26 September 2023 – Anne Chambers
Hide video Show video
(10.00 am)
Statement by MR BEER re Disclosure
Mr Beer: Sir, good morning, can you see and hear me?
Sir Wyn Williams: Yes, I can, thank you.
Mr Beer: Sir, before we start Mrs Chambers’ evidence this morning, there’s just a short statement I would like to read, if I may, about some recent disclosure.
Sir Wyn Williams: Yes, of course.
Mr Beer: Sir, you will recall that on Tuesday of last week I provided an update to the Inquiry on the Post Office’s late disclosure to the Inquiry. I noted that, since 3 July 2023, so just before the first disclosure hearing, the Post Office had disclosed some 23,000 potentially relevant documents to the Inquiry of which some 15,200 are said by the Post Office to relate to Phase 4 of the Inquiry. I noted that this meant that a high number of potentially relevant documents had been disclosed in the recent past by the Post Office and many of them were presently being processed by the Inquiry.
I also said that nobody should be surprised if witnesses had to be recalled as a consequence of this and other disclosure issues.
On Friday afternoon and yesterday at midday the Inquiry received further updates from the Post Office regarding its disclosure. The update related to an issue that had been highlighted by the Post Office to the Inquiry previously, known as the back-up tapes. It relates to 37 back-up tapes that the Post Office located at one of its sites. The Post Office had provided an update on the back-up tapes on 22 August 2023 in a letter to the Inquiry, disclosed to the Core Participants prior to the 5 September disclosure hearing.
Just for your reference, no need for it to be displayed, the document reference for that letter is POL00124517.
That update had noted that the Post Office had identified some 42 back-up tapes with unknown contents at a site and that the Post Office had, for some time, notified the Inquiry of the steps that it was taking to understand the contents of the back-up tapes, which the Post Office said were substantial in volume, including in particular whether the back-up tapes might relate to matters being investigated by the Inquiry. The number of the back-up tapes was later changed in correspondence to B37.
However, the Post Office noted at that time that, as the back-up tapes:
“… ordinarily reflect a copy of the data that exists elsewhere, they are not ordinarily considered as key repositories to process and search for the purposes of disclosure.”
The Post Office also noted that:
“The files recovered from the dataset sessions on the tapes may be partially or significantly duplicative of files already harvested, searched and disclosed to the Inquiry.”
The Post Office provided a detailed description of the steps that it was taking before it begin to investigate the back-up tapes in that 22 August 2023 letter. This update was detailed and largely of a technical nature.
On 31 August 2023 the Post Office provided further back-up tapes, this was also provided to the Core Participants before the 5 September disclosure hearing. That’s POL00126338, no need to display.
The Post Office noted that it had started its investigation into the tapes and was taking:
“… a two-pronged approach, firstly, using technical policy-based and other means to identify whether the back-up tapes contained meaningful new information and, secondly, concurrently taking steps to allow the Post Office to review the actual data on the tapes to identify whether the tapes contain new information.”
At that time, the Post Office noted that it was not yet able to confirm how long certain steps would take but that it would continue to keep the Inquiry informed and would welcome our thoughts on an appropriate approach to adopt.
Last Friday afternoon at 3.08 pm, the Post Office sent a further update to the Inquiry, regarding the 37 back-up tapes. That back-up tapes update highlighted three key points.
Firstly, an initial analysis of the tapes as performed by KPMG suggested that the content of the tapes are largely non-duplicative. In other words, while the tapes are called back-up tapes, they contain new material. They’re made up of documents that are not already in the Post Office’s Relativity platform from which it reviews documents for potential disclosure to the Inquiry.
Secondly, after performing initial searches, it seemed that a significant number of the back-up tape documents may be relevant to the Inquiry’s terms of reference, including Phase 4.
Third, the date range of the parent emails on the back-up tapes was primarily 2001 to 2008. The Post Office noted that this was a period where their electronic disclosure was more limited and the Post Office had therefore relied more heavily on their hard copy materials. In this sense, the Post Office has, it said, “a present working assumption”, that this material may be unique at least in the main.
The Post Office noted that it was intending to prioritise the review of this material on a witness-by-witness basis and, with this in mind, the Post Office was prioritising the documents responsive to search terms for Anne Chambers and Mandy Talbot. It noted that it had run some searches over the documents for “Anne Chambers” and “Mandy Talbot”, both in speech marks, and this had generated some 208 and 1,060 hits respectively, excluding families.
The Post Office noted that they would provide relevant documents relating to Mrs Chambers as soon as possible and envisage doing so informally by end of day on Friday.
Sir, the Inquiry legal team considered this information urgently on Friday afternoon. In order to get a better understanding of the issue, the legal team asked the Post Office to indeed provide the documents responsive to the search terms for Anne Chambers as soon as possible and also asked the Post Office to provide search hit results for the Phase 4 witnesses who are to be called between today and Friday, 20 October 2023: namely John Jones, Simon Recaldin, Catherine Oglesby Andrew Hayward, John Scott, Rob Wilson, Paul Inwood, Thomas Pegler, John Breeden, Alan Lusher, Alison Bolsover and Marie Cockett.
The Inquiry asked for two sets of results, one with family members and one without, no later than 11.00 am yesterday. At 7.03 pm on Friday evening the Post Office provided documents that had been responsive to Rule 9 requests or otherwise said to be of interest from the “Anne Chambers” search hits of 208 documents. They provided 84 documents in total.
In the meantime and over the weekend, the Inquiry Team urgently considered the 84 new Anne Chambers documents. The Inquiry is of the view that none of the material is sufficiently relevant to Phase 4 issues, however that disclosure did contain new material that may be relevant to Mrs Chambers’ evidence in relation to Phase 3, in particular in relation to knowledge of and action taken in response to bugs, errors or defects.
At 12.14 yesterday, the Post Office provided the search hit results for the remaining four Phase 4 witnesses to be called between 29 September and 20 October. This included expanded search terms beyond just “first name” and “last name” in inverted commas.
Sir, as you would expect, the search results from the back-up tapes vary from witness to witness. One had no hits, some have hits in the hundreds and some have hits in the tens of thousands. Indeed, one witness has some 93,699 hits when you include family members in a broader search.
Last week, I noted that, as had been made clear on previous occasions, when the Inquiry has addressed the issue of late disclosure, all of those interested in the work of the Inquiry, including but not limited to witnesses and Core Participants, should understand that the fact that the Inquiry has decided to continue to hear evidence does not mean that witnesses from whom evidence is about to be taken will be giving evidence just once.
I also noted that the Inquiry will not hesitate to request further witness statement or witness statements from witnesses and call witnesses back to give evidence, in the event that sufficiently relevant material is either disclosed before the witness gives evidence but the Inquiry hasn’t had the opportunity to process it or such evidence is disclosed after a witness has given evidence.
This not only to ensure that all sufficiently relevant material is put to witnesses but also in fairness to witnesses, so they have the opportunity to address all sufficiently relevant material.
On behalf of the Inquiry, I repeat those comments now. Like other late disclosures, once the Inquiry has had a reasonable opportunity to analyse the material that the Post Office has provided from the back-up tapes, the Inquiry will disclose that material to Core Participants and witnesses as required.
If this necessitates the need for supplemental requests, then those supplemental requests will be sent.
Having spoken with you, sir, I make the following additional comments: on 15 September you published a statement following the 5 September directions hearing. You stated that there was a need for close monitoring of the disclosure process during the remainder of the Inquiry, especially as it relates to disclosure from the Post Office. You also directed that the Inquiry would hold a further hearing to consider disclosure issues, on a date to be fixed in the period commencing 8 January and ending 19 January 2024.
Sir, your legal team consider that the material that is disclosed as a result of the back-up tapes ought to be closely monitored, alongside other issues in the lead-up to the further disclosure hearing and, if witness evidence is required on the back-up tapes, both in relation to specific documents that come to light results of that disclosure or on Post Office’s updates in relation to the back-up tapes more generally, then it will be sought in accordance with your directions.
Sir, that’s all I would propose to say on the issue of disclosure now.
Sir, I think you’re still muted.
Sir Wyn Williams: I said thank you, Mr Beer, and I was would just like to add that, as I hope has been clear from Mr Beer’s statement, he has been consulting me throughout the period since Friday afternoon about how we should approach what he has described in relation to the Post Office disclosure.
