Serinus Energy PLC v SysGen Solutions Group Ltd, 2023 ABKB 625

Court of King’s Bench of Alberta Citation: Serinus Energy PLC v SysGen Solutions Group Ltd, 2023 ABKB 625 Date: 20231107 Docket: 2001 07294 Registry: Calgary Between: Serinus Energy PLC Plaintiff/ Defendant by Counterclaim - and - SysGen Solutions Group Ltd. Defendant/ Plaintiff by Counterclaim _______________________________________________________ Reasons for Judgment of the Honourable Justice M.A. Marion _______________________________________________________ Table of Contents I. ......... Introduction . 4 II. ....... Procedural Background . 6 III. ...... The Record . 6 IV. ...... Factual Background . 7 A.

The Parties and their Business Relationship . 7 B. The FSMA, the Standard Set-Up and Other Services . 8

C. The Relationship Strains and Amendment to the FSMA .. 8 D. Serinus Requests and Receives Administrator Access to Serinus’ Systems . 9 E. SysGen’s Termination of the FSMA .. 9 F. Serinus Retains IT Ops and Shuts Down Office Due to COVID .. 10 G. Serinus Requests Removal of SysGen’s RMM Software . 11 H. The Disputed Invoice and the Administrator Lockdown . 11 I. Response to the Administrator Lockdown and the Billing Dispute . 12 V. ....... Issues . 14 VI. ...... Analysis . 14 A. Is this an Appropriate Matter for

Summary Trial? . 14 B. Are the Expert Opinions Admissible? . 17 1. Kayser 18 2. Mathezer 19 3. Employees of the Parties with Expertise . 21 C. Is SysGen Liable for Breach of Contract? . 21 1. Was the 2010 Application a Contract Binding on the Parties? . 21 2. The FSMA Amendment 22 3. The FSMA’s Disputed Clause and the Termination Letter 26 4. Did SysGen Breach the FSMA? . 28 a. SysGen’s Evidence of When it First Learned of the Security Threat and Decided to Implement the Administrator Lockdown is Vague, Inconsistent and Unreliable 29 b.

The Stated Reason for the Administrator Lockdown is Not Compelling or Corroborated by Objective or Documented Evidence . 29 c. SysGen Did not Reach out to Serinus Before or Immediately After Conducting the Administrator Lockdown . 31 d. April 21, 2020: SysGen’s Response to Serinus’ Questions About the Administrator Lockdown is Vague and Delayed . 31 e. April 22, 2020: SysGen Deletes Serinus’ Software . 32 f. April 22 and 23, 2020: SysGen Misleads, Obstructs and Further Delays Responses . 32 g. The Timing of the Dispute Letter, the Administrator Lockdown and the Offer, is Unlikely a Coincidence . 33 5.

Conclusion re: SysGen Breach of Contract 35 D. Is SysGen Liable for Conversion? . 36 1. Wrongful Act 36 2. Involving a Chattel 37 3. Handling, Disposing or Destruction of a Chattel 38 4. With the Intention or Effect of Denying or Negating the Title of Another Person to Such Chattel 38 5. Conclusion re Conversion . 39 E. Is SysGen Liable for Breach of Fiduciary Duty? . 39 F. Is SysGen Liable for Intrusion Upon Seclusion? . 41 G. If SysGen is Liable to Serinus, What are Serinus’ Damages? . 41 1. What are Serinus’ Compensatory Damages? . 41

a. Serinus’ Internal Personnel Costs . 42 b. Amounts Serinus Paid to iON .. 43 c. General Damages . 44 d. Aggravated Damages . 45 2. Should Serinus be Awarded Punitive Damages? . 45 a. Are Punitive Damages Appropriate in this Case? . 45 b. Are Punitive Damages Excluded by the 2010 Application agreement? 49 c. What is an Appropriate Quantum of Punitive Damages? . 51 i. Blameworthiness of the Defendant’s Conduct 52 ii. The Vulnerability of the Plaintiff . 53 iii. The Harm or Potential Harm Directed Specifically at the Plaintiff 53 iv. The Need for Deterrence . 53 v. Other Penalties . 54 vi.

Other Advantages . 54 vii. Conclusion re Punitive Damages . 54 3. Conclusion re Serinus’ Damages . 54 H. Is Serinus Liable to SysGen on the Counterclaim? . 55 1. What is the Legal Effect of the 2010 Application? . 55 2. Is Serinus Liable for Unpaid FSMA Services? . 55 a. February 2020 FSMA Services . 56 b. March 2020 FSMA Services . 56 c. April 2020 FSMA Services . 57 3. Is Serinus Liable for Unpaid Data Storage Services? . 57 4. Is Serinus Liable for Unpaid Software Licencing Services? . 58 5. Conclusion re SysGen Counterclaim .. 59 VII. .... Conclusion . 59 I.

Introduction [ 1 ] At its core, this case addresses a simple question: can a commercial IT service provider, without notice and under the guise of protecting the client’s information systems, reset a client or former client’s administrator account passwords to gain leverage in a billing dispute when there is no contractual, statutory or other claimed common law right to do so? The answer is no. [ 2 ] Does the answer change if the client is difficult or the client’s position in the billing dispute is incorrect?

No: the answer is still no. [ 3 ] People and businesses rely increasingly on complex electronic information systems to manage their information. Most do not have the technical skills or resources to protect themselves from cyberthreats or manage their own IT systems. They often need help from professionals with technical experience and special skills.

Absent clear and enforceable contractual language, statutory rights, or other common law rights, it would never be reasonably expected that IT professionals hired and authorized to manage and protect information systems would use their privileged access to disrupt their client or former client’s business for the IT professional’s benefit in a billing dispute.

Such conduct would be a marked departure from ordinary standards of decent behaviour. [ 4 ] In this case, the Defendant, SysGen Solutions Group Ltd ( SysGen ), was not attempting to steal from its client, the Plaintiff, Serinus Energy PLC ( Serinus ), or to damage Serinus’ IT systems. However, SysGen used its continued access to Serinus’ information systems to remove Serinus’ administrator access to Serinus’ own systems at a time when Serinus (to the knowledge of SysGen) was transitioning away from SysGen to a new IT services provider. SysGen changed Serinus’ administrator passwords which locked Serinus

out from administrative control of its systems, without notice to Serinus and immediately after Serinus disputed a SysGen invoice for services during the transition period. SysGen asserts that it did this to investigate or monitor a security threat to Serinus’ systems. When SysGen failed to return administrator access, and instead made a settlement offer using Serinus’ administrator access as part of a settlement of the billing dispute, Serinus took matters into its own hands and managed to break into its own systems to regain control. [ 5 ] This

summary trial raises issues about the proper

interpretation of the parties’ contract, including an amendment to the contract and its termination provisions. It also raises the questions of whether SysGen breached the contract, committed the tort of conversion, breached fiduciary duties, and whether the tort of intrusion upon exclusion should be recognized in this case. Further, SysGen disputes Serinus’ damages, including the reasonableness of its response and expenses incurred. Serinus also claims aggravated and punitive damages, which SysGen asserts are excluded by a contractual exclusion clause.

Finally, SysGen counterclaims against Serinus for unpaid invoices during and after the transition period, which Serinus has refused to pay. [ 6 ] For the reasons set out below, I find that SysGen breached the contract between the parties and committed the tort of conversion. However, SysGen did not owe fiduciary obligations, and this is not an appropriate case to consider whether the tort of intrusion upon seclusion can or should be recognized in Alberta. SysGen is liable for some of Serinus’ costs in response to SysGen’s conduct, and for punitive damages which are not barred by the contractual exclusion clause.

However, Serinus is also liable to SysGen for some of SysGen’s unpaid invoices for services Serinus received and used. [ 7 ] The net result of this litigation, after set-off, is a judgment in favour of Serinus against SysGen in the amount of $43,874.61 plus pre-judgment interest from June 1, 2020 to the date of this judgment, and post-judgment interest to the date of payment, at the prescribed rate under the Judgment Interest Act , RSA 2000, c J-1 . II. Procedural Background [ 8 ] Serinus filed its Statement of Claim on June 9, 2020.

Serinus claims that SysGen infiltrated Serinus’ IT systems and performed an unauthorized password reset on all of Serinus’ administrator accounts, intentionally blocking Serinus from managing or overseeing its own IT infrastructure, with the intent to ransom Serinus for disputed SysGen invoices. Serinus claims breach of contract, breach of fiduciary duty, conversion, and intrusion upon seclusion.

