 1645 - sc sh of file locations

PD - yes
CE - these html are useful at face value
PD - yes
CE - last portion of html gives creation date
PD - yes
CE so we look at this, subject toit bein editable, face value, that's the date
PD - yes

CE - 1659 - these shots they purport to demo other similar errors going on
PD - yes, they highlight creation on 26th Oct in google, but genuine belief they were earlier, it's context.
CE - sync base explanation thats DU's explaination
PD - yes, in a forensic capacity i could
CE

CE you were just downloading, not asked to figure out how occured
PD - yes, but consternation on call, so included others at the time
CE - other instances of creation dates
PD - 3am that day issue yes
CE - there's other data thoug
PD - what
CE - html data
PD - will give same

CE - should be html files, but there aren't here
PD - no, was asked to produce files in quesiton
E - no critisism, but there is info
PD - yes
CE - native files
PD - ???
CE - no metadata produced
PD - only screen shots
CE - you didn't look
PD - no
CE - you dodnt enter artifacts

PD- no
JR - this is PD's document
CE - i don't
PD - DU produced the screenshots, I produced assistence
CE - you provided writtten guidance for DU, DU produced, you gave ?
PD - empty table,
CE - DU filled it in and returned to you?
PD - yes
CE - so DU produced it?

PD - I'm comfortable with it
CE - this doc you did create, response to JB report, wrote summary. Cannot give explanation for dates issue, but do not believe DU tried to mislead. You say you don't believe it, but it is one explanation?
PD - it's a possibility, but I didn't believe

CE - you accept its one explanation that DU is misleading
PD - I don't believe
CE - JB's report 1643 - scsh shows note in google account, dialogue box too, we see coloured box says hi elizabeth, can edited info sit behind that?
PD - edited time stamp? Yes that would be behind

CE - box 3, 3 sc sh side by side, cropped tightly
PD - yes
CE wider shots would show edit dates
PD - no they weren't there
CE - a little on how this exercise conducted. Propositions, agree/disagree. first most reliable way to ensure reliable/ integrthy - a forensic investigation

PD - yes
CE next best, in person you doing it
PD - wasn't asked
CE not a critisism, just another option, next best, you access files
PD - would have been beneficial
CE - next best, sit next to DU and watch what's done
PD - yes, next best but time limited

CE - next best, remote access to DU files
PD - ?
CE - would have been 4th option
PD - i believe DU
CE - but an option
PD - yes
CE next option, record teams call
PD - yes
CE - didn't happen
PD - no
CE - you went for the 6th best option
PD - my assistence asked for just to get note

CE - difficulty with screenshots 1659-60 - in box 20 cause the dificulty. Told trib you can't fathom explanation. Do you accept one is that they could be manipulated
PD - can't say it's impossible, it's possible
CE - no further qu

P - PD couple qu, you were asked re: dismiss

P - being missing, why would it be there?
PD - it's at the bottom of each window, didn't believe it was relevant
P - it's like clicking the x to close?
PD - yes
P - asked if you produced doc, could you tell us more detail, inc when and how
PD - couple days before got a call

PD - AW and manager with explanation and for a steer, I queried if forensic or not, wasn't going that way, time factors around leave, scheduled another call. Created a guide for DU how you can take down and record, i would witness it done live. Created blank form to record

P - when did you send form
PD - on call
P - you said DU completed, when returned,
PD - moments after call
P - what is a native file
PD - files that the app produces
P - also asked one possibility was DU is misleading us/you, your answer don't believe the case, but can't rule out

P - how could it be ruled out?
PD - can't say how it is ???? where I'm adding to DU's explanation, I was on the call at the time, if there was a tech issue i can't put my finger on it, can't recreate.
J - no qu from me
JR - 260-265- weird incident august 23 further down oct 23,

JR - another nov, another dec last is 28th Dec '23. Can you give assistance which bit of note the query of date 26th Oct is about?
PD - rephrase please
JR - can you help
PD - I can only comment JB report states dates times created, helpful
JR - did you have a visual on DU in meet

JR - can you describe what DU did?
PD - DU did production of sc sh, i advised as filled log. Had full visual of what file path going to, where mouse on screen.
JR - 1643 - top says, beth did this at request of AW and while watched by AW and PD
PD - yes
JR - read comments?

CE - on this qu 1720 is relevant, documentary record says not possible
JR - PD - would you like to comment?
JR - suggests you didn't
PD - was there all the time
JR - back to 1659 rh column, have you read? Your views?
PD - google orders by time as default, however can

PD - be moved, but not here
JR - UCAT pip 30th august date.....
J - loss of audio, 5-10 mins break.
*BREAK*

@threadreaderapp please unroll

Day 8 morning session 2 will continue here:

https://x.com/tribunaltweets/status/1948688797303988470