I wish to make it clear that I did consider whether it was appropriate to stop the process of evidence gathering. Having reflected upon that, I decided it wasn’t, because I am satisfied, at least at the moment, that we can deal with the evidence of Mrs Chambers and those who follow her immediately and also hopefully deal with the appropriate disclosure to Core Participants on necessary documents which have been recently disclosed to us. But, as Mr Beer has stressed, I am keeping all of this under very close review and, if it is necessary to change the approach that I have determined is appropriate, at least for Mrs Chambers’ evidence, I won’t hesitate to change my approach.
So that’s all I wanted to say about that. Thank you, Mr Beer.
Mr Beer: Thank you, sir. May Mrs Chambers be sworn.
Sir Wyn Williams: Well, does she need to be? That was the question I was going to – she was sworn on the last occasion. I’m very happy for her to be resworn, but is it strictly necessary?
Mr Beer: Sir, I reflected on that and I read it the ending of the transcript of the last session and you released Mrs Chambers because there would have been a need for her to speak to her legal representatives and I took that to be a release from the oath, essentially.
Sir Wyn Williams: All right, well, I think Mrs Chambers, unless you have any objection to the course of action proposed by Mr Beer, it’s probably sensible that you be resworn. I’m not going to repeat it but the statement I made to you at the beginning of your evidence back in May, about self-incrimination, applies equally to the evidence you’re about to give, all right?
Anne Chambers
ANNE OLIVIA CHAMBERS (re-affirmed).
Questioned by Mr Beer
Mr Beer: Thank you, Mrs Chambers. As you know, I ask questions on behalf of the Inquiry. You gave evidence on 2 and 3 May 2023, on all of the first day and for some of the second day, about the operation of the SSC, about other service support offered by Fujitsu to the Post Office, about the operation of PinICLs, PEAKs and KELs, about problem management between Fujitsu and the Post Office, and then, for the balance of the second day, about some bugs, errors or defects in the Horizon System.
I said that I would continue to examine some other bugs, errors or defects when you came back to give your Phase 4 evidence. I shall do that probably tomorrow and I should say I’m not going to look at bugs 19 and 23 when we get to them. They, as it seems to me, are adequately addressed in Mr Justice Fraser’s judgment and in other documents that the Inquiry now has. So you’re principally here to give evidence about the work that you undertook in Mr Castleton’s case.
Anne Chambers: Yes.
Mr Beer: Before I get to either the additional bugs or Mr Castleton’s case, I’d just like to pick up on four topics that we addressed on the last occasion where we’ve now got some additional disclosure that I would like to ask you about.
Firstly, ARQs and the SSC.
Anne Chambers: Okay.
Mr Beer: At the end of the last evidence session, this is on 3 May 2023, Mr Moloney asked you about a work instruction that you had been asked to write by the SSC management team in August 2011.
Anne Chambers: Yes.
Mr Beer: There’s no need to display the document at the moment but if you want to refresh your memory we can go back to it. The document is FUJ00138385.
It was suggested to you that a reason that the management team may have asked for all issues concerning litigation to be forwarded to the SSC management team for sign-off might be a financial reason.
Anne Chambers: Yes.
Mr Beer: Yes, that motive or purpose was suggested to you and you said, in summary – and I do summarise – well, that would really be an issue for your managers to answer what their motivation or purpose was?
Anne Chambers: Yes.
Mr Beer: Can we look at a document to see whether this sheds light on the issue, please. It’s FUJ00154665. Can you see that this is an email thread dated 8 August 2007?
Anne Chambers: Yes.
Mr Beer: It’s copied to you, you’ll see you’re last of the copy-ees?
Anne Chambers: Yeah.
Mr Beer: But it’s a message to Penny Thomas and Peter Sewell –
Anne Chambers: Yes.
Mr Beer: – from Mik Peach, your then line manager, yes?
Anne Chambers: Yes, that’s right.
Mr Beer: If we just read the message, Mr Peach says:
“Penny,
“I am not saying that you are confused about the difference between an ad hoc request, an ARQ and a support call – I am saying that the customer is either confused about the difference, or else is making a deliberate attempt to avoid the cost of raising ARQs or ad hoc data requests by raising these as support calls.
“Bottom lines for SSC on these problems is as follows:
“(a) If it is believed there is a system problem which has caused discrepancies, then we will investigate as normal … this includes the calls passed over yesterday although none of these calls says that they believe there is an FS problem, all of them actually indicate there is a mismatch in the figures in POLFS, cause unknown.
“(b) If it is believed that POL are using the support process as a means of avoiding ARQ or ad hoc data request costs then the calls should be referred back to POL (by Liz?) requesting payment.
“(c) If there is any hint of litigation, then we won’t deal with the calls as support calls, but will assist the security team in their analysis.
“There is a significant difference in the system now which is leading to this sort of call, and why there needs to be a more robust application of the process – in the past, reconciliation on the system was done in two different streams within the FS domain – if there was a reconciliation issue, or mismatch in the figures then it had to be in our domain somewhere (even if it was chord by [postmaster] user error).
“The new system means that much of the reconciliation and auditing figures are produced by POLFS, which is not in the FS domain, is a POL system and is managed for them by PRISM.
“Regards
“Mik.”
You’ll see that, in the course of that message, Mr Peach says expressly – he expressly states that a concern is that the Post Office is using referrals to the SSC for investigations to bypass requests for ARQ data that are chargeable; can you see that?
Anne Chambers: Yes.
Mr Beer: Now, although this was before the preparation of the work instruction that you were taken to, does it assist you with your memory as to what the reasons for or the motives were for asking for the work instruction?
Anne Chambers: That was the management’s line, if you like, and had obviously been so for some time. SSC were primarily there to investigate problems as they happened. If you get to the point that it’s months down the line and the evidence is needed, then it was certainly harder for us to investigate because we would need to effectively get the data out of audit anyway and, possibly, this was then seen as, if it’s at that point in the process, then should Post Office have been paying for it?
But I still think this is a question for my management, who were the ones saying this, rather than for me.
Mr Beer: I understand. You see in the first paragraph Mr Peach raises the suggestion that the client, POL, may be making a deliberate attempt to avoid the cost of raising ARQs, essentially by getting the SSC to do the work, and then in (b) says:
“If it is believed that POL are using the support process as a means of avoiding ARQ or ad hoc data request costs …”
Can you recall whether this was a theme in your time that was spoken about within the SSC?
Anne Chambers: I think it was seen that this was an additional service that Post Office were expected to pay for, if they needed this data, and that was part of – I assume, was part of the contract between the two companies but I don’t know that.
Mr Beer: Although you may be right that the motivation for the request for the work instruction is a matter for your managers, either Mr Peach or Mr Parker, I’m asking you: can you recall discussion within the SSC about the facility being abused, essentially, by the client, in order to avoid the costs of ARQ data?
Anne Chambers: It wasn’t something we sat there talking about every day. It’s more likely that there were times, perhaps, when I was being helpful and perhaps doing more things than I should have been, that should have been charged for.
Mr Beer: The paragraph, two from the bottom, beginning “There is a significant difference”; can you see that?
Anne Chambers: Yes.
Mr Beer: Can you read that to yourself or reread it to yourself and assist us, if you’re able, with what it means.
Anne Chambers: I think this is talking about the back-end systems, which I cannot remember all the details of, but there was a big change at some point, and Post Office’s back-end database was now something called POLFS, which was not, as it says, part of the Fujitsu domain but was managed by a third party.
And so before, when – even though it wasn’t necessarily a front-end of Horizon problem, because investigation would have to be done by Fujitsu, then we would have done that, and Mik is now pointing out that now, you know, you’ve got two parties resolved so Fujitsu, perhaps, should not be taking on more than their fair share of it.
Mr Beer: So if an enquiry is raised or an issue is raised by a subpostmaster with the NBSC and work is done, for example, by an investigator to either rule in or rule out a problem on the counter, is this paragraph suggesting that the SSC should take the position that there ought to be further work done behind the scenes at the Post Office to consider any discrepancy or shortfall before the SSC would do any investigatory work?
Anne Chambers: No. This is talking about the reconciliation between the back-end systems, not the counter reconciliation. But there were cases then when Post Office would be looking at the data that was held in POLFS for a branch and there might be some inconsistency with branch figures, whereas they – that had been fed through from Horizon.
This would not necessarily – well, it – I can’t remember specific examples but this is not the postmaster at the end of the week or the month saying “I’ve made a discrepancy”; it’s more possibly the two different systems having different numbers and Post Office trying to work out why that might be the case.
Mr Beer: So Mr Peach isn’t saying that the SSC won’t do the work: he’s just saying that SSC won’t do the work for free; is that right?