It claims general damages, aggravated damages, and punitive or exemplary damages. [ 9 ] On June 16, 2020, SysGen filed a claim against Serinus in the Provincial Court of Alberta (as it was then known), claiming $53,000 plus interest for goods and services provided pursuant to contracts alleged between Serinus and SysGen. [ 10 ] On September 9, 2020, Master Mason (as she then was) ordered the transfer of SysGen’s Provincial Court action to the Court of Queen’s Bench (as it then was) and its consolidation with Serinus’ claims in this action. [ 11 ] On October 27, 2020, SysGen filed its Statement of Defence and an Amended Counterclaim which, among other things, amended the Counterclaim to $58,118 and added a claim of unjust enrichment. [ 12 ] On November 9, 2020, the parties consented to the terms of a procedural Consent Order.

They then engaged in a process involving the filing of numerous affidavits and conducted several questionings on affidavits, working toward the

summary trial that was held on March 2 and 3, 2023. III. The Record [ 13 ] The parties relied exclusively on a 1,455-page jointly-filed Compendium of Pleadings & Evidence ( Compendium ), which includes evidence from 13 witnesses. [ 14 ] Serinus’ witnesses were: (

a) Jeffrey Auld ( Auld ), Serinus’ CEO, by way of an affidavit and questioning pursuant to rule 6.7; (

b) Moez Mansouri ( Mansouri ), Serinus’ Head of IT, by way of two affidavits and questioning pursuant to rule 6.7; (

c) Rhonda Yaniw ( Yaniw ), Serinus’ Head of Corporate Administration, by way of two affidavits and questioning pursuant to rule 6.7; and (

d) Stephen Mathezer ( Mathezer ) of iON United Inc ( iON ), by way of an expert report and questioning thereon. [ 15 ] SysGen’s witnesses were: (

a) Lyle Richardet ( Richardet ), SysGen’s CEO, by way of three affidavits and questioning pursuant to rule 6.7; (

b) Shane Jordan ( Jordan ), SysGen’s Director of Service Delivery, by way of three affidavits and questioning pursuant to rule 6.7; (

c) Jordan Charuk, SysGen’s Client Experience Specialist, by way of two affidavits. He was not questioned on his affidavits; (

d) Matthew Mowser ( Mowser ), SysGen’s Technical Account Representative, by way of two affidavits and questioning pursuant to rule 6.7;

(

e) Ryan Pentlichuk, ( Pentlichuk ), SysGen’s Virtual IT Manager, by way of one affidavit upon which he was not questioned; (

f) Michael Swallow ( Swallow ), SysGen’s Manager of Client Services, by way of two affidavits and questioning pursuant to rule 6.7; (

g) Ryan Stock ( Stock ), SysGen’s Field Service Manager, by way of two affidavits upon which he was not questioned; (

h) Sanad Rustom ( Rustom ), SysGen’s Technical Account Representative, by way of three affidavits and questioning pursuant to rule 6.7; and (

i) Christopher Kayser ( Kayser ) of Cybercrime Analytics Inc, by way of two expert reports and questioning thereon. [ 16 ] The parties agreed that the evidence in the Compendium, other than the expert reports which were objected to pursuant to rule 5.36, was admissible evidence subject only to the weight that the court might place on that evidence. [ 17 ] The record before the court was significant. No viva voce evidence was heard or requested and the matter proceeded directly to two days of final argument.

By my estimation, with the significant record the parties condensed what would likely have been a two- week trial into two days of argument. It was, in effect, a “trial in a box”. IV. Factual Background [ 18 ] The material factual background in this matter is largely undisputed. A

summary of the factual background is set out below, which is based on what appears to be agreed or undisputed evidence, or my factual findings. A. The Parties and their Business Relationship [ 19 ] Serinus is a publicly-traded international oil and gas company with active operations and offices in Romania and Tunisia, together with offices in Calgary and London. SysGen is an IT services provider with its head office in Calgary. [ 20 ] The parties’ relationship started in 2010. In May 2010, Serinus (under a previous name) applied for an account with SysGen by executing an Account Application ( 2010 Application ).

The parties disagree as to whether the 2010 Application ever became legally binding on the parties, was in effect at the times relevant in this action, and about its legal effect. B. The FSMA, the Standard Set-Up and Other Services [ 21 ] The parties agree that, in December 2015, they entered into a contract called a Field Service Maintenance Agreement ( FSMA ).

Pursuant to the FSMA, SysGen agreed, for a $11,000 monthly fee, to provide services related to the management of Serinus’ IT systems ( FSMA Services ), including: (1) continuous monitoring; (2) asset management services; (3) maintenance of the security of Serinus’ IT environment without introducing new security risks; (4) holding quarterly business reviews in respect of Serinus’ IT systems; and (5) maintaining the confidence of Serinus’ internal structure and its marketing strategies.

The monthly fee included a guarantee that SysGen would provide an on-site person at Serinus’ Calgary offices on a full-time basis ( On-Site FTE ). The FSMA excluded a number of other IT services from its scope. [ 22 ] It is acknowledged by both parties that, at all relevant times, Serinus owned its IT systems, including its servers. However, the FSMA did not expressly provide how administrator access to Serinus’ IT systems would be handled. The experts agree that there were several potential IT service model structures available to provide the FSMA Services.

SysGen’s preferred practice was to have sole global administrator access over its client’s IT systems, which meant that only SysGen would be able to make changes to the IT systems where administrator access was required. Accordingly, until January 2020, SysGen was set up as the sole privileged holder of global administrator access over the Serinus IT system (referred to by SysGen as the Standard Set-Up ). The Standard Set-Up was in place until end of January 2020. [ 23 ] In addition to the FSMA Services, SysGen provided Serinus other services.

In December 2016, November 2017, and May 2018, the parties agreed to the terms of purchase orders by which SysGen provided Serinus with data backup drives and ongoing storage services ( Data Storage Services ). Further, in July 2018, the parties agreed to the terms of a purchase order by which SysGen would provide Serinus with licences to Office 365 software ( Software Licence Services ). C. The Relationship Strains and Amendment to the FSMA [ 24 ] By June 2019, Serinus had concerns with SysGen’s On-Site FTE, Mowser, who had been the On-Site FTE since 2013.

At a June 2019 quarterly business review ( QBR ) meeting, the parties discussed replacing him. SysGen agreed to take immediate steps to remove Mowser and to work with Serinus to provide different support. By June 2019, Mowser was no longer on-site and the parties implemented a new support structure involving on-site support in the morning and remote support in the afternoon. [ 25 ] The parties explored whether a new FSMA arrangement could be put into place. In July, 2019, SysGen proposed a new FSMA with a lower monthly fee of $9,000 and a two-year term.

It was not acceptable to Serinus, in part because Serinus was not in a position to enter into a new commitment on a two-year term. Serinus advised that the parties would have to revert back to the existing arrangement. [ 26 ] On August 20 and 21, 2019, by email exchange, the parties agreed to amend the FSMA ( FSMA Amendment ), the legal effect of which is in dispute. In

summary, Serinus takes the position that the FSMA was amended to reduce the monthly fee to $9,000, to

replace the On-Site FTE with on-site support in the mornings and remote support in the afternoons, and to convert the FSMA to a contract with a month-to-month term.

SysGen agrees with Serinus’ position regarding the monthly fee but says that the amendment did not change the provisions of the FSMA dealing with its term or termination. [ 27 ] Following the FSMA Amendment, SysGen invoiced and Serinus paid $9,000 per month and Serinus no longer received the equivalent of the On-Site FTE. [ 28 ] In fall 2019 and early 2020, the relationship between the parties continued to be somewhat strained, particularly in respect of Auld’s dealings with SysGen and his dissatisfaction with SysGen’s services. D.

Serinus Requests and Receives Administrator Access to Serinus’ Systems [ 29 ] In January 2020, Mansouri was appointed Serinus’ Head of IT with the mandate of managing and supervising Serinus’ IT infrastructure. Mansouri wanted Serinus to have administrator access to its own systems ( Administrator Access ) to reduce risks in the event a problem arose that required immediate administrator access. The Standard Set-Up was no longer acceptable and he requested SysGen provide him Administrator Access. [ 30 ] SysGen initially refused to provide Mansouri with Administrator Access.

On January 29, 2020, SysGen (Jordan) met with Serinus (Auld) to explain SysGen’s intent to maintain the Standard Set-Up, and provided Serinus a letter indicating that it could not provide Mansouri Administrator Access as long as the Serinus infrastructure is SysGen’s responsibility. [ 31 ] Serinus responded by demanding that Mansouri be provided Administrator Access by January 30, 2020, failing which Serinus would consider the FSMA to have been terminated with cause. SysGen relented and provided Mansouri with Administrator Access.

