---
title: "Two Stories About the Same December"
description: "On October 6, I wrote up Judge P. Casey Pitts's decision denying most of a motion to dismiss Apollo Information Systems Corp.'s claims, arguing the ruling deserved a busy security leader's attention. The case looks different today. In Document 83,"
url: https://kaynemcgladrey.com/blog/two-stories-about-the-same-december/
date: 2026-10-15
modified: 2026-10-15
author: "Kayne"
image: https://kaynemcgladrey.com/wp-content/uploads/2026/10/Adults-working-in-a-modern-office-with-Christmas-decorations-using-laptops.webp
categories: ["Blog"]
type: post
lang: en-US
---

# Two Stories About the Same December

On October 6, I wrote up Judge P. Casey Pitts’s decision denying most of a motion to dismiss Apollo Information Systems Corp.’s claims, arguing the ruling deserved a busy security leader’s attention. [The case](https://www.courtlistener.com/docket/72156744/apollo-information-systems-corp-v-st-john/) looks different today. In [Document 83](https://storage.courtlistener.com/recap/gov.uscourts.cand.462786/gov.uscourts.cand.462786.83.0.pdf), the defendants answer the complaint, concede most of the facts Apollo alleged, and then sue Apollo back. Their counterclaims take the same December 2025 meetings, invoices, and credential changes that carried Apollo’s complaint and recast them as the story of a company hounding a sick employee out the door.

The Answer’s admissions are on the record. The counterclaims are allegations, held to the same standard as the complaint itself, and none of it’s been tested. Both stories can’t be true, and the collision between them is now the whole case. Keep an eye on how differently an incident responder and an HR director would read the same three weeks, because that gap is where this fight’s going to happen.

## The Receipts Get Admitted

### What Survived Dismissal

The [first amended complaint](https://storage.courtlistener.com/recap/gov.uscourts.cand.462786/gov.uscourts.cand.462786.55.0.pdf) alleges two trusted employees quietly built a competing business on company time and sold Apollo $178,790 in subscriptions through entities they controlled. The Answer doesn’t fight the receipts. It fights the meaning.

| What Apollo Alleged | What the Answer Admits |
| --- | --- |
| St. John sold Apollo a $50,000-a-year Northumbria subscription tied to his Sultrani entity | Bought by company credit card on March 13, 2025, through northtools.org, invoiced by Sultrani, after a formal evaluation CISO Dave Tyson initiated, with Tyson approving the purchase |
| DataSchism and CyberGestalt subscriptions for $47,790 and $81,000 went to hidden entities | Invoiced by CyberGestalt to iCounter on November 4, 2025, after Executive Chairman John Watters approved both at October meetings in Dallas |
| St. John registered domains for the venture | northtools.org on December 20, 2024, cybergestalt.ca on September 15, 2025, dataschism.ca on October 31, 2025 |
| St. John wiped his computer before resigning December 5, 2025 | He erased the laptop, which the Answer calls standard procedure for departing intelligence team members, and handed over the password when asked |
| St. John changed locker credentials on December 10, 2025 | He changed the login email on his personal 1Password account to a sultrani.com address, and denies changing the password |

### The Name Problem

The concessions run deeper than money. St. John drew a $309,000 base salary in 2025. Ramon drew $200,000. The Answer concedes that Ramon told Apollo executives he and St. John were business partners in a venture called North Tools, while framing the statement as mistaken and noting that North Tools LLC wasn’t formed until December 30, 2025, after both men resigned, with Ramon joining as a partner on January 1, 2026.

That account has a crack in it, because the same Answer admits St. John used the North Tools name while he was still employed by Apollo. A late-formed LLC coexists uneasily with a name already in circulation during employment, and the defense now has to explain how both admissions fit together.

## The Lockout Meets the Vault Transfer

### The Theory That Carried the Claim

Apollo’s trade secret claim survived dismissal largely on the strength of the lockout. An admin, whom Apollo believes was St. John, changed the login credentials for its encrypted password locker on December 10, 2025, leaving the company staring at its own vault of persona credentials, and [Judge Pitts found](https://storage.courtlistener.com/recap/gov.uscourts.cand.462786/gov.uscourts.cand.462786.82.0.pdf) that enough, at the pleading stage, to support misappropriation.

### The Counterclaim Version

The counterclaims tell a different story about the same vault. St. John’s 1Password account opened on April 22, 2016, before his employment with Cyber Defenses or Apollo began, and he always paid for it himself. On November 13, 2025, Apollo’s Sarah Parker purchased a new 1Password account for the company at Apollo’s expense. Between November 24 and December 1, according to the counterclaims, St. John worked with Parker to move the work vaults from his personal account to the new corporate one, removing them as he went, and Sam Stover confirmed his own access to the transferred vaults on December 4. Six days later, St. John changed the login email on what remained, his personal account, to a sultrani.com address.

> The data used in DataSchism and CyberGestalt was collected through St. John’s own accounts, not through any Apollo account or subscription. (Counterclaims, para. 29)

If the 1Password audit logs bear that out, the misappropriation theory that carried Apollo past dismissal collapses. The evidence sits with a third party, so the answer arrives when discovery does.