Anne Chambers: He’s saying that, in these situations where there’s some inconsistency between – it may be if there’s an inconsistency between POLFS something at an individual branch – I’m not saying – not sure that he’s saying that we didn’t – wouldn’t look at that but this is less about individual branch things. I don’t think I’m going to be able to get much further with this, sorry.
Mr Beer: Well, looking at the email as a whole, is Mr Peach saying that the SSC will only investigate once data has been requested by the Post Office through the Security team and the Security team has asked for assistance from the SSC?
Anne Chambers: It would depend entirely on what the problem was that we were being asked to investigate. Obviously, you know, day-to-day ‘happening now’ problems, they would come into SSC and that would be our normal investigation.
This is things where it is Post Office, probably not NBSC, but the people looking after POLFS and the Post Office financial systems at the back end, or potentially investigating individual branches for litigation, or whatever, those requests would come in through the Security team and I believe it’s just sort of pointing out to Penny that she mustn’t then just pass them on to SSC as support calls but they needed to be considered as to whether they fitted better into the ad hoc request or the ARQ process.
Mr Beer: The paragraph at (c), “If there is any hint of litigation, then we won’t deal with the calls as support calls but will assist the Security team in their analysis”; can you remember whether that was fleshed out at all, what “any hint of litigation” might be? Whether it was the postmaster alleging faults with Horizon, if there were unexplained shortfalls, if there were investigators or auditors involved? What was the trigger for saying, “No, we won’t deal with this, this needs to be routed through a Security team”?
Anne Chambers: That was a decision for Penny to make, what she was hearing from the people raising the calls within Post Office.
Mr Beer: So she was the gatekeeper, was she?
Anne Chambers: For the type of queries and calls that are being talked about here, it is talking about calls that are coming in through the Security team.
Mr Beer: What I’m trying to work out is how it worked on the ground, in the light of this email after 2007. If a PEAK is raised with the SSC, how it was established whether this was a genuine support call or whether it was something which disclosed a hint of litigation and had to go down a different route?
Anne Chambers: Yes, I think – this is talking about the calls that were coming in through the Security team, not the calls that were coming in through the Helpdesk?
Mr Beer: So the whole email you read as being only about calls coming in through the Security team?
Anne Chambers: Yes, yes. That’s what it’s addressing.
Mr Beer: Where do you see that?
Anne Chambers: Because it’s sent to Penny Thomas and is obviously part of a discussion with her and it’s – the top two people on the distribution list are the Security team, and that’s who it’s sent to, and then it’s copied to Service Managers and just a couple of us within SSC who possibly had been dealing with calls that had come in through Penny, and so Mik wanted to make us aware of what he was saying. I really can’t remember.
Mr Beer: Can you recall any instruction or advice that, where there was believed to be a risk of litigation, which, for the most part, meant criminal prosecutions, the Post Office and Fujitsu should work especially closely together, rather than bouncing the issue back to the Security team and saying “Either you pay for an ARQ set of data before we do any further investigation work”?
Anne Chambers: I think we were expecting, as I say, Penny to talk to her Post Office contacts and find that before taking it over. I mean – yeah, sorry, I don’t think I can answer your …
Mr Beer: Yes. Would you agree that, in cases that may be heading towards a criminal prosecution, it was necessary for the Post Office and the SSC to work particularly closely together to ensure that the right data was analysed and, if necessary, harvested and retained?
Anne Chambers: I think this was – that was the responsibility of the Security team, not the responsibility of SSC at that point. If there was examination of that data then needed in the run-up to a case, then I believe the Security team would normally talk to Gareth Jenkins, or somebody like that, to do the analysis and it’s possible that somebody like me might then have been roped in to assist. I think, certainly from 2007, you could say, yes, that’s what would happen.
But if a call had come in through the NBSC from a postmaster saying “I’m making losses and I think it’s the system at fault”, then, if this was a current ongoing situation, then, yes, that would certainly be looked at by SSC in the first instance. The fact that it might at some point later end up as litigation wouldn’t stop us from looking at it at that very early stage.
Mr Beer: Lastly on this document, at the end of (c) “but will assist the Security team in their analysis”. Was there any developed, written protocol that set out the steps that would be taken by the SSC in assisting the Security team in their analysis of data where there was a hint of litigation?
Anne Chambers: I have no recollection of anything written about that.
Mr Beer: Was there, short of anything written, any clearly articulated set of requirements on what needed to be analysed, what data needed to be harvested –
Anne Chambers: No, because –
Mr Beer: – and what needed to be retained? It was done on a case-by-case basis; is that right?
Anne Chambers: The data would have been the ARQ data and SSC had no access to the servers on which that was stored.
Mr Beer: Thank you.
That was the first topic. The second topic, if I may turn to it, Horizon data integrity. Could we look, please, at FUJ00155493. If we just look here, we can see your email at the top of the page to Mr Jenkins.
Anne Chambers: Yes.
Mr Beer: Then if we scroll down, please, we can see Mr Jenkins’ email to you and others at the foot of the page. If we just go over the page, we can see he signs it off. So, if we start at the foot of page 1, please, and see what Mr Jenkins said. “All”, and you can see this is addressed to Allan Hodgkinson, Jeremy Worrell, you, Jim Sweeting, Chris Bailey, copied to Latoya Smith and John Burton.
Anne Chambers: Yes.
Mr Beer: He says “Jeremy has asked”; is that Jeremy Worrell in the distribution list?
Anne Chambers: I presume so but I don’t really have any memory of him.
Mr Beer: Were there other, relevant Jeremys in the SSC or –
Anne Chambers: Certainly nobody – that wasn’t somebody in SSC.
Mr Beer: No.
“Jeremy has asked me to produce a paper on Horizon Data Integrity to support [the Post Office] in refuting claims by postmasters that Horizon is causing money to be lost.
“I’ve put together an initial draft. I’ve ignored the ‘front bits’ for now and am currently looking for comments on the technical aspects and in particular the comments in yellow.”
Then there’s a character string indicating that there was an attachment, I think.
Anne Chambers: Yes.
Mr Beer: “Also if anyone is aware of other material to feed in on this, I would be grateful. I had a quick look through PVCS … “
Can you recall what PVCS was?
Anne Chambers: That was the document storage system.
Mr Beer: “… and a search through the TED …”
Can you recall what the TED was?
Anne Chambers: No.
Mr Beer: “… and found nothing useful there.
“Note that this is NOT yet in a state to go to [the Post Office] and once I’ve had feedback from all of you (and anyone else you think is relevant), Jeremy needs to pass this through Commercial.”
What was Commercial?
Anne Chambers: I presume the – a department in Fujitsu.
Mr Beer: Reading on:
“We have a [conference] call with [the Post Office] at 4 pm on Friday, so I’d appreciate any feedback by lunchtime Friday …”
Then a comment addressed to Jeremy, just scrolling down:
“Do you have any thoughts as to where this should be lodged in Dimensions. I assume we need to make this a formal document, but if not, I’m happy to remove the ‘front bits’.”
Then it’s signed off “Regards, Gareth”.
Just going back to the distribution list, peace. Can you help us with the other people there: Allan Hodgkinson, do you recall him and what position he had?
Anne Chambers: He was one of the senior designers. I can’t remember.
Mr Beer: In the development team?
Anne Chambers: Development or architects, yes.
Mr Beer: Okay. You’ve said that you don’t recall Jeremy Worrell?
Anne Chambers: No.
Mr Beer: Jim Sweeting?
Anne Chambers: I don’t remember that name.
Mr Beer: Chris Bailey?
Anne Chambers: He was another of the very senior architects/designers.
Mr Beer: Latoya Smith?
Anne Chambers: I don’t remember.
Mr Beer: John Burton?
Anne Chambers: I think he was the manager of a group of development teams.
Mr Beer: So he’s giving you a paper, Mr Jenkins, and is asking you, on his initial draft, for views. You’ll see in the first paragraph he says:
“Jeremy has asked me to produce a paper on Horizon Data Integrity to support [the Post Office] in refuting claims by postmasters that Horizon is causing money to be lost.”
Anne Chambers: Yes.
Mr Beer: Would you have understood this literally: the purpose of the paper was to be to support the Post Office in refuting claims, rather than to explore whether there may be anything in the claims being made by subpostmasters?
Anne Chambers: Gareth wrote that sentence and not me.
Mr Beer: Yes, but you’re a recipient of it. Would you understand that the direction was to produce a paper that would support the Post Office in refuting claims rather than the more open question of an exploration of whether there was anything in the claims made by the subpostmasters?
Anne Chambers: Yes, well, that’s what he says he is doing.