When it did so, it stated: “Please note SysGen is no longer responsible for the environment or if anything breaks now that we have provided access to another party”. Serinus replied: “You have provided access to you [sic] client. Your responsibilities remain intact”. E. SysGen’s Termination of the FSMA [ 32 ] Deviating from the Standard Set-Up was not acceptable to SysGen due to its concerns over liability. Accordingly, on January 31, 2020, SysGen wrote to Serinus to terminate the FSMA ( Termination Letter ).

The Termination Letter provided (emphasis in original): Effective today, January 31, 2020, SysGen are here by providing notice of termination of our Managed Services Contract with Serinus Energy. Per the agreed to contract terms, SysGen are providing 90 days’ notice of termination of services.

Effective May 1, 2020, SysGen will no longer provide on-site/off-site Managed Service Support with the exceptions below: 1) Microsoft Office Licensing [...] 2) SysGen Back-up and Business Continuity Service [...] As part of this 90 day notice period : 1) SysGen agrees to work with Serinus Energy to transition services in an expeditious and professional manner. 2) SysGen has already provided administrator access and passwords to Serinus IT personnel. 3) Should any disruption of services be caused by any Serinus internal IT personnel or third parties, SysGen will not be held liable. 4) If SysGen is required to remedy any issues outside of our normal FSMA agreement these hours will be billed back to Serinus Energy at a time and materials rate of $160 paid in advance to SysGen before work will commence. 5) We respectfully ask that all and any outstanding amounts are paid to SysGen prior to May 1, 2020. [...] [ 33 ] Serinus did not respond to the Termination Letter. [ 34 ] Following the Termination Letter, SysGen’s services were primarily related to the transition of services.

However, SysGen continued to provide some FSMA Services, Data Storage Services and Software Licence Services in February, March and April 2020. For example, Serinus continued to make service requests to SysGen, SysGen continued to log into accounts on the Serinus system, SysGen continued to provide at least some regular recurring managed service (or “service level agreement” events as outlined in the FSMA), and SysGen continued to provide reports that it had normally provided under the FSMA.

SysGen continued to provide on-site services until at least mid March 2020, although the FSMA Services related to on-site and remote support were reduced after February 2020. During this period, Serinus paid at least one invoice in respect of the FSMA Services. [ 35 ] There is a dispute about the effect of the Termination Letter and SysGen’s entitlement to be paid for the various services after it was sent. F. Serinus Retains IT Ops and Shuts Down Office Due to COVID [ 36 ] Following the Termination Letter, SysGen did not provide a formal transition plan. Mansouri began more actively managing

Serinus’ IT systems. By mid-February, Yaniw had directed Serinus staff to send their IT requests to Mansouri, although, as noted above, some IT service requests continued to be made to SysGen.

In early March 2020, Serinus repeated its request for an inventory of all Serinus software licenses and access logins for those licences, which Serinus needed as part of the transition of services. [ 37 ] By early March, as part of the transition away from SysGen’s services, Serinus did several other things, including: (1) resetting passwords; (2) installing its own monitoring software ( Site 24x7 ); (3) installing a cloud-based application ( Altera ) to allow Mansouri to remotely access Serinus computers; (4) retaining a Calgary-based IT services company, IT Ops, to assist with the management of Serinus’ Calgary server and to replace some of the FSMA Services previously provided by SysGen; and (5) providing IT Ops with Administrator Access. [ 38 ] Serinus took at least some of these steps without consulting with or giving notice to SysGen.

However, by March 4, 2020, SysGen employees, including Rustom, Stock and Jordan, became aware of some of Serinus’ transition steps including that Serinus had been making “backdoor administrator level changes” to Serinus’ systems, and that Serinus had retained a new IT services provider to which Serinus had provided Administrator Access. In fact, in early March, Rustom met with Serinus and IT Ops’ representative, James Idris ( Idris ), in respect of the transition of services. At that time, Jordan, as SysGen’s Director of Service Delivery, did not see Serinus’ transition steps as a security threat.

SysGen did not advise Serinus that those steps were problematic and did not take any immediate steps in response to secure Serinus’ IT environment or remove Serinus’ or IT Ops’ Administrator Access. [ 39 ] By March 15, 2020, when Serinus shut its Calgary office down due to COVID, Serinus had provided written notice to SysGen that IT Ops was its new IT service provider and that IT Ops may wish to work with SysGen as part of the transition of services from SysGen to IT Ops. [ 40 ] During March 2020, SysGen continued to provide transition services and at least some FSMA Services, including remote support and some on-site support until March 15, 2020 when Serinus shut its offices down.

G. Serinus Requests Removal of SysGen’s RMM Software [ 41 ] On April 2, 2020, Serinus requested that SysGen remove SysGen’s remote monitoring and management software ( RMM Software ), known as “LabTech”, from Serinus’ systems. The RMM Software was required by SysGen to remotely access Serinus’ system and was a step consistent with the transition of services away from SysGen. In response to the request, SysGen confirmed that its RMM Software was being automatically removed from any Serinus online machines and would take several hours. However, SysGen did not remove all the RMM Software.

It retained the ability to remotely access Serinus’ system. H. The Disputed Invoice and the Administrator Lockdown [ 42 ] By a letter dated April 20, 2020, but sent by email in the early morning of April 21, 2020, Serinus wrote to SysGen ( Dispute Letter ) to dispute ( Billing Dispute ) Invoice ADV-39769, notwithstanding Serinus had paid the invoice almost a month earlier. [ 43 ] In the Dispute Letter, Serinus disputed the legal effect of the Termination Letter with SysGen for the first time.

Serinus took the position that the Termination Letter was a letter of resignation effective January 30, 2020 and that SysGen had invalidly attempted to create a 90-day notice period upon its resignation. Serinus requested SysGen to provide the contractual basis upon which SysGen was entitled to continue to be paid its fees. [ 44 ] On April 20 or 21, 2020, Jordan advised SysGen’s CEO, Richardet, about surreptitious third-party access and changes to Serinus’ IT systems.

Richardet instructed SysGen’s Manager of Client Services, Swallow, to return Serinus’ system to the Standard Set- Up, so that SysGen was the sole privileged holder of global administrator access over Serinus’ IT system ( Administrator Lockdown ). [ 45 ] Using, at least in part, the SysGen’s LabTech RMM Software that Serinus had requested SysGen remove, Swallow implemented the Administrator Lockdown at approximately 10:06 am on April 21, 2020 by resetting certain passwords.

Following the Administrator Lockdown, certain Serinus accounts were disabled, Serinus and IT Ops no longer had Administrator Access to Serinus’ Calgary IT server (and in particular its domain controller), Mansouri and Idris had lost their email access entirely, and Serinus access to SQL service accounts used for a Serinus geological project database were disabled. As Mansouri deposed: “Serinus could not maintain, change, manage or have any visibility into the functioning of its own IT systems”. Serinus could not continue to transition its services to its new IT provider.

It only had end-user access. [ 46 ] SysGen did not seek or obtain Serinus’ specific authorization to implement the Administrator Lockdown. It provided no advance notice to Serinus. I. Response to the Administrator Lockdown and the Billing Dispute [ 47 ] On April 21, 2020, within a few hours of the Administrator Lockdown, Serinus realized it no longer had Administrator Access and that Swallow was remotely accessing its system. Serinus advised SysGen that it had lost Administrator Access, and asked SysGen for information about why that had happened and who Swallow was.

SysGen confirmed Swallow was a SysGen employee, that SysGen “would have a response for you soon,” and that they were “investigating and working on it”. SysGen did not advise Serinus that SysGen had completed the Administrator Lockdown, or why Serinus had lost its Administrator Access, even though SysGen knew these things. [ 48 ] Using its own Altera RMM Software, Serinus managed to access and observe its Calgary server and to get the logs for the account responsible for the Administrator Lockdown (an account named “Waterboy”).

In the very early hours of April 22, 2020, Serinus emailed the password logs to SysGen, asked SysGen whether a SysGen computer had been infected with malware, and requested more information about the Waterboy account and what was going on. Serinus advised SysGen it was a “very high level security issue for our

infrastructure”. [ 49 ] SysGen never responded to Serinus’ email. However, after Serinus sent SysGen this email, SysGen uninstalled Serinus’ Site 24x7, Altera and other remote access software. With its own RMM software uninstalled, Serinus could no longer remotely access its own systems and could not provide IT support to Serinus staff. However, with Administrator Access, SysGen continued to have access to all of Serinus’ data and information on Serinus’ Calgary server. At that point, Serinus for the first time believed that SysGen was deliberately denying Serinus Administrator Access.

Mansouri notified Serinus’ CEO, Auld. [ 50 ] Later on April 22, 2020, SysGen responded to Serinus’ Dispute Letter. SysGen’s response asserted its right to be paid for the disputed invoice and future invoices for its services since the Termination Letter.

