An IT professional is suing his former employer and Deutsche Bank, alleging the companies retaliated against him after he blew the whistle on a fellow employee who repeatedly brought his girlfriend into the bank’s data center.
The lawsuit, filed by James Papa and first reported by The Register, claims violations of New York State’s Whistleblower Protection Law and alleges a conspiracy to cover up security failures. Papa is also suing Marc Senatore, vice president at the bank who was his direct supervisor.
Papa, employed by IT company Computacenter as a service delivery manager, worked under contract at Deutsche Bank’s New York headquarters. The contract involved maintaining the security of the bank’s critical computer systems housed in dedicated “tech rooms,” according to
A spokesperson for Deutsche Bank, Dylan Riddle, said the allegations in Papa’s claim “are drafted in an attempt to litigate through the press.” He also said the case “lacks merit and we will vigorously defend ourselves.”
Computacenter did not immediately respond to requests for comment.
Papa’s attorney, Christopher Brennan of Ziegler, Ziegler and Associates, also filed a whistleblower retaliation lawsuit against Deutsche Bank
Ramos, a former Deutsche Bank employee, said in the lawsuit he had been unfairly fired after blowing the whistle over alleged violations of Federal Reserve and Securities and Exchange Commission regulations regarding allegedly improper controls and segregation of assets.
Ramos’ allegations “have been thoroughly investigated and were determined to have no merit,” the bank told media outlets after he filed his lawsuit. The bank said it fired Ramos over anti-Asian bias, according to the lawsuit.
In Papa’s case, he said the bank was supposed to restrict access to the headquarters to authorized personnel only. Security protocols required specific credentials for entry to the headquarters and the tech rooms, and they prohibited nonemployees, according to the lawsuit.
According to the complaint, Papa learned in March 2023 that a Computacenter employee, who the lawsuit does name, brought his girlfriend, pseudonymously identified as Jenny, into headquarters and the tech rooms. Security staff at the bank allegedly allowed her entry without credentials or authorization, a “direct violation of the bank’s own established security protocols,” according to Papa.
Papa said he told the employee that such conduct was unacceptable and should not happen again, and the employee allegedly agreed. However, around June 2, 2023, Papa learned the employee had repeatedly brought Jenny into the secure areas in the weeks prior, specifically on days Papa was not present.
The complaint claims Jenny accessed the employee’s laptop while it was connected to the bank’s computer network inside the tech rooms.
Papa later learned Jenny is a “Chinese citizen with significant computer expertise” who traveled to China with the employee shortly after the alleged incidents in June 2023. Security camera footage allegedly showed Jenny inside the tech rooms “physically touching the bank’s computer servers,” the lawsuit claims.
The bank’s subsequent investigation allegedly failed to determine Jenny’s actual identity or if she was working with or for the Chinese government or any cybercrime or espionage entities.
Papa claims he reported the “significant security breach” to his superiors at Computacenter, which the lawsuit describes as “protected whistleblower activity.” After his report, he was instructed to prepare an official complaint for both Computacenter and Deutsche Bank.
Papa attended a meeting on June 23, 2023, where he was “aggressively interrogated by a Deutsche Bank lawyer” while surrounded by lawyers from both companies and Deutsche Bank security representatives.
Papa claims it “became obvious” the bank intended to use him as a “scapegoat” to “cover up Deutsche Bank’s and Senatore’s obvious and egregious security failures.” When Papa pointed out the bank’s security failures, the bank’s representatives at the meeting allegedly “became agitated.”
At the end of the meeting, Papa was informed his employment was suspended until further notice. On July 31, 2023, he was told he was being fired by Computacenter “at the direction of Deutsche Bank, including Senatore,” according to the lawsuit. The alleged reason for termination was that Papa’s whistleblowing activity “had brought too much attention to Deutsche Bank’s security failures” at headquarters.
The lawsuit alleges that neither Deutsche Bank nor Computacenter ever reported the employee or Jenny to any law enforcement agency for criminal trespass or any “potentially significant federal crimes.”
Also, neither company “ever informed the members of the investing public” nor “ever reported to any industry regulator, including but not limited to, the SEC or the Federal Reserve” about the breach, the complaint states.
Regulations typically require that a security breach with a major impact be reported. For example, the SEC requires public companies to report “material” incidents.
Papa claims he was the “only person fired at either Deutsche Bank or Computacenter related to the obvious and egregious security breach.” He alleges the companies “conspired together” to intentionally interfere with his relationship with Computacenter by terminating his employment as a means to “cover up violations of law, rules or regulations by Computacenter and Deutsche Bank.”
The lawsuit seeks significant compensatory and punitive damages from the defendants. It alleges whistleblower retaliation under New York Labor Law, interference with a business relationship, negligence related to the security failure and conspiracy.
The lawsuit was originally filed in the Supreme Court of the State of New York for the County of New York and has since been removed to federal court, in the United States District Court for the Southern District of New York.