Mr Beer: Yes, and how would you – say for example you thought “Well, I have got some knowledge about the way that Horizon is structured and, by this time, 2009, by the way in which bugs, errors or defects have manifested themselves and how we in SSC and the company more broadly has treated them, I’ve got some evidence that may assist claims by subpostmasters” –
Anne Chambers: I –
Mr Beer: – would you have –
Anne Chambers: I didn’t –
Mr Beer: – included that in reply?
Anne Chambers: I was not aware of any bugs, errors and defects that were causing money to be lost without them leaving any sign that a problem had occurred. In general, although, yes, of course there were bugs, errors and defects, they were not causing continual ongoing losses.
Mr Beer: You have introduced a qualifier there Mrs Chambers, “I was not aware of bugs, errors and defects that did not leave a sign that they were occurring”, essentially?
Anne Chambers: Mm, yeah. There obviously were bugs, errors and defects that, in some cases, were causing money to be lost but my view at that time was that Horizon was robust in general. There would have been specific cases when it was not.
Mr Beer: Would you –
Anne Chambers: The –
Mr Beer: I’m sorry?
Anne Chambers: No, it’s all right.
Mr Beer: Do you agree that this is suggestive of a request to put forward the best case in refuting the claims made by subpostmasters, making the best case for Horizon’s integrity?
Anne Chambers: That would appear to be how Gareth has put it there. I mean, my view was that, you know, I would investigate each case individually, which was my job, you know, when the support calls came in, and that – yeah. I mean, that’s how Gareth has put it there and I was not aware of problems with data integrity that were causing losses left right and centre, leaving no indication behind them.
Mr Beer: I don’t believe that we have the family documents for this email, so I can’t presently show you the draft of the Horizon Data Integrity report that’s referred to there in that character string, ie the document that you were being asked to comment on.
Anne Chambers: Yeah.
Mr Beer: We do have a version of the document dated 2 October 2009, the day after your email and, when we look at it, we’ll see that it appears to include or reflect the comments that you made in part.
Anne Chambers: Yeah.
Mr Beer: Can we scroll up to your reply, please:
“Section 2
“You mention incremental consequence numbers in the audit section at the end, but could mention it earlier too, to make clear that each message has a unique identifier which stays with it when it is replicated.
“Each individual message has a checksum.
“What quite sure what you should be saying about CRC read failures. We aren’t currently checking old event logs for these when doing audit retrievals, and I don’t want us landed with even more checks to make. If there are CRC errors, SMC normally raise a call and we trash the message store and let it rebuild – but probably don’t want to say that! But if we don’t say, [I think that’s meant to read ‘will’] they ask?”
Is that right?
Anne Chambers: Yes.
Mr Beer: “[will] they ask?
“Event logs – more than 18 months but not sure if it is 7 years.”
Then:
“[Paragraph] 3.1.1, 3.1.2 The user will get an AP message warning them that the last session ended in error, but it only tells them to check AP transactions, not others.
“3.1.3.1 If banking recover is not completed immediately after the counter is replaced, this is reported on the banking reconciliation reports and followed up.”
So the part of the reply where you say, “We aren’t currently checking old event logs for these when doing audit retrievals, and I don’t want us landed with even more checks”, can you just explain what you’re referring to when you say, in this context, “CRC read failures”?
Anne Chambers: This is when a message has been – a Riposte message, when read by a process, either on the counter that it was originally written on or one of the other counters, every time it was read, the checksum on the message was recalculated and if it didn’t match it implied there’d been some sort of a corruption, and that would raise a critical red event.
Mr Beer: You say:
“We aren’t currently checking old event logs for these when doing audit retrievals …”
Anne Chambers: As part of the audit retrieval process after 2008 sometime, the Security team would also extract the Tivoli events for the branch over the relevant period, and SSC staff would look at those events to see if there was anything of concern. In particular, we were looking for the Riposte lock events which might indicate some silent failure that might not have been noticed at the time.
This was a not exactly a time consuming process but it was part of the process. Now we – I can’t remember now but this implies that we wouldn’t have seen those CRC read failure events in that process. They should, however, have been noticed at the time because they were one of the events that the SMC monitoring team were monitoring for, so there should have been a PowerHelp call raised at the time, if these events were occurring on a particular counter.
That PowerHelp call would then have been in the audit trail, so this isn’t something that would have been happening and then wouldn’t notice as part of the – and would not be seen as part of the audit retrieval.
Mr Beer: You continue that:
“[The] SMC normally raise a call and we trash the message store and yet it rebuild …”
What do you mean by that, trashing the message store?
Anne Chambers: I think that’s the bit that I probably didn’t want to say, “trash the message store”, because it sounds horrible. What it meant was delete – on the affected counter, you would delete the message store at a time when the counter – I mean often – one thing I can’t remember is whether these sort of errors actually shut down Riposte on the counter, which meant that you then couldn’t use it or, if it could still be used. Obviously, if it was unusable, then it’s not going to – this underlying error couldn’t possibly cause any financial impact because you can’t use the counter. But I cannot remember if that was the case or not.
But then trashing the message store is actually deleting the message store file on the affected counter, and then it would rebuild itself, and I can’t remember if it used the – and it would then be copied from one of the other counters to get the complete set of messages back in again, and that would then hopefully not have any corruptions in it.
Obviously, if this kept happening because you’ve got a dodgy disk on a counter you might still get more errors being reported and then the action would be to replace the counter, which would, as part of that process, also rebuild the message store.
Mr Beer: Why wouldn’t you want to say this?
Anne Chambers: I think because “trash” is not a particularly good-sounding word.
Mr Beer: But there was an acceptable way to describe what you were doing, wasn’t there –
Anne Chambers: That was –
Mr Beer: – without using the word “trash”?
Anne Chambers: Yes, you would say, “delete the message store” that –
Mr Beer: Yes. Why wouldn’t you want to say that? That you were deleting the message store and then letting it rebuild itself?
Anne Chambers: I really cannot remember exactly why I put it into those words and, obviously, I wish I hadn’t put it into those words but I cannot remember my thinking at the time.
Mr Beer: I’m not concerned at the moment with the word you used, “trashing the message store”, I’m concerned with – I’m asking you why wouldn’t you want to reveal this in a report about Horizon data integrity?
Anne Chambers: Yes, again, that’s why I can’t remember, really, why I said that. It wasn’t because I thought it was an absolutely awful of thing to be doing.
Mr Beer: What other reasons could there be for not revealing it?
Anne Chambers: I don’t know.
Mr Beer: Were you saying “What they don’t know won’t harm them”?
Anne Chambers: It certainly looks as if that was what I was saying but, if that is the case, I don’t know, really, why I was saying that, because this was not doing – this was, you know, to get the counter up and running again with a non- corrupted set of data.
Mr Beer: Or were you saying, because it’s not going to help the Post Office prove Horizon’s integrity, let’s not tell them?
Anne Chambers: No, I don’t think I was saying that.
Mr Beer: Again, can you, reflecting back, think what the reason would be not to reveal this information in a report on Horizon data integrity?
Anne Chambers: The only thing I can think of with hindsight is perhaps when these errors should – had occurred, we should have specifically been looking to see if it could have had any impact on the – anything, you know, if they were balancing at the time, and that wasn’t a check that we were making at the time.
But did I think this was a situation that was causing – was a cause of ongoing problems, you know, no, I don’t – even now, I don’t think that was the case. But no, I don’t know why I put that sentence in those terms. I think I just wanted to let Gareth know of what the situation was and then he could decide precisely what he wanted to say about it. But I agree, that doesn’t look good.
Mr Beer: You say, “SMC normally raise a call”.
Anne Chambers: Yes, that was the process and then that was so we knew to do something about it. Obviously, if we had a call direct from a branch about any sort of problems and then we looked at that call, we would have seen those CRC errors and would have looked to see what needed to be done about it. But I cannot be 100 per cent sure that if they weren’t – if they were saying, you know, that they’d got financial problems and we saw the CRC errors, then, obviously, we would look to see if they could have been a cause of it.
But, if we’re talking about looking at data retrieved some years or months – months or years afterwards, again, if we were examining – if we were actually investigating, rather than just doing the audit retrieval, we would look for anything wrong. But, no, sorry, I’m just not getting anywhere with this.
Mr Beer: Okay. You say the SMC was normally to raise a call. Were there times, therefore, when the SMC failed to pick up this issue or there were problems that therefore slipped through the net?
Anne Chambers: I could not say that they 100 per cent picked up on everything that they were always meant to, but they would certainly have picked up on the vast majority of things like CRC errors. Because that was their job to do.
Mr Beer: Was there a process to ensure that they ensured that that process always operated as it was intended?