SysGen’s response did not mention the Administrator Lockdown or provide Serinus any information about it. [ 51 ] On April 23, 2020, Serinus responded to SysGen about the Billing Dispute, but also stated: Finally, I would draw your attention to a deeply concerning incident that occurred on 22 April 2020. [1] At approximately 10:00 am MDT we registered and retained logs on an unidentified device accessing our active domain server. This device had access with high level administration account credentials and whilst in the system changed all the domain administration passwords.

Please investigate and confirm that this unauthorized device was not undertaken by, or with the knowledge of, SysGen, its employees or associates. If any such person was involved, we request that any revised passwords be provided to us immediately so that we may regain fully [sic] access Serinus’ IT assets and systems.

Your written confirmation is required immediately. [ 52 ] SysGen did not respond. [ 53 ] On April 24, 2020, Serinus’ counsel wrote to SysGen, asserted that SysGen was hijacking Serinus’ systems, and demanded that SysGen immediately return Administrator Access to Serinus by 6 pm that day, failing which Serinus “will be taking steps to restore its access including through the Courts without further notice to you”. In the meantime, Serinus began taking preparatory steps to regain access and had shut down its servers by late afternoon on April 24. [ 54 ] SysGen responded immediately to the April 24, 2020 letter.

However, it did not return Administrator Access to Serinus. Instead, it sent an offer through its legal counsel, the full contents of which are not in evidence. [ 55 ] SysGen had not restored Administrator Access by the 6 pm deadline. Serinus’ CEO instructed Mansouri to do whatever it took to restore Serinus’ control of its IT systems. [ 56 ] Serinus worked with IT Ops over the weekend and, by April 26, 2020, using a forced administrator password reset with a server boot disk, had restored Serinus’ control over all the administrator accounts on its Calgary server ( Serinus Restoration ).

There is a dispute between the experts as to the appropriate characterization and reasonableness of what Serinus did to regain control of its IT systems. SysGen’s position is that the Serinus Restoration was a reckless self-help measure. [ 57 ] After the Serinus Restoration, SysGen no longer had access to Serinus’ Calgary server. [ 58 ] On April 27, 2020, Serinus retained iON to perform a cyber incident investigation with a view to securing Serinus’ environment from any further unauthorized access and ensuring there were no “time bombs” or further threats in the system.

Serinus relied on input from iON and Mansouri in authorizing the iON work ( iON Work ), which included creation of a May 19, 2020 report. [ 59 ] In its Stament of Defence, SysGen asserted that the Administrator Lockdown was the continuation of the FSMA Services during the 90 day notice period, and was a response to a security threat in the Serinus system. V. Issues [ 60 ] The issues in this

summary trial application are: (

a) Is this an appropriate matter for

summary trial? (

b) Are the expert opinions admissible? (

c) Is SysGen liable to Serinus for breach of contract? (

d) Is SysGen liable for conversion? (

e) Is SysGen liable for breach of fiduciary duty? (

f) Is SysGen liable for the tort of intrusion upon seclusion? (

g) If SysGen is liable to Serinus, what are its damages, including: (

i) What are Serinus’ compensatory damages? (ii) Is this an appropriate case for punitive damages? (

h) Is Serinus liable to SysGen on the Counterclaim? (

i) If Serinus is liable to SysGen, what are SysGen’s damages?

VI. Analysis A. Is this an Appropriate Matter for

Summary Trial? [61]

Part 7, Division 3 of the Alberta Rules of Court, Alta Reg 124/2010 (Rules) governs

summary trials. [62] The well-established and binding test for whether a

summary trial is appropriate is twofold: (1) can the court decide disputedquestions of fact on affidavits or by other proceedings authorized by the Rules for a

summary trial? and (2) would it be unjust to decidethe issues in such a way? See: JN v Kozens, 2004 ABCA 394 at para 40; Imperial Oil v Flatiron Constructors Canada Limited, 2017ABCA 102 at para 24; SHN Grundstuecksverwaltungsgesellschaft MBH & Co v Hanne, 2014 ABCA 168 at para 9. This test must beviewed through the lens of proportionality: Benke v Loblaw Companies Limited, 2022 ABQB 461 at para 16. [63] Whether the first part of the twofold test will be met will depend on the nature and quality of the material before the court:Compton Petroleum Corp v Alberta Power Ltd, 1999 ABQB 42 at para 20.

Perfect evidence is not required. The evidence need only besufficient to permit the judge to find the facts necessary to adjudicate the issues of fact or law and reach a just result: 956126 Alberta Ltdv JMS Alberta Co Ltd, 2020 ABQB 718 at para 225, citing Beaver First Nation Band v Bulldog, 2004 ABCA 79 at para 5; Goulbournev Buoy, 2003 ABQB 409 at para 26. Further, conflicting evidence is not alone a bar to

summary trial if the conflict can be resolved byreference to other evidence, or if the disputed evidence is immaterial: 571582 Alberta Ltd v NV Reykdal & Associates Ltd, 2000 ABCA330 at paras 2–4 ; Jagodnik v Oudshoorn, 2015 ABQB 456 at para 5; WestJet v ELS Marketing Inc, 2013 ABQB 666 at para 63, rev’din

part 2014 ABCA 299; Benke at paras 13–19; Compton at para 20. [64] In this case, the parties have done an excellent job and spent significant resources marshalling and organizing the evidence ofnumerous witnesses, several of whom have been questioned on their affidavits. There is an extensive documentary record. Both partiesagree that there are not significant disputes in the evidence as to “what happened”, but rather disputes about the legal effect of things thathappened.

Both parties agree that a trial judge would not likely obtain any further or better evidence than that presently before the court. [65] With respect to the second part of the test, for many years Alberta courts have frequently referred to a non-exhaustive list offactors to consider whether it would be unjust to proceed by

summary trial: Schaufert v Calgary Co-Operative Association Limited,2021 ABQB 579 at para 4; Jagodnik at para 3; Factors Western Inc v DCR Inc, 2019 ABQB 971 at para 35; HOOPP Realty Inc vGuarantee Company of North America, 2018 ABQB 634 at para 17; O’Neil v Yaskowich, 2018 ABQB 599 at para 12; Duff v Oshust,2005 ABQB 117 at para 24; Compton at para 21; Adams v Norcen Energy Resources Ltd, (ABQB), 248 AR 120 atpara 19. [66] Those factors are: (

a) the amount involved; (

b) the complexity of the matter; (

c) its urgency; (

d) any prejudice likely to arise by reason of delay; (

e) the cost of taking the case forward to a conventional trial in relation to the amount involved; (

f) the course of the proceedings; (

g) whether all witnesses or only some were (will be) cross-examined in court; (

h) whether there is a real possibility that the defendant can bolster its evidence by discovery of the plaintiff’s documents andwitnesses; and (

i) whether the resolution will depend on findings of credibility. [67] I would add to this list: whether the parties agree that a

summary trial is appropriate. The Court of Appeal has warned courtsthat we should not give unreasonable weight to the agreement of the parties as to the suitability of the

summary trial process, and shouldnot pre-judge the analysis based on party agreement before the other factors are considered: Imperial Oil at paras 44–46. I interpret thisonly to mean that the parties’ agreement is not determinative but is one factor to consider. In my view, an agreement of

summary trialsuitability is an important factor because it respects that counsel will have the best understanding of the issues at play, because itprovides public access to justice for matters that may not financially justify a full trial process or to parties that may not be able to affordprivate dispute resolution, and because it, in turn, supports the rule of law.

See: Hannam v Medicine Hat School District No 76, 2020ABCA 343 at para 48; Benke at para 7. [68] Courts must also consider the existence of credibility issues in context. “Credibility” issues include both issues of credibility(sincerity or willingness to speak the truth as the witness believes it be) and reliability (accuracy of an honest witness’ evidence): R vDelmas, 2020 ABCA 152 at para 25, citing R v Morrisey, (ONCA), 22 OR (3d) 514.

