Videotron’s network security was seriously jeopardized last spring. A frustrated ex-employee sent the company into a cold sweat by seizing thousands of “highly confidential and sensitive” documents. This is what Videotron alleges, which had to turn to exceptional legal proceedings to avoid the worst.
The story was hit until recently by strict confidentiality orders. However, these were lifted by the Superior Court in mid-July, following the intervention of La Presse. The hundreds of thousands of customers of the Quebec communications leader therefore knew nothing of this affair.
“We can confirm that our customers’ personal information has not been affected in any way by Mr. Zheng’s actions,” Videotron responded in an unsigned email. Our interview request was denied due to the ongoing legal process.
Videotron’s allegations based on court documents have not been decided on the merits by the courts. That said, the Superior Court still accepted these allegations as “proven” to authorize the seizure of the documents from Paul X. Zheng’s home last March. Note that he is not charged with any crime.
Trained in engineering in China in the 1980s and holder of a master’s degree in engineering from Polytechnique Montréal, Paul X. Zheng firmly denies having communicated confidential information belonging to Videotron to a third party. Essentially, he considers that what he is accused of is only a pretext to justify his unjust and abusive dismissal. He is thus claiming $60,000 from his ex-employer.
If he downloaded documents at home, it was because the computer equipment provided by his bosses was, according to him, “outdated and inappropriate” for his programming work. Thus, he had to perform his work on his own personal equipment, he argues in his defense filed in court. Paul X. Zheng maintains that this “temporary” practice was known to his superior. In addition, she was needed for her duties in the event of a network failure.
February 2023. Paul X. Zheng has been an analyst in Videotron’s wireline access team since 2018. His responsibilities give him access to a wealth of sensitive and confidential information concerning Videotron’s residential Internet network. Recently, his performance has deteriorated and his relationship has “degraded” with management, Videotron alleges.
When his bosses present him with a recovery plan, Paul X. Zheng reacts badly. The analyst makes rude and disrespectful remarks, and his attitude is “hostile” during the meeting, Videotron claims. His reaction is so “concerning” that the company fears he is stealing confidential information.
Two hours later, Videotron finds that Paul X. Zheng has transferred approximately 1,300 company files to his personal Gmail account. His access is cut off. Confronted by his bosses, he denies having downloaded confidential documents. “Which was wrong,” Videotron alleges.
It’s the commotion. Videotron discovers that Paul X. Zheng appears to have been raging since September 2022. He has downloaded a “significant amount of highly sensitive and confidential information, documents and information”. We are talking about nearly 20,000 documents transferred to his personal external accounts and 4,250 documents sent to an email address since September 2022.
The leak is taken very seriously by Videotron. Indeed, the consequences could run into millions of dollars. If these stolen documents are used with bad intention, the security of the network and infrastructures could even be “compromised”, worries Videotron.
It is that Paul X. Zheng did not appropriate trivial information. Quite the contrary. The thousands of appropriate documents contain “highly confidential and sensitive” information, such as home internet network plans, operational scripts, start-up procedures and technology roadmaps.
Videotron lists a long list of “serious harm” that this theft could cause.
“A malicious individual could carry out targeted attacks that could possibly result in, among other things, denial of service for our residential and business customers, theft of service or theft of information, if certain information were made public, such as the topology network, access control list, scripts and operational procedures”, worries Videotron.
Videotron’s concerns are numerous: a competitor could use strategic information to its advantage, suppliers could sue it if confidential data were leaked, and Videotron’s reputation could be tarnished.
It was in this extremely urgent context that Videotron went to the Superior Court on March 3, 2020, in the context of an Anton Piller-type injunction. This exceptional procedural vehicle allows someone to conduct a search of an individual’s home, a measure generally carried out by the police. The person concerned is obviously not informed in advance.
Three days later, Judge France Dulude authorized Videotron representatives to enter the residence of Paul X. Zheng in the Notre-Dame-de-Grâce district and seize all the documents belonging to the company. For months, a computer expert sifted through hard drives and USB drives seized from Paul X. Zheng.
The documents made public by Judge Marc-André Blanchard do not make it possible to know whether third parties were able to get their hands on the documents and whether Videotron’s fears were proven. The list of documents held by Mr. Zheng is still under seal.
In his defense, written by Me Paul-Yvan Martin, Paul X. Zheng asserts that he devoted himself “zealously” to his work, even volunteering at Christmas and New Year’s Eve. However, since May 2022, he has occupied in his spare time a second job for an OEM in Vancouver.
Paul X. Zheng is very critical of Videotron’s practices. He believes that the Quebec company was experiencing “problems with the inefficiency of its engineering services as well as instances of misconduct in engineering practices, resulting in high operating costs”.
Paul X. Zheng links his “wrongful” dismissal to the conduct of his boss, whom he considers vexatious. He claims that his superior reacted badly when Paul X. Zheng pointed out his lack of competence and his concerns about the age of his equipment. That said, he denies being rude to his bosses and says he never “spoken anything to warrant fear of misuse” of information.
Note that Paul X. Zheng is also known as Paul Xiaowu Zheng or Xiaowu Zheng, according to Land Registry and Business Registry entries. Furthermore, Mr. Zheng owned from 2009 to April 2023 a company specializing in “telecommunications equipment industry” named DRX Solution. However, his business never operated and never had a client, according to his lawyer.