Anne Chambers: I don’t know what their processes were and how much cross-checking was done by their management.
Mr Beer: Further down the email, when you’re commenting on what were, I think, paragraphs 3.1.1 and 3.1.2 of the draft Integrity Report, you say:
“The user will get an AP message warning them that the last session ended in error, but it only tells them to check AP transactions, not others.”
Can you explain what you mean by that, please?
Anne Chambers: Not properly, without seeing the underlying document but I think we’re talking about what has happened when a counter has failed in some way and it’s going into the recovery system, when the counter becomes available again.
Mr Beer: You continue:
“If banking recovery is not completed immediately after the counter is replaced, this is reported on the banking reconciliation reports and followed up.”
Did you either work in or see BIMS?
Anne Chambers: The BIMS were produced by the – what I think of as MSU, Management Support Unit. SSC did not see that system but the data that went into the BIMS reports was often taken from PEAKs, which the MSU raised asking SSC to check out various reconciliation report entries and then we’d send our response back and they would, if necessary, send a BIMS report, often just cutting and pasting our response, and that went to Post Office.
Mr Beer: Your comment on 3.1.3.1, is that a description of what the process was, ie what was supposed to happen?
Anne Chambers: Yes. I mean, if anything went wrong with banking transactions, there was a huge amount of central reconciliation that was done matching up the counter outcome – the outcome was known at the data centre – and also data received from the various financial institutions, the banks, and so on. And everything was matched up in there and any inconsistencies gave an entry on the banking reconciliation reports.
Specifically, in a recovery situation, it’s possible that a banking transaction had been authorised by the bank and the money removed from the customer’s account but, if it hadn’t settled on the counter before the counter failed, then the money might not have – that transaction would not be included in the branch accounts and so this banking reconciliation process was all intended to get everything into a consistent position, and recovery was part of that.
Mr Beer: So failures in banking recovery were always supposed to be reported accurately on banking recovery reports?
Anne Chambers: No, if there was any consistency – any inconsistency between the outcomes and a transaction needing recovery – a banking transaction needing recovery was going to be incomplete until somebody logged back on to that counter again.
Mr Beer: So that was supposed to be reported on a banking reconciliation report?
Anne Chambers: It would all be reported somewhere if there was any inconsistencies.
Mr Beer: It was supposed to be followed up with a BIMS notice; is that right?
Anne Chambers: It depends what the outcome was. When the recovery was completed, if the branch could confirm whether they’d paid the money out or not, then that would resolve the, you know, the inconsistency, if you like, and then that will get fed through and matched up in the reconciliation system.
Mr Beer: During your evidence back in May, you were asked to consider a circumstance in which a system error was to result in a BIMS notice, and you gave evidence that it wasn’t your role to follow up what happened with the BIMS notice and later actions; do you remember?
Anne Chambers: Yes.
Mr Beer: So where it says here “If banking recovery”, et cetera, it is “followed up”, again, are you describing the process rather than your knowledge of what actually happened?
Anne Chambers: This is describing – yeah, by following it up, I mean that, if necessary, SSC would investigate what had happened, in some cases would phone the branch to ask them to complete the recovery by logging on to the counter.
Mr Beer: So, essentially, by this email you’re adding in some further points that may assist Mr Jenkins to assist the Post Office in refuting claims that Horizon is causing money to be lost; is that right?
Anne Chambers: I was just trying to clarify where he had put things in his draft that I felt could be perhaps explained. I can’t remember, without seeing the draft, whether this is in more detail or saying that, you know – you know, I knew a little bit more about the process at this level.
Mr Beer: Can we turn, please, to a draft of the report. FUJ00080526. You’ll see that under “Document Status” this is marked as a final draft. You’ll see in the bottom of the document on page 1 it’s version 1.0 and it’s dated 2 October 2009. The email exchange we’ve just looked at was 1 October 2009.
Anne Chambers: Could I just ask, is it possible to have this screen raised up slightly?
Mr Beer: Yes. Do you want to try it yourself? If you grab the top of it. Maybe one of the ushers can assist.
Anne Chambers: Yes, that’s right better. Thank you.
Mr Beer: We were looking at the date at the bottom, 2 October 2009, the day after your email.
Anne Chambers: Yeah.
Mr Beer: Then if we can go to page 3, please. We can see the version number. 0.1b is said to be dated 2 October 2010, I think that must be a typo for 2009. Then:
“First informal draft. Changes from version 0.1a were marked in red (like this) with strikeout for significant deletions.”
Then this version, 1.0 “Version for release to Post Office”.
Yes?
Anne Chambers: Yes.
Mr Beer: It’s those, 0.1a and 0.1b, that I don’t think that we have got. If you just look down at the reviewers, you don’t seem to be listed there –
Anne Chambers: No.
Mr Beer: – and yet you did review?
Anne Chambers: Yes, I don’t know how informal that first draft was but, yes, I did review it.
Mr Beer: Would that sometimes be the case, that if you were an informal reviewer, you wouldn’t be listed?
Anne Chambers: I don’t know, I wasn’t – no, I don’t know.
Mr Beer: Or is this a description of those who are to review this draft, rather than those which had reviewed previous drafts?
Anne Chambers: Yes, that could well be. I mean, we are now up at a far higher level, if you like, of people than the level at which I worked. And I note that Chris Bailey and Alan Hodgkinson aren’t on there either. So I assume, you know – maybe, you know, Gareth had just asked around useful people to try to get a picture in his first very informal draft.
Mr Beer: Can we go to page 5, please. We can see the purpose of the document set out:
“This document is submitted to Post Office for information purposes only and without prejudice.”
You can see at the top it says in “Commercial in Confidence and Without Prejudice”. It says:
“In the event that Post Office requires information in support of a legal case Fujitsu will issue a formal statement.
“This document is a technical description of the measures that are built into Horizon to ensure data integrity, including a description of several failure scenarios, and descriptions as to how those measures apply in each case.”
So that’s the purpose of the document. Then if we go to page 6, please. There is the section on Horizon data integrity.
If you scroll down, please, if you just see the paragraph that’s now at the top of the page:
“Every record that is written to the transaction log has a unique incrementing sequence number. This means it is possible to detect if any [transactions] have been lost.”
Then right at the foot of the page:
“Each record generated by a counter has an incremental consequence number and a check is made that there are no gaps in the sequencing.”
So that is, I think, the first comment you made, that, whereas the sequence number had been referred to by Mr Jenkins in the audit section, which is what this part of the report is, it could usefully be explained earlier. Can you see that at the top?
Anne Chambers: Yes, because – yes.
Mr Beer: Then the second point that you made in your email “If there are CRC errors, SMC normally raise a call and we trash the message store and let it rebuild but we probably don’t want to say that, but if we don’t say, will they ask”, that’s not referred to here or, indeed, so far as I can tell, anywhere in the report. Do you think, because that was a potentially tricky point, it was left out?
Anne Chambers: I don’t know. I mean, what we were doing was fixing the problem and not in a particularly tricky way. It was the clean way to fix the problem. I don’t know what Gareth had said about it before. I think what he’s put there is correct but what he doesn’t do is go into any detail as to the action that was taken when it did happen.
Mr Beer: Then if we go forwards, please, to 3.1.1 and 3.1.2 on the next page and just scroll down, please. Do you remember these were the paragraphs, 3.1.1 and 3.1.2 –
Anne Chambers: Yes.
Mr Beer: – where you had said “The user will get an AP message warning them that the last message ended in error but it only tells them to check AP transactions, not others”?
Anne Chambers: Yes.
Mr Beer: I think the point you were making, is this right, is that the subpostmaster was not getting information telling them to check all transactions, only the AP transactions, yes?
Anne Chambers: Yes. I mean, AP transactions were different to other transactions in that they were recoverable, whereas other transactions were not.
Mr Beer: So why were you raising that point, to make the distinction that the subpostmaster wasn’t getting a message to check other transactions?
Anne Chambers: It must have been something that was in the previous draft where I felt there was – a little bit of clarity was needed but I can’t remember.
Mr Beer: It doesn’t look as if your point has been addressed here, does it, in 3.1.1 and 3.1.2?
Anne Chambers: Unless there had been a sentence in saying that the user will be prompted.
Mr Beer: Which has now gone?
Anne Chambers: Which has now gone. That is possible.
Mr Beer: Thank you very much, that’s all I ask on the second topic.
Sir, I wonder whether that would be an appropriate moment with the morning break?
Sir, you’re still on mute.
Sir Wyn Williams: It would but I may have misunderstood something. I think it’s page 5 of that document, but there is certainly a page that we’ve looked at, which describes the version of Horizon to which it relates. Have I misunderstood that?