One of the factors a court canconsider in assessing credibility is to observe demeanour, which might include responsiveness, fairness, and objectivity versusevasiveness, exaggeration and partisanship: 557466 Alberta Ltd v McPherson, 2022 ABQB 23 at para 112. While first-hand observationof demeanour is preferable, some aspects of demeanour can be assessed (albeit imperfectly or at times with more difficulty) throughreview of a questioning transcript and other records. [69] Further, Courts of Appeal have cautioned against over-reliance on demeanour because it may have limited value: R v Giroux,

2017 ABCA 270 at para 7; R v Rhayel, 2015 ONCA 377 at para 85. Other non-exclusive and overlapping factors in assessing credibilityinclude (

a) the plausibility of the evidence; (

b) independent supporting or contradicting evidence; (

c) the external consistency of theevidence; (

d) the internal consistency of the evidence; and (

e) the balance of the evidence: R v Harris, 2022 ABKB 759 at para 19, citingJustice David M. Paciocco, “Doubt about Doubt: Coping with R. v. W(D.) and Credibility Assessment” (2017) 22 Can Crim L Rev 31 at65. And, further, courts may use the reason and common sense, life experience and logic provided they do not fall into prejudicial orstereotypical reasoning: Delmas at para 31; R v ARD, 2017 ABCA 237, aff’d R v ARJD, 2018 SCC 6; Harris at para 20. First-handobservation of live witnesses is often important to resolve credibility, but in some civil cases will not be necessary or a proportionateprocess. [70] In my view, courts should be reluctant to refuse to hear a matter by way of

summary trial too readily only because ofcredibility issues. This is particularly so where the parties agree that

summary trial is appropriate, knowing full well the contents of therecord and any conflicts or credibility issues arising in the evidence. [71] Whether credibility can be fairly determined in a transcript-and-records-based

summary trial will be directly correlated to therobustness of the record. The more well-prepared and concise the affidavits, the more those affidavits are tested by questioning, and themore objective documentary or other evidence there is available, the more likely the court can resolve credibility without having toobserve the witnesses first-hand. In those circumstances, courts should give the evidence a hard look before refusing

summary trials infavour of a full trial process. [72] On the other hand, where parties provide affidavits that are unsupported, untested or questioned upon, or that make baldassertions or conclusory statements, vague references, personal opinions, or hearsay, it will be more difficult for the court to proceedwhere there are conflicts or credibility issues. If parties expect a

summary determination, they must ensure there is an appropriate record. [73] In this case, the amounts at issue are relatively small. The matter is reasonably complex but not unduly so. The parties haveexpended significant resources preparing affidavits; and conducting numerous questionings on affidavits, to put a robust record beforethe court. It is doubtful that much more additional evidence would be garnered through an expensive and delayed trial process. There aresome credibility issues, the key one being whether SysGen’s evidence of the reason it initiated the Administrator Lockdown is honest orreliable evidence. Both parties agreed the matter is appropriate for

summary trial. I am satisfied, having completed my detailed reviewof the evidence, that there is sufficient evidence for me to make fact findings, to resolve any credibility issues, and that it would be just toresolve this dispute on the record before me. I do not require viva voce evidence in this matter. B. Are the Expert Opinions Admissible? [74] Each party relies on an expert report. The experts were extensively questioned before trial. The reports and the questioningtranscripts were included in the Compendium. Several factual witnesses swore affidavits directly responding to the expert evidence.

As amatter of efficiency, the parties agreed that, rather than making a preliminary ruling on admissibility of the expert reports during thesummary trial, I would decide admissibility and weight to be given to the reports after trial as part of my deliberations. [75] The admission of expert evidence remains a two-step process.

At the first step, the proponent of the evidence must establishthe threshold requirements of admissibility, which are the four Mohan factors from R v Mohan, (SCC), [1994] 2 SCR 9at 20, namely relevance, necessity in assisting the trier of fact, absence of any exclusionary rule, and a properly qualified expert: WhiteBurgess Langille Inman v Abbott and Haliburton Co, 2015 SCC 23 at para 23; R v Bingley, 2017 SCC 12 at para 14. [76] It is within the properly qualified expert component of the analysis that the court considers the expert’s duty to the court to befair, objective and non-partisan, and their willingness and capacity to comply with it: White Burgess at para 53.

The expert’s opinionmust be impartial (reflecting an objective assessment of the questions at hand), independent (it is the product of the expert’s independentjudgment, uninfluenced by who has retained them or the outcome of the litigation) and unbiased (it does not unfairly favour one party’sposition over another): White Burgess at para 32. [77] If the evidence does not meet the threshold Mohan requirements, it should not be admitted: Bingley at para 15. Assummarized in Bingley at para 15: If at the first stage, the evidence does not meet the threshold Mohan requirements, it should not be admitted.

The evidence must belogically relevant to a fact in issue: R. v. Abbey, 2009 ONCA 624, 97 O.R. (3d) 330, at para. 82; R. v. J.-L.J., 2000 SCC 51, [2000] 2S.C.R. 600, at para. 47. It must be necessary “to enable the trier of fact to appreciate the matters in issue” by providing informationoutside of the experience and knowledge of the trier of fact: Mohan, at p. 23; R. v. D.D., 2000 SCC 43, [2000] 2 S.C.R. 275, at para. 57.Opinion evidence that otherwise meets the Mohan requirements will be inadmissible if another exclusionary rule applies: Mohan, at p.25.

The opinion evidence must be given by a witness with special knowledge or expertise: Mohan, at p. 25. In the case of an opinion thatis based on a novel scientific theory or technique, a basic threshold of reliability of the underlying science must also be established:White Burgess, at para. 23; Mohan, at p. 25. [78] At the second discretionary gatekeeping step, the court balances the potential risks and benefits of admitting the evidence inorder to decide whether the potential benefits justify the risks and benefits or potential harm to the trial process: White Burgess at para24; Bingley at para 16.

Those risks, benefits or harm can include prejudice, consumption of time, or confusion: White Burgess at para24. If the probative value is outweighed by its prejudicial effect, it should be excluded: Mohan at 21; White Burgess at paras 19, 24;Bingley at para 16. [79] I consider the proposed expert evidence below under this framework. 1. Kayser [80] SysGen relies on Kayser’s primary and surrebuttal expert reports. It seeks to have him qualified as an expert in the area of

cybersecurity in information technology administration. Kayser was not involved in the underlying events in this action. [ 81 ] In his report, Kayser answered six questions, but they really surrounded three main topics. Question 1 dealt with whether the Standard Set-Up, and SysGen’s efforts to maintain the Standard Set-Up, was consistent with industry standards.

Questions 2-5 addressed what Kayser defined as a “brute force attack” (or BFA ) to regain access to an IT system, including the risks involved, when a BFA would be a reasonable step to take, what sort of qualifications a person should have before using a BFA, and the potential costs if the risks of using a BFA were realized.

Question 6 addressed whether a cybersecurity incident response would be necessary or reasonable once administrator control was restored. [ 82 ] I find that the questions as presented are logically relevant to issues in the action, namely whether the Administrator Lockdown was in accordance with industry standards, and whether the Serinus Restoration and other steps taken by Serinus in response to the Administrator Lockdown were reasonable in the circumstances (which is relevant to damages).

I am also satisfied that the expert opinion is necessary in the sense that it will assist me in appreciating these matters in issue. There are no exclusionary rules that would preclude its admission. [ 83 ] I have some concerns about Kayser’s qualifications given his lengthy work history, which, until 2016, was focussed on now- outdated computer programming, sales, management and investment advisory work, not cybersecurity or IT.

Further, I am satisfied that, based on his most recent work experience and education over the past number of years, and in particular his Master of Criminal Justice and Graduate Certificate in Cybercrime Investigation and Cybersecurity from Boston University, he is sufficiently and properly qualified to give opinions in the area of cybersecurity. Limitations on his qualifications are better addressed in this case as a matter of weight to be given those opinions.

Further, I find he is not qualified to give opinion evidence on technical aspects of information technology administration, IT managed services, or IT support services. [ 84 ] Kayser’s evidence goes into some details that are tangential at best, and in my view in some areas he spent an inordinate amount of time going down some paths that were not overly helpful to the Court. In oral argument, SysGen’s counsel acknowledged that the evidence respecting the BFA was probably not as relevant as it may have originally seemed.

Had I not had the benefit of the questioning already being conducted, and I was determining whether to admit all aspects of his report in the first instance at a trial, I would have found that the benefits of Kayser’s evidence (at least in some areas) was outweighed by the risks to the trial, particularly in relative time consumption and expense. However, I have had to review the questioning transcripts in any event, and limited additional time was spent at trial on the expert evidence.

On balance, in these unique circumstances, I find that the benefit of the admissible evidence outweighs its risks or prejudicial effects. [ 85 ] However, even if qualified as an expert, external independent witnesses must limit their testimony to their area of expertise: R v McPhail , 2019 ABCA 427 at para 4 , citing R v Sekhon , 2014 SCC 15 at para 46 . Embedded in Kayser’s report and questioning testimony are opinions he is not qualified to make, in particular legal opinions about what Serinus or SysGen were “entitled” to do or not do, and interpreting the FSMA or the FSMA Amendment.