## The December Meetings, Retold

### The MS Episode

Multiple sclerosis (MS) doesn’t care about product deadlines, and neither, according to the counterclaims, did Apollo’s leadership. On November 13, 2025, St. John had an MS episode serious enough that his physician ordered complete rest in a low-stress environment for at least a week, followed by a reduced schedule. He told Tyson the next day. Tyson told him to rest.

### What Followed Instead

From November 17 through December 5, Watters, Stover, and Dan Kropp allegedly made remarks nearly every day expressing displeasure with St. John’s absences during his medical leave. Apollo personnel pulled him into meetings scheduled last minute, demanded audits of software and purchases, and pressed him to hit a December 2 deadline Watters had set for a third-party-risk product. Nobody at Apollo ever asked what leave or schedule change his condition required, even though the company had accommodated the same condition in November 2023 with rest at home and half days through most of December.

Then came the three December 2-4 knowledge-transfer sessions that Apollo’s complaint frames as an attempt to recover stolen assets. The counterclaims frame them as video conferences, which Stover recorded in whole or in part, in which he questioned a man on prescribed medical leave about assets St. John says he had already handed over, prompting St. John to call the questions “accusatory.” On December 10, the counterclaims allege, Watters referred to St. John’s departure as his “ADA resignation,” a reference to the Americans with Disabilities Act.

Three disability claims ride on that narrative, brought under the Washington Law Against Discrimination (WLAD) rather than California’s Fair Employment and Housing Act because St. John had worked from Washington since July 2024. He seeks back pay, front pay, damages for emotional distress and aggravation of his condition, and fees under RCW 49.60.030(2).

## Exhibit A Goes on Offense

St. John’s first counterclaim seeks a declaratory judgment that Apollo owns nothing he built before or after his employment. The vehicle is Exhibit A to his 2024 employment agreement, thirteen pages the [motion to dismiss](https://storage.courtlistener.com/recap/gov.uscourts.cand.462786/gov.uscourts.cand.462786.59.0.pdf) described as a list of pre-existing intellectual property. The counterclaims now say it covers hundreds of works, including software tools, scripts, YARA modules, automation notebooks, training courses, frameworks, and seminars, and that Northumbria, DataSchism, and CyberGestalt are the culmination of works on that list. Section 7’s assignment, the argument runs, can’t reach them, because Cal. Lab. Code § 2870 and RCW 49.44.140 both limit what an employer can claim by invention assignment.

Note what Ramon’s Exhibit A says, which is nothing. He listed no prior inventions, so this shield protects one defendant only. Whether the items on that list actually match what shipped as those products is the entire ownership fight, and no public filing tests it yet.

## The Approvals Problem

### Procurement Without Cover-Ups

The defense’s account of the money is the part executives should read twice. Northumbria went through a formal evaluation Tyson initiated to replace Apollo’s threat-intelligence platform, and Tyson selected it. Watters personally approved DataSchism and CyberGestalt at October 22-23 meetings in Dallas attended by more than a dozen Apollo personnel. The counterclaims insist St. John had no authority or means to purchase software for Apollo, with Apollo personnel making each purchase after the company’s own review. When the Northumbria subscription auto-renewed a year later for $50,000 in March 2026, St. John refunded the full charge at Apollo’s request. None of this settles who owned the products, but “we didn’t know” is no longer available as a framing device, and Apollo’s finance and procurement process has some explaining to do regardless of who wins.

### The KeLa Question

Less explained is the KeLa thread. On December 4, 2025, St. John opened a KeLa subscription in the name of Northumbria Tools and asked KeLa to transfer iCounter’s account to Max Tomayko, a former Cyber Defenses intern now contracting for North Tools from Washington. Apollo says Ramon later told executives that the pair used Apollo’s own KeLa subscription to gather dark web information, repackaged it, and sold it back through the competing products. The Answer denies it flatly, which means one of those two accounts doesn’t survive discovery.

## The Clock Starts Running

Fact discovery closes July 30, 2027, with dispositive motions due November 18, 2027. Amended pleadings are allowed through December 30, 2026, so the fiduciary duty claim against Ramon that Judge Pitts dismissed could return. Apollo will answer or move against the counterclaims, which come with structural insurance. They claim both supplemental jurisdiction and diversity under 28 U.S.C. § 1332, and they reserve the ability to keep litigating under Rule 41(a)(2) even if Apollo’s own claims disappear.

Everything that decides this case lives in discovery, from the 1Password audit logs and Exhibit A’s actual contents to Stover’s recordings and whoever heard the “ADA resignation” remark.

## Why This Case Gets Messy

Apollo frames the three weeks as an offboarding gone wrong, the defendants frame them as a disability exit engineered by management, and each side’s strongest evidence is the other side’s alleged misconduct. If you run a security team, your security offboarding process and your HR offboarding process can’t tell different stories about the same events, because a courtroom will pick whichever version survives discovery.