Mr Beer: Yes, that is page 5.
Sir Wyn Williams: And –
Mr Beer: It’s the last sentence.
Sir Wyn Williams: This document only covers Horizon. It does not cover HNG-X, Horizon Online. Am I being too simplistic? Does that mean that it only covers the version of Horizon which existed until Horizon went online?
Anne Chambers: Yes, this covers the – what we sometimes call Legacy Horizon, which was based all around the Riposte system because the data integrity side of things, it was all to do with the way that Riposte was working behind the scenes. Horizon Online was based on a totally different set of centrally-held databases.
Sir Wyn Williams: Sure, and at the date of this document, Legacy Horizon still existed?
Anne Chambers: Yes, but –
Sir Wyn Williams: Had there been – yes, the transition to Horizon Online hadn’t yet occurred?
Anne Chambers: No.
Sir Wyn Williams: Fine. Sorry. I just wanted to be clear in my mind about that. Thank you. Yeah. Yes, let’s have our morning break.
Mr Beer: Sir, 11.30, then please.
Sir Wyn Williams: Yes, fine.
Mr Beer: Thank you.
(11.15 am)
(A short break)
(11.30 am)
Mr Beer: Good morning, sir, can you see and hear me?
Sir Wyn Williams: Yes, I can, yes.
Mr Beer: Thank you.
Mrs Chambers, can we turn to the third topic, please, which is informal examination of issues within the SSC and the process for the examination of issues within the SSC that may end up in court proceedings.
Can we start, please, by looking at an email chain. FUJ00156153. I should make clear that this isn’t an email chain that you were included on but I’m going to ask you questions about whether what’s in it reflected the position at the time.
Can we go to page 3, please, and look at the foot of the page, which is the first in the chain. Foot of the page, please. Thank you. So 2 June 2010, from Penny Thomas to Steve Parker:
“Hi Steve
“You wanted to change the way we request these checks to PEAK …”
The subject is “Event Analysis via PEAK”:
“… and I think we need to agree the format; have you got a few minutes to agree process?”
At this time, we can see who – and we know who – Mrs Thomas was, a security analyst. What position did Mr Parker hold in June 2010? Was he the manager of the SSC by then?
Anne Chambers: I think so. He took over certainly around about then, so I assume that, yes, he was the manager.
Mr Beer: So your line manager?
Anne Chambers: Yeah.
Mr Beer: Then if we scroll up, please. We can see his reply:
“Penny,
“Yes, I’d like to change it as well so that we get formal PEAKs raised for ARQs as discussed last week, establish audit trail, spread the work, etc.”
What do you understand that first part to mean, “We get formal PEAKs raised for ARQs”?
Anne Chambers: I presume it means, so for each – for each ARQ extract that the Security team were doing, where, by this point, we were also checking any events that were raised in the same period, that the request for SSC to make those checks, each one would have a PEAK raised for it.
Mr Beer: So for each request for an ARQ, there was an equivalent PEAK?
Anne Chambers: Yes, effectively they’d do the ARQ extract of the transaction data and Riposte events. They’d also get the Tivoli events and then raise the PEAK, with the Tivoli events attached, and route it to SSC for us to examine.
Mr Beer: Would you understand why it would be necessary or desirable to establish an audit trail?
Anne Chambers: I presume just so that somebody could say, if asked, “Yes, those events have been checked by somebody in the SSC”.
Mr Beer: Would that be in the context of court proceedings or in other contexts too?
Anne Chambers: I don’t know.
Mr Beer: Okay:
“Before I can do this we may need to talk to Tom as well.”
I think that must be a reference to Tom Lillywhite. Can you see him amongst the copy list?
Anne Chambers: I can see him, yes.
Mr Beer: Do you remember who he was?
Anne Chambers: No.
Mr Beer: “I’m concerned that if we put this on a formal level like this it may mean that further down the line random members of the SSC get a subpoena and we have to testify. If there is any chance of this happening then we (SSC) will not be giving guidance on the events. We need guidance from Tom (or Fujitsu legal) on how we protect ourselves from the possibility of court appearance before we formalise the process?”
Can you recall a concern within the SSC at about this time, that’s mid-2010, that the SSC should not be giving guidance or speaking to ARQ data because it may result in the SSC giving evidence in legal proceedings.
Anne Chambers: I don’t remember anything specifically from 2010 but I think, after I gave evidence in 2006, the SSC management were not keen on any SSC members having to be put in that position again.
Mr Beer: Why were they keen that members of the SSC should not give evidence?
Anne Chambers: Because they felt it was not our job to give evidence.
Mr Beer: Do you know why they felt it was not your job to give evidence?
Anne Chambers: Because we’d had no training, it was not part of our job description. You know, we did not take on the job thinking that we might find ourselves in court.
Mr Beer: Was that a theme, that was the subject of discussion, that there was a need for the SSC to protect itself from the possibility of giving evidence in court?
Anne Chambers: Yes, I think that was how our management felt.
Mr Beer: What about individual members of the SSC too?
Anne Chambers: Yes, I don’t think – I don’t think any of us had ever joined a support team thinking that that is where we might end up.
Mr Beer: So, although there was a desire to formalise matters, is this right: you would understand what Mr Parker is saying here, that that formality can’t come at the expense of exposing ourselves to court appearances?
Anne Chambers: That seems to be what he’s saying there, yes. I’m not sure that I was aware of this discussion at the time, though.
Mr Beer: That was my next question: did you understand the relationship between a formal process for administering potential litigation cases and an increased possibility of a court appearance by SSC staff?
Anne Chambers: I’m not sure that that was anything I was thinking about at the time when I was checking these events. But, obviously, it was a – appears to have been of concern to Steve.
Mr Beer: Ie an instruction, keep in informal, do things by email and discussion, otherwise you may expose yourself to giving evidence in court? Did that come down to the workers in the SSC?
Anne Chambers: I don’t recall anybody ever saying that.
Mr Beer: Okay, let’s read on, please. Scroll up. We can see Penny Thomas’s reply:
“OK, Steve, I’ll continue requesting via email until you are fully satisfied that [the] SSC are protected.”
Yes?
Anne Chambers: Mm.
Mr Beer: Scroll up still further, please. We can see Mr Parker refers it on to Mr Lillywhite:
“Tom,
“Any comment on this please?
“It is important for the ARQ process that SSC examine the events generated and then comment on their potential impact on the financial status of the branch.”
Would you agree with that?
Anne Chambers: Yes.
Mr Beer: “This has been done in the past on an informal basis (email to Anne Chambers normally!) …”
Is that right, that it was normally you that received these informal requests via email?
Anne Chambers: I don’t actually remember. I’d forgotten that this was done on an informal basis at any point. But that’s what it says. So …
Mr Beer: “… but that informal process leads to requests being lost when somebody may be on leave, etc.
“We need to formalise this but I’m concerned about the legal implications. SSC staff are not trained on evidential requirements or as witnesses in court.”
That’s something that you’ve just mentioned?
Anne Chambers: Yeah.
Mr Beer: Just stopping there, I’m going to come back to ask you some questions about that in the context of the Lee Castleton case. In general terms, were you ever given any guidance on when you were carrying out enquiries and carrying out investigations in a case that may end up in litigation, that you had to do or not do certain things as a potential witness, like retaining your working notes?
Anne Chambers: I think you’re – when we were just looking at ordinary support calls, I don’t think it occurred to any of us at the point at which we were doing that investigation that it could, at some point in the future, result in us needing to be a witness.
Mr Beer: Just stopping there, I’m not asking about those ordinary support calls, as you describe them. I’m talking about these informal requests from Security?
Anne Chambers: Yes, I don’t think anybody, when we started checking these Tivoli events, I don’t think there was any discussion, when that process started, that we might then be expected to appear in court about it.
Mr Beer: No training or guidance that “Look, if you do end up in court, the court has certain requirements for somebody that’s performing a task of specialist expertise” –
Anne Chambers: No.
Mr Beer: “– such as retention of working notes, retention of copy documents”?
Anne Chambers: No.
Mr Beer: The duties that you might owe to a court?
Anne Chambers: No, there was no discussion or training. There was, I believe, a KEL that sort of outlined the sort of things that – the events that we needed to check, but it was purely technical.
Mr Beer: Mr Parker continues:
“If there is any possibility of a court appearance or a witness statement being required then we have to refuse to process the ARQ requests.
“Do your own what the legal situation is here?”
Do you recall that, that it got to the stage that, such was the concern about the possibility of giving a witness statement or making a court appearance, that the SSC would refuse to look at the ARQ data?