That evidence is not admitted and is ignored. Further, I do not admit or rely upon any opinions he gives in the technical aspects of information technology administration, IT managed services, or IT support services. [ 86 ] Further, at times Kayser was argumentative and in my view strayed into advocacy, for example in his steadfast attempt to interpret the contractual entitlements of the parties. This did not reach the level of requiring all of his evidence to be inadmissible as contemplated in White Burgess , but it did affect the weight I gave his evidence. 2.

Mathezer [ 87 ] Serinus relies on Mathezer’s expert report and testimony. Unlike Kayser, Mathezer was involved in the events in the underlying litigation. Serinus retained his firm to conduct the iON Work on April 27, 2020. Mathezer’s report responds to Kayser’s report and the six questions, and in doing so also explains what iON did and found as part of the iON Work following the Administrator Lockdown and the Serinus Restoration. [ 88 ] Because he was involved in the underlying events in this matter, Mathezer is a different kind of “witness with expertise” than Kayser.

In Kon Construction Ltd v Terranova Developments Ltd , 2015 ABCA 249 at para 35 , the Court of Appeal noted that there are at least three categories of “witnesses with expertise”: (

a) Independent experts who are retained to provide opinions about issues in the litigation, but were not otherwise involved in the underlying events. This is the category of expert witness contemplated by White Burgess and Mohan . (

b) Witnesses with expertise who were involved in the events underlying the litigation, but are not themselves litigants. An example is the family physician in a personal injury case who is called upon to testify about his or her observations of the plaintiff, and the treatment provided. (

c) Litigants (including the officers and employees of corporate litigants) who have expertise, and who were actually involved in the events underlying the litigation. [...] [ 89 ] Mathezer fits into the second category of witness with expertise. In Kon Construction at para 37, the Court of Appeal suggested that it is prudent to qualify witnesses in the second category much like independent experts who were not involved in the underlying events: [37] It is sometimes argued that the evidence of witnesses in the second category is not “opinion” evidence: Westerhof at paras. 60-1.

To some extent they are testifying about what they observed, and what they actually did. In that sense, they are not opinion witnesses. On the other hand, it is challenging for them to explain why they acted as they did without engaging their professional expertise. For example, the family doctor cannot explain why he or she endorsed any particular treatment without expressing a medical opinion about it. It is difficult to set the boundary between what they did and their expert opinions about what should have been done. Where

witnesses with expertise (who are not litigants) are to testify about events within the scope of their expertise, it is generallyprudent to have them formally qualified as expert witnesses, particularly when they propose to express opinions on collateralissues like the employment prospects of the patient. Further, the overall objective of comprehensive disclosure found in R. 5.1(1)(c &

d) supports the pre-trial disclosure of the opinions of participating experts. [Emphasis added] [90] In responding to Kayser’s report, Mathezer purports to express opinions beyond his direct involvement, and I find it is prudentto go through the two-step process for qualifying him as an expert witness and admitting his report. [91] Mathezer’s evidence is relevant and necessary, for the same reasons outlined earlier for Kayser’s evidence.

Further,embedded in Mathezer’s evidence is also evidence about what exactly he and iON observed when they were working for Serinus, whichis relevant evidence that includes factual evidence. There are no exclusionary rules that would preclude admission of Mathezer’sevidence. [92] With respect to whether Mathezer is a properly qualified expert, Serinus did not clarify the area in which they sought to haveMathezer qualified as an expert. SysGen does not dispute he is an expert in respect of general IT principles.

Based on his education(including his Bachelor of Computer Science), training and experience, I also find he has expertise in cybersecurity assessment and thedesign, implementation, support and management of cybersecurity solutions. I am satisfied, that with respect to Questions 1-5, Mathezeris a properly qualified expert and exhibited impartiality, independence and a lack of bias.

The fact Mathezer was retained by Serinus isnot enough to undermine his independence, impartiality and freedom from bias: White Burgess at para 32. [93] However, I find Mathezer’s evidence in respect to Question 6 should not be admitted. The evidence discloses that Serinusretained Mathezer and iON to assist with the incident response. As part of that, Mathezer and iON advised Serinus about therecommended next steps once Serinus had regained Administrator Access and control of its IT systems.

The question of whether the iONWork was necessary and reasonable in the circumstances effectively puts Mathezer’s advice directly in issue. Mathezer acknowledgedthat an adverse finding about the reasonableness of the response could affect iON’s reputation. I find that there is a realistic concern thatMathezer, while perhaps willing, is unable to provide independent and unbiased expert opinion evidence on the question of whether theiON Work was a necessary and reasonable response. Therefore, Serinus has not discharged its burden to establish threshold admissibilityof that evidence.

Accordingly, “those parts” of his evidence are excluded: White Burgess at para 48. However, this does not render allhis evidence inadmissible, including his evidence in respect of Questions 1-5. [94] Further, as a factual witness with expertise, Mathezer’s evidence about why he and iON recommended particular steps, and toexplain what they did, is admissible.

His observations are admissible as factual evidence: Kon Construction at paras 35–37. [95] For the same reasons as with respect to Kayser, I am satisfied that the benefits of Mathezer’s evidence (other than his opinionevidence specifically related to whether the iON Work was necessary or reasonable in Question 6) outweighs the risks to the trial or anyprejudicial effect. [96] Like Kayser, Mathezer also ventured into legal opinions based on his

interpretation of the contractual or other entitlements ofthe parties. He also referenced and interpreted the Criminal Code, RSC 1985, c C-46. As with Kayser, Mathezer’s legal opinions are notadmitted and will be ignored. [97] Further, I have given less or no weight to certain of Mathezer’s opinions which were based upon incorrect assumptions. Forexample, Mathezer was advised (incorrectly) that SysGen had resigned and was no longer authorized to be accessing Serinus’ IT systemsas of January 2020. 3.

Employees of the Parties with Expertise [98] Neither party objected to the evidence of the other party’s employee witnesses who at the time arguably provided opinionevidence based on their expertise. For example, employee witnesses on both sides have expertise in IT systems (for example, Mansourifor Serinus; and Rustom, Mowser, Pentlichuk and Swallow for SysGen). Given the lack of objection and the principles set out KonConstruction at paras 35(

c) and paras 38–43, any such opinions within their expertise that they gave in the context of explaining whatthey did and why, were admissible and I considered them in the context of all the evidence. C. Is SysGen Liable for Breach of Contract? [99] Although its written argument focused more heavily on its tort and fiduciary duty claims, Serinus’ Statement of Claim pleadsbreach of contract. Contractual issues in this action include whether the 2010 Application was a binding legal contract that continued tobind the parties in 2020, and the

interpretation of the FSMA after the FSMA Amendment (to determine the contractual obligations of theparties at the time of and following the Termination Letter and between the Termination Letter and the Administrator Lockdown). 1. Was the 2010 Application a Contract Binding on the Parties? [100] SysGen argues that the 2010 Application became a binding legal agreement between the parties that was still applicable in2020.

It relies on the 2010 Application primarily in relation to its Counterclaim, which is addressed later in these Reasons. [101] Serinus argues that the 2010 Application was only signed by Serinus as an application or an offer, that SysGen did not sign it,and that there is insufficient evidence of its acceptance by SysGen. It relies on the principle that an acceptance of an offer must becommunicated to the offeror before acceptance is complete and a binding contract is created: Schiller v Fisher, (SCC),[1981] 1 SCR 593, 1981 CarswellOnt 523 at para 8.

Serinus asserts that the 2010 Application is a “foisted unilateral agreement” thatdoes not bind Serinus, relying on: Meads v Meads, 2012 ABQB 571; John W Page Welding Consulting Ltd v Canonbie ContractingLimited, 2014 ABQB 465 at para 48; Park Place Communities Ltd v Wong, 2017 ABQB 725 at para 11.

[ 102 ] I disagree with Serinus’ characterization of the 2010 Application. I find that the 2010 Application was executed and agreed to by Serinus and returned to SysGen. SysGen’s provisions of the blank application to Serinus to fill out was the offer — SysGen offered to provide services if Serinus accepted the terms of the 2010 Application. The execution of the 2010 Application was Serinus’ acceptance. This is clear based on Serinus’ signature line on the 2010 Application, which stated: “the undersigned below warrants the above information is true, and agrees to the Terms and Conditions on the reverse.

Accepted this 12 day of May 2010” (emphasis added). The consideration was that SysGen agreed to provide future services to Serinus based on those Terms and Conditions. [ 103 ] Serinus points to one aspect of the language in the attached Terms and Conditions (relating to credit) as evidence that the filled- out 2010 Application was the “offer” by Serinus to SysGen. That part of the Terms and Conditions provided that Serinus understood that “if our Organization is approved for credit, we will be subject to the terms as specified by SysGen...”. In my view, this does not make the 2010 Application an offer.