Anne Chambers: No, I think I was completely unaware of any of this.
Mr Beer: This refers to emails being sent to you on an informal basis asking you to do this work. Did that continue or can’t you remember?
Anne Chambers: As I said, I don’t remember ever doing it by email. We did switch to PEAKs being raised and then they were shared out, so it wasn’t always me doing them.
Mr Beer: Scrolling up the page, please. Thank you. We can see Mr Lillywhite’s reply.
“If there is indeed legal implications, and you are all agreed on that then I think we seek advice from our legal department … it is too important to get wrong!”
Then up to page 1, please, and then scroll up, please, to look at Mrs Thomas’ email. We can see her reply:
“I am not convinced there is, Tom.”
You remember he said if there are legal implications on the SSC staff undertaking investigation of these events and looking at ARQ data. She says:
“I am not convinced there is, Tom.
“While Anne has been helping us she has been fully shielded from any form of [Post Office] litigation. Why would we specifically identify the checking of events as more vulnerable than any other part of the process considering the total end-to-end process employed here? The names of those checking events for us are not notified to the [Post Office] and we have the ability to identify and select any expert witness we consider appropriate to support [the Post Office’s] prosecutions. No one in the company can be forced to sign a witness statement if they do not want to; and [the Post Office] cannot cherrypick our staff.
“Gareth has the responsibility of covering transaction records for all litigation facing activity until now and there has been no issue. Do we need to life a suitable ‘expert’ to cover event filtration and analysis? That’s another question.”
Was that the subject of discussion within the SSC, that you had been shielded from involvement in Post Office litigation?
Anne Chambers: I don’t recall it ever being discussed. Obviously, I knew that, after the Marine Drive case that I’d been involved in, Gareth had taken on subsequent witness statements and trials but I don’t recall any discussion about it.
Mr Beer: What about the point that the names of those checking events for us are not notified to the Post Office? Was that an instruction that was given, “Don’t tell the Post Office who carried out the work because, otherwise, they might end up a witness in court”?
Anne Chambers: No, I don’t recall that ever being said or discussed.
Mr Beer: Was the facility available to obscure from the Post Office who was carrying out the work, checking the events analysis?
Anne Chambers: I don’t know what got passed to the Post Office as a result of the events analysis. I mean, that all just went straight back to the Security team and I don’t know precisely what Penny then passed on as part of the ARQ data.
Mr Beer: Do you recall whether you or others in the team were told, “Don’t worry, even though you’re responding to these informal requests for analysis, we shield you by not revealing who undertook the work when we passed the product back to the Post Office”?
Anne Chambers: I don’t recall any of us ever explicitly worrying about that or thinking that it was something to be concerned about.
Mr Beer: As a means of ensuring that what happened in the Marine Drive case didn’t happen again, that the SSC was dragged into giving evidence?
Anne Chambers: I don’t think it was something that we were particularly thinking about. The checking of the events was a task that needed to be done and we did it and passed it back. I don’t think we considered possible consequences, although, in the light of Marine Drive, maybe it’s something we should have been more alert to but, no, it wasn’t something we were talking about or considering.
Mr Beer: After Marine Drive, I think it’s right that no-one from the SSC did give evidence again?
Anne Chambers: Yeah.
Mr Beer: Do you know how that came about?
Anne Chambers: I presume that was a decision by the management, who, I think for various reasons, weren’t happy that I’d had to give evident in the first place.
Mr Beer: But you in the SSC carried on doing the analysis –
Anne Chambers: We did –
Mr Beer: – and passing it back to Security?
Anne Chambers: I became involved in Marine Drive because I dealt with the original support call from the branch, which did not go back to Security because it went back to Marine Drive. Where I – I mean, after that, I think Gareth took responsibility for making checks on other branches for the transaction data for litigation, where it was coming in through the Security team, and I, occasionally, a few occasions, possibly helped him with some of that analysis but –
Mr Beer: Were you doing so in the knowledge that your identity would not be revealed to the Post Office so there was no prospect of you having to give evidence?
Anne Chambers: I think I always assumed that it would be Gareth giving evidence. I don’t think I considered whether my identity or my involvement was being hidden to protect me or anything. By that point it just seemed to be the process that Gareth, as it says here, had taken that responsibility.
Mr Beer: Do you know how that process came about? That Gareth had taken responsibility?
Anne Chambers: No.
Mr Beer: Can we turn to the fourth issue then, please, that can come down.
Back when you gave your evidence on 3 May, you described an occasion when the Post Office had wanted to insert transactions without the branch being aware. I’ll just read back the questions and answers. The question was:
“Was there any method to alert others that corrective action had been taken to insert data or extra messages into a branch’s account?”
You said:
“The ARQ data would contain both the original transaction and the corrective transaction, at the point at which they were done. If the full, unfiltered data was retrieved and inspected, then that would show the comment, for example. Certainly, sometimes, for counter corrections – and it wasn’t done consistently – but we often might use a counter number that didn’t exist to make it clear that it was something out of the ordinary or a username, including SSC, again to show that it was something out of the ordinary.
“That wasn’t done on this specific one and I cannot remember whether that was because I was specifically asked not to or I was just producing a transaction that was absolutely a mirror of the one that shouldn’t have been there in the first place and all I did was change the signs of the values, effectively and all I – I left all the other data in there as it was.”
So remembering back what you were saying and just to synthesize it, you were saying, sometimes, a fictitious counter number was used to mark out the transaction correction?
Anne Chambers: As I recall, yes.
Mr Beer: Secondly, you were saying but that wasn’t done consistently, ie the use of a fictitious counter number to mark out the fact that SSC had made a correction?
Anne Chambers: Yeah.
Mr Beer: Thirdly, you were doing that, or the SSC was doing that, deliberately, ie using the fictitious counter number, because you would want to show that an SSC member had been making the correction?
Anne Chambers: Yes.
Mr Beer: But, fourthly, there might be occasions when you were specifically asked not to use the fictitious one?
Anne Chambers: I don’t think we were ever asked not to use a fictitious one.
Mr Beer: It was just a passage of your evidence where you said “That wasn’t done on this occasion and I can’t remember whether that was because I was specifically asked not to”, which tended to indicate that you were saying that you may have been asked not to use the fictitious number?
Anne Chambers: I don’t recall ever being asked not to do that and I can’t remember which specific instance we’re talking about here. Sorry.
Mr Beer: Overall, does it mean that it was possible for members of the SSC to insert transactions using the branch user ID?
Anne Chambers: Right, you’re talking about user ID here now, rather than counter number, but, yes, it was – I mean, the messages that we inserted could have contained the branch user ID.
Mr Beer: Would it follow that standard filtered ARQ data would not distinguish those insertions from those that were, in fact, carried out in the branch?
Anne Chambers: The standard ARQ data, yes. You might not be able to see the difference.
Mr Beer: So transactions which appeared in the standard filtered ARQ data, for example, in Mr Castleton’s case, with his ID user number next to them, would not necessarily mean that they were carried out by him?
Anne Chambers: It would have been possible, yes, for SSC to put transactions in, that –
Mr Beer: Using his ID?
Anne Chambers: Using his ID.
Mr Beer: Without leaving a fingerprint on the standard, filtered ARQ data that that had been done?
Anne Chambers: Yes, I think that would have been possible.
Mr Beer: It shouldn’t have been done but it could be done?
Anne Chambers: Yes, I don’t think there’s anything that would have prevented that. I don’t believe that was done but I can’t say it’s an impossibility.
Mr Beer: Thank you.
Can I turn then to Mr Castleton’s case and begin with what you did and didn’t know, what information you did have and what information you didn’t have, and the stage at which you became involved. I’m going to try and do it chronologically, including by establishing what had happened before your first involvement, which was, I think, on 26 February 2004, yes?
Anne Chambers: Yes.
Mr Beer: I’m afraid there’s quite a long run-up to the wicket here but I just want to see what had happened before you became involved.
Anne Chambers: Certainly.
Mr Beer: Can we start, please, with the first call on 14 January 2004. You address this in your witness statement, please. So that is WITN00170200.
I’m told, sir, that’s not on the system, which is remarkable because it’s Mrs Chambers’ 38-page second witness statement. Maybe if I just hand my copy of it to the operators to see whether it’s an error in my reading.
Sir, we probably need to take a break, then, if that is indeed not on the system. I apologise for this. Can we leave it that we’ll come back to you when it is on the system, please.
Sir Wyn Williams: Okay. That’s fine. Do you want me to sit in my chair, so to speak, for a few minutes or can I wander around safely for at least five minutes?