It simply provides that, under the 2010 Application agreement, SysGen may accept Serinus for credit and, if that happened, then Serinus agreed to the credit terms.

This conditional credit provision was only one part of the agreement — the 2010 Application agreement also dealt with non-solicitation, third party software indemnity, and limitation of liability, all of which would be applicable even if Serinus was not accepted for credit. [ 104 ] Even if I am wrong in my characterization, there is evidence that SysGen and Serinus worked together for approximately ten years, and that SysGen provided services and invoiced for those services.

If necessary, I would find on the balance of probabilities that, by its conduct, SysGen accepted Serinus’ offer reflected in the 2010 Application. [ 105 ] Accordingly, I find on the balance of probabilities that the 2010 Application was a contract governing the business relationship between Serinus and SysGen. As there is no evidence it was ever terminated, I find that it continued to be an active contract between them as of 2020, including at the time of the Termination Letter and the Administrator Lockdown. 2. The FSMA Amendment [ 106 ] The parties dispute the proper

interpretation of the FSMA Amendment and, in particular, whether it only reduced the price and services under the FSMA, or also amended its term and termination provisions. [ 107 ] The goal of contractual

interpretation is to determine the objective intent of the parties at the time the contract was made through the application of legal principles of

interpretation: IFP Technologies (Canada) Inc v EnCana Midstream and Marketing , 2017 ABCA 157 at para 79 ; Sattva Capital Corp v Creston Moly Corp , 2014 SCC 53 at para 49 .

Contracts must be interpreted in light of the contract as a whole: IFP at para 79; Tercon Contractors Ltd v British Columbia (Transportation and Highways) , 2010 SCC 4 at para 64 . [ 108 ] In interpreting contracts, courts must consider the relevant surrounding circumstances, including the objective evidence of the background facts at the time of execution of the contract, namely the knowledge that was or reasonably ought to have been within the knowledge of both parties at or before the date of contracting: IFP at paras 82–83; Sattva at para 58.

Relevant background facts can include the genesis, aim or purpose of the contract, the nature of the relationship created by the contract, the nature or custom in the industry in which the contract was executed, antecedent agreements leading up to the contract, and even negotiations if they shed light on the factual matrix: IFP at paras 83–85 and the cases cited therein; Alberta Union of Provincial Employees v Alberta Health Services , 2020 ABCA 4 at para 32 . [ 109 ] Surrounding circumstances does not include the parties’ subjective intentions, and surrounding circumstances cannot be used to add to, detract from, vary or otherwise overwhelm the written words: Sattva at paras 59–60; IFP at paras 81–82; Alberta Union at para 26. [ 110 ] If the terms of an agreement are ambiguous, then the court may refer to extrinsic evidence, including the parties’ post- contractual conduct, to resolve the ambiguity: IFP at paras 86–87; Shewchuk v Blackmont Capital Inc , 2016 ONCA 912 at paras 46 , 56.

Mere difficulty in interpreting a contract is not the same thing as ambiguity; a contract is ambiguous when the words are reasonably susceptible to more than one meaning: IFP at para 86. [ 111 ] The surrounding circumstances relevant to the

interpretation of the FSMA Amendment include the following: (

a) the parties had been operating under the FSMA for over three years; (

b) the FSMA had been automatically renewed effective in January 2019 for a term ending January 2020; (

c) the On-Site FTE that had been used for quite some time had been removed and was no longer providing on-site services as of approximately June 2019; (

d) on July 2, 2019, SysGen proposed an updated arrangement in the form of a new Master Services Agreement for a two year term. Serinus advised SysGen that it was not in a position to enter into a new commitment for two years and, therefore: “for now we will just revert back to our existing arrangement”; (

e) at an August 2019 QBR meeting, the parties met to discuss possible changes to the FSMA. Serinus again confirmed it was unwilling to commit to a one or two year term on a proposed agreement. The parties discussed the fact that Serinus continued to pay the FSMA’s $11,000 monthly charge even though SysGen had not provided the “guaranteed” On-Site FTE under the FSMA for July and August; and (

f) at that August 20, 2019 QBR meeting, there was an agreement to continue with the setup where there would be on-site IT support in the morning and remote services in the afternoon, with a reduced price of $9,000 per month. [ 112 ] The FSMA Amendment was then crystallized in a few emails, the pertinent portions of which are set out below:

Serinus to SysGen : Per our conversation last week, the outcome of the meeting was that Serinus could not commit to a one or two year term on the proposed Service Agreement therefore we would need to continue under the terms and conditions of the existing Service Agreement from 2016 where the monthly cost is $11,000 per month which includes a guaranteed full-time resource. Can you tell me when that

schedule will start? We have been without an onsite full-time resource basically for the month of July and August but still paying the $11,000 / month. SysGen to Serinus : I have been meaning to get back to you as I have some great news.

I have been really pushing back with our President about signing a new contract right now and in light of the long term relationship and trying to do what’s best for Serinus as per your current situation, with the understanding that we will be moving ahead with the projects on the timelines we have discussed I have been able to get approval to move forward with the discounted rate of $9000 per month for the FSMA on a month a month to month term beginning September 1. If you can confirm with email approval I will have it revised to the new rate.

Serinus to SysGen : Can you confirm that we will still receive the same service as prior only we won’t have a full-time onsite resource? SysGen to Serinus : Exactly, we would continue with the existing

schedule of having a resource on-site in the morning and remote support in the afternoon. Serinus to SysGen : I approve us moving forward at the new rate. Also, will we receive a discount for July and August on our full fee given we didn’t have an FTE on site? SysGen to Serinus : We were operating under the understanding that this would be updated when a new agreement was signed off. Although we adjusted the on-site support internally we were still dedicating just as many resources to your organization.

In light of you not being able to sign a long term agreement I was able to fight for a special discounted approval moving forward but not to have it backdated. [ 113 ] There is no evidence that the parties further discussed the FSMA Amendment. Its terms were finally accepted when Serinus paid the SysGen invoices with the $9,000 monthly fee. [ 114 ] Serinus acknowledges that the plain, grammatical, and ordinary meaning of the FSMA Amendment indicates that the price of the FSMA was reduced on a month-to-month term, rather than the term of the FSMA being amended.

However, it argues that the surrounding circumstances negate only a month-to-month price reduction and also support a month-to-month term of the FSMA. I disagree. [ 115 ] The surrounding circumstances are used to interpret the words used by the parties, not to overwhelm the words used or to see if they “negate” the plain words used, as argued by Serinus. I find that surrounding circumstances to the FSMA Amendment, and the unambiguous words used in the email exchange comprising the FSMA Amendment, interpreted as a whole and in context, support an

interpretation that the parties only amended the price under the FSMA on a month-to-month basis, which was referred to by a non- lawyer in an email as a “month a month to month term”. [ 116 ] The parties had earlier explored a completely revised FSMA relationship. When that did not work, Serinus confirmed that the FSMA would remain in place and asked when it could expect the On-Site FTE. SysGen then offered a reduced price in return for not having to provide an On-Site FTE, but rather to continue the

schedule of on-site morning support and remote support in the afternoons, even though SysGen had to dedicate the same resources to Serinus either way. The entire email exchange is about the “new rate” for the change in services. There is no objective evidence that the parties exchanged communications about changing the term or termination provisions of the FSMA. [ 117 ] In fact, SysGen’s proposal expressly confirmed the discounted rate “ for the FSMA ”, which is a clear incorporation of the FSMA’s terms but at a new price.

SysGen stated that if Serinus confirmed with email approval, SysGen would have “it revised” to the new rate, which is a reference to revising the FSMA. After confirming Serinus will receive all the same services except the changes to the On-Site FTE, Serinus approved moving forward “at the new rate”, but did not reference any other changes to the FSMA.

When interpreted in the context of the entire email exchange and the surrounding circumstances, the reference to “on a month a month to month term beginning September 1” is a reference back to the price and not the term or termination provisions of the FSMA. [ 118 ] This

interpretation of the FSMA Amendment is also consistent with surrounding circumstance that Serinus did not want a long- term arrangement — under the confirmed terms of the FSMA it could decide to terminate the FSMA before its automatic renewal of the FSMA in January 2020. Serinus’ obligations were short-term. [ 119 ] Further, the revised price made commercial sense in the circumstances. The parties knew that Serinus was not looking for a long-term arrangement. Whether it would continue the FSMA in January 2020 was, therefore, up in the air.

SysGen was offering an 18% discounted price even though the parties both knew that SysGen’s information was that it dedicated the same resources without the On- Site FTE as it did with it. It made business sense that the parties agreed to a temporary price reduction until the parties knew whether the FSMA was continued for another year.

I reject Serinus’ argument that the change to the price could not have been intended to be on a monthly term because the reason for the price reduction was permanent. [ 120 ] Accordingly, I find that the FSMA Amendment amended the price and on-site support services of the FSMA but otherwise confirmed its terms. 3. The FSMA’s Disputed Clause and the Termination Letter [ 121 ] The FSMA provided: Yearly Budgeted Maintenance All FSMA services are contracted for a period of 12 Months commencing on January 12, 2016 (the “Commencement Date”). This

Agreement will be automatically renewed on each subsequent anniversary of the Commencement. Termination of this Agreement or ofany renewal thereof must be received by SysGen on or before the subsequent renewal date. Early termination of the agreement must bepresented as notice in writing, as such it is agreed SysGen Solutions Group will require 90-day notice for transition of services. (Disputed Clause) [122] Serinus argues that the 90-day notice period referenced in the Disputed Clause only applies if Serinus (not SysGen) terminatesthe FSMA prior to its term coming to an end.

It argues that SysGen does not get the benefit of the 90-day notice period if SysGenterminates the FSMA. [123] In Serinus’ correspondence on April 20 and 23, 2020, Serinus took the position that the FSMA did not provide SysGen anytermination rights whatsoever, and that SysGen had ended the FSMA when it resigned on January 31, 2020. In oral argument, initiallySerinus took the position the FSMA was terminated on January 31, 2020, but then acknowledged that there should be some notice of atransition period but the question was what a reasonable period would be.

In its Reply Brief, Serinus took the position that, under theFSMA, SysGen was entitled to one-month (or thirty days) notice for transition of services, but then also took the position that Serinus’request that SysGen remove its LabTech RMM Software on April 2, 2020 marked the “official end” of the transition of services. [124] Serinus’ argument is that the reference to termination of the FSMA or any renewal thereof being “received by” SysGen in thesecond sentence, and the reference to SysGen requiring “90-day notice” for transition of services, only contemplates delivery of notice toSysGen and, therefore, the early termination provisions are a “one-way valve” that only apply when Serinus seeks early termination.

Idisagree with Serinus’

interpretation. [125] The Disputed Clause is titled “Yearly Budgeted Maintenance”, which suggests part of the purpose of the clause is to give bothparties some certainty on an annual basis as to what their costs and obligations will be. [126] Interpreting the Disputed Clause as a whole, in that context, and in the context of the entire FSMA, the Disputed Clause dealswith three distinct concepts. The first sentence addresses the initial term of the FSMA. The second and third sentences address theautomatic renewal of the FSMA for subsequent one-year periods.

Those sentences provide that the FSMA will be renewed automaticallyunless Serinus notifies SysGen of its choice that the FSMA will terminate on its end date — Serinus is not required to provide SysGenwith advance notice of its choice, because it only has to notify SysGen “on or before” the renewal date. If Serinus fails to notify SysGenof its choice, then the FSMA is automatically renewed. The requirement that Serinus notify SysGen of a decision to renew isinformational only because the FSMA will renew automatically if Serinus does nothing.

Notably, the notice requirement here is notformal, does not have to be in writing, and the default is renewal for another yearly term. [127] As Serinus argues, I agree that the last sentence of the Disputed Clause deals with a different situation: early termination of theFSMA before the end date of the then current term. This sentence does not limit the early termination right to only one party. [128] Parties to a business relationship would usually not intend to be bound in perpetuity: Rapatax

(1987) Inc v Cantax CorporationLtd, 1997 ABCA 86 at paras 18–19; Conseil Scolaire Catholique Franco-Nord v Nipissing Quest (Municipalité), 2021 ONCA 544 atpara 30. Whether the parties intended a contract to be of perpetual duration is a matter of

interpretation of the agreement and itssurrounding circumstances: Conseil Scolaire Catholique at para 33, citing Shaw Cablesystems (Manitoba) Ltd v Canadian LegionMemorial Housing Foundation (Manitoba), (MBCA), 143 DLR (4th) 193; Edmonton Kenworth Ltd v Kos, 2018ABQB 439 at para 43. [129] In my view, based on the FSMA, the FSMA Amendment, and the surrounding circumstances, I find that the parties did notobjectively intend their business relationship embodied in the FSMA to be a perpetual contract or one of indefinite length for SysGen butnot for Serinus.

That is, I interpret the FSMA as providing both parties the right to early termination. Under this provision, because it is atermination outside the annual planning by the parties, a more formal notice in writing is required. [130] Accordingly, I interpret the 90-day notice requirement as applying to both parties.

Contrary to Serinus’ argument, unlike theearlier sentences in the Disputed Clause which deal with termination or renewal at the end of the term (which provided expressly for thenotice being “received by SysGen”), the notice provision for early termination only talks about the “90-day notice” being “required” bySysGen (not received by SysGen). 90 days is the agreed notice period for early termination. It is not a “one-way valve” as argued bySerinus. It was the time SysGen required to transition services to a new IT service provider, regardless of which party terminated theFSMA. [131] A problem with Serinus’

interpretation is that it focusses on what it perceives to be the equities now, or at the time of theTermination Letter, and refers to SysGen as receiving the benefit of, or an entitlement to, a notice period. Serinus ignores the fact that therequirement to provide advance notice of early termination could just as easily have worked against SysGen’s interest depending on thecircumstances. Further, Serinus ignores that a notice period, in many situations, would provide a benefit to the customer, Serinus, to giveit time to find a new IT provider without having a gap in critical IT support.

In my view, the FSMA cannot objectively be interpreted toprovide that SysGen could simply terminate the FSMA without notice and walk away. Accordingly, I interpret the reference to “90-daynotice” as the notice period for both parties for early termination, because it was required for SysGen’s transition of services to a new ITprovider. [132] Accordingly, I find that the Termination Letter was not an immediate resignation as argued by Serinus, but was a notice of earlytermination in writing providing 90-days’ notice as contemplated by the FSMA.

Therefore, the FSMA remained in place during thenotice period, subject to its possible earlier repudiation and termination by SysGen as discussed elsewhere in these Reasons. [133] If I am wrong in my

interpretation, and the 90-day notice period only applies to the notice period if Serinus exercises its right toearly termination, then the agreement is silent on the notice period SysGen is required to provide to Serinus (if any). In this instance,Serinus acknowledges some notice period should apply, and argues for a 30-day period. [134] If a court is satisfied that a reasonable notice period applies or should be implied, what is reasonable will depend on the

circumstances of each case, including such factors as the expectations of the parties, the duration or intended duration of the relationship,the dependency of the terminated party on the arrangement and the commercial climate: 1193430 Ontario Inc v Boa-Franc Inc, (ONCA), 78 OR (3d) 81 at para 45; 1397868 Ontario Ltd. v Nordic Gaming Corporation (Fort Erie Race Track), 2010ONCA 101 at para 13. [135] In this case, the parties’ expectations were that the overall relationship was to be evaluated on an annual basis, and that it mayrequire 90 days to effect a transition of IT services to a new provider, during which period Serinus would have some continued need forSysGen services.

In the circumstances, if I was implying a reasonable notice period for SysGen to terminate the FSMA, I find the 90-dayperiod is reasonable and the overall result would be the same. 4. Did SysGen Breach the FSMA? [136] The FSMA obligates SysGen to maintain the security of Serinus’ IT environments without introducing new security risks. Theissue is whether the Administrator Lockdown breached this obligation. [137] “Security” has been defined as “the quality or state of being secure: such as (

a) freedom from danger: SAFETY; (

b) freedomfrom fear or anxiety ...: : https://www.merriam-webster.com/dictionary/security. “Cybersecurity” has been defined as “measures taken toprotect a computer or computer system (as on the Internet) against unauthorized access or attack”: https://www.merriam-webster.com/dictionary/cybersecurity. [138] In my view, SysGen’s obligation to maintain security and to protect from danger or threats includes protecting Serinus fromdanger or threats imposed by SysGen.

This obligation was of increased importance when one of the parties had given an earlytermination notice and the parties were working toward transitioning Serinus to a new IT service provider. [139] SysGen argues that the Administrator Lockdown was implemented in response to a security threat to Serinus’ IT system and,therefore, was performance (not breach) of the FSMA. In many ways, this is the crux of this action. On balance, I find that SysGen’sevidence provides little support for its position, for several reasons. a.

SysGen’s Evidence of When it First Learned of the Security Threat and Decided to Implement the AdministratorLockdown is Vague, Inconsistent and Unreliable [140] Richardet’s evidence is that Jordan told him “on or about April 20” that Administrator Access had been granted to “unknownthird parties”, changes had been made to Serinus’ network, and new software had been installed, all without SysGen’s knowledge orconsent. Richardet

[…]