Mr Beer: The latter, please, sir, and we’ll get you a message one way or another when we’re to reconvene. Thank you very much, sir.
(12.02 pm)
(A short break)
(12.19 pm)
Mr Beer: Good afternoon, can you now see and hear me?
Sir Wyn Williams: Yes, I can, thank you.
Mr Beer: Thank you. Apologies for that protracted delay.
Can we look, please, at WITN00170200, and can we go, please, to page 3 of your witness statement and look at paragraph 10, please. I should have taken you to the heading at the top of the page “Involvement in relation to Marine Drive Post Office and the litigation against Lee Castleton”.
So this is the section of your statement, indeed the rest of the statement, which deals with Mr Castleton’s case. At paragraph 10, you say:
“I have now been provided with a copy of the NBSC call log for Marine Drive. This is not something that was ever available to me during my time at Fujitsu. As I have explained in my first statement, there was a clear division between business investigations conducted by NBSC and system investigations conduct by SSC. I can see now from this document that there was a call about a discrepancy at Marine Drive on 14 January 2004 and another a week later on 21 January 2004, and the record shows NBSC as assisting the postmaster to make checks at that time.”
So where you say, “this is the first time that I’ve seen the NBSC call log”, do you mean you’ve been provided a copy of the document by the Inquiry –
Anne Chambers: Yes.
Mr Beer: – and this is the first time in the 19 years since the relevant events that you have seen the call log?
Anne Chambers: I didn’t see the call log at the time and I have not seen it – I had never seen it until it was provided as part of the evidence set with the Rule 9 request.
Mr Beer: So you say:
“This is not something that was ever available to me during my time at Fujitsu.”
To be clear, it wasn’t available to you when you investigated the issue at Marine Drive back on 26 February 2004 –
Anne Chambers: It was not available to me then.
Mr Beer: – and it was not available to you when you were asked to look at a wider range of issues in 2006 in preparation for the court case concerning Mr Castleton?
Anne Chambers: No, it wasn’t available to me then and I don’t recall being asked to look at wider issues at that time either.
Mr Beer: We know that, for example, you were told, before you gave evidence at the High Court, that you may be asked questions about the Callendar Square/Falkirk bug?
Anne Chambers: Yes, I was told that that was going to come up and I should be ready to answer questions about that.
Mr Beer: As part of preparation, you weren’t shown a copy of the NBSC call log?
Anne Chambers: No.
Mr Beer: You tell us in this statement that there was a clear division between business investigations conducted by the NBSC and systems investigations conducted by the SSC. Is that the reason why you in the SSC didn’t see the NBSC call log?
Anne Chambers: I presume so. NBSC was a Post Office organisation, totally separate from Fujitsu and I don’t think at the Helpdesk levels they – either side had view of the others’ calls.
Mr Beer: The information we’re going to look at in a moment, concerning events on 14 January 2004 and the 21 January 2004, would that have been helpful context for you to have had access to, to the investigation that you were to carry out?
Anne Chambers: I don’t think there was any additional evidence that would have been of help to me in the NBSC logs because I think that the Horizon Helpdesk had captured certain – the majority of the information. Again, either – I’m not sure now whether they got some of this information by talking to the NBSC agents or by talking direct to Mr Castleton, but the Horizon Helpdesk had captured, in various calls, I think probably all the pertinent information about what Mr Castleton was saying.
Mr Beer: Okay, we’ll look at that as we go along. Can you explain, in general terms, how you were passed information from the HSH, the Helpdesk?
Anne Chambers: They would log the information on their PowerHelp call – I think that was what the calls were called at that point in time – and then they’d route the PowerHelp call on to a PEAK or PinICL stack, and that would automatically raise – I can’t remember if it was PEAKs or PinICLs at this precise point in time – and would paste the information – the information that had been recorded on the PowerHelp call would also go onto the – would automatically go onto the newly raised PEAK that would then be on the SSC stack.
Mr Beer: How would you be passed information from the NBSC?
Anne Chambers: We were not passed information directly. It was a matter of the HSH having recorded it on their own call – PowerHelp call that they had raised.
Mr Beer: If you wanted to ask for more information from HSH, how would you do that?
Anne Chambers: If we felt that there was insufficient information from HSH, then we would route the call back to them saying we need some more information.
Mr Beer: If you wanted information from the NBSC, how would you do that?
Anne Chambers: We very rarely contacted anybody at NBSC. I can’t say we never did because I know there are a few calls where I did talk to, I think, somebody called Ibrahim but, I think in general, it was HSH’s responsibility to get a clear picture of what the postmaster said the problem was and then to route it on to us. I could have talked – contacted the postmaster myself also, if I needed more information, but in this case I didn’t.
Mr Beer: So, essentially, the Fujitsu HSH, the Helpdesk, were your agents, were your facility for obtaining information from either the postmaster or NBSC?
Anne Chambers: Yes. I’m not sure how often they would go back to NBSC to ask for more information themselves either, but certainly they would – they were expected to get a clear picture from the postmaster before sending the call over to SSC.
Mr Beer: Thank you. Can we look, then, at this first record of the call, then.
Sir Wyn Williams: Sorry, Mr Beer, before we do that – and this may appear very pedantic – but, given the date on Mrs Chambers’ second witness statement, has she actually ever vouched for its accuracy at the Inquiry?
Mr Beer: That’s a really good point!
Sir Wyn Williams: I don’t think she could have, really.
Mr Beer: Well, given that I couldn’t have displayed it if I wanted to, you’re right to pick me up on it.
Sir Wyn Williams: It’s all right.
Mr Beer: With your leave, then, sir, shall we do that now?
Sir Wyn Williams: Yeah, I think it must be the case that she hasn’t done it. So we’d better do it and now is as good a time as any.
Mr Beer: Turn to page 34, please. Is that your signature?
Anne Chambers: Yes, that is my signature.
Mr Beer: I don’t believe we’re in the territory of you wishing to make corrections to the witness statement?
Anne Chambers: No.
Mr Beer: Are the contents of it true to the best of your knowledge and belief?
Anne Chambers: Yes.
Mr Beer: Thank you.
Thank you very much, sir, for your eagle eyes.
Can we look, please, at the first record of the call made by Mr Castleton, 14 January 2004. It’s LCAS0000365. Can we turn, please, to page 18.
We can see here the NBSC call log, yes? Do you recognise it now?
Anne Chambers: I recognise it having been sent it by the Inquiry. I wouldn’t have known what I was otherwise.
Mr Beer: Just looking along the top line to orientate ourselves, “Date” – I think that’s the call taken, first column; the “Incident ID”, the second column; a “Brief Description” of the event, third column; a “Detailed Description” of the event”, fourth column; “Resolution”, fifth column – do you know what “KB” means?
Anne Chambers: No. I might guess “Knowledge Base” but that’s a guess.
Mr Beer: A cross-reference to the “Incident Log”; a record of the nature of the call, the “Call Type”; who the client was; the “Activity”; the “Sub-Activity”; the branch code, the “FAD code”; and the name of the Post Office concerned. Yes?
Anne Chambers: Yes.
Mr Beer: Can we go, please, to page 25. Can you see, please, that this is an entry of 14 January 2004 –
Anne Chambers: Yes.
Mr Beer: – at the foot of the page.
Anne Chambers: Yeah.
Mr Beer: So this is the first relevant entry that we’re going to look at, the first contact between Mr Castleton and the Post Office. The 14th is a Wednesday, okay? Take it from me. We can see the brief description is “Discrepancy”, and then the detailed description is a discrepancy of – and I think we can tell from looking elsewhere in the document where the hash sign appears, that’s a pound sign, essentially –
Anne Chambers: Yes.
Mr Beer: – of £1,103.13 loss. Resolution, KB. If that does mean “Knowledge Base”, what would that mean?
Anne Chambers: I’ve no idea. This was the NBSC system which I had nothing to do with.
Mr Beer: We can see some cross-reference to an incident log; the call type, “Horizon Balancing”; the activity, “Cash Account Discrepancy”; sub-activity “Discrepancy”; and then the branch code and the office name.
Anne Chambers: (The witness nodded) Yes.
Mr Beer: If we just scroll down to the next page, we can see there’s nothing else. It moves on to a different date, yes?
Anne Chambers: Mm-hm.
Mr Beer: Now, if we go back to that page, on 14 January, what was your understanding of what should be done where a postmaster reported a discrepancy of, say, £1,000?
Anne Chambers: I would expect, and I don’t know, that NBSC would possibly help him to look through various reports, and so on, to see if there could have been any errors in recording data that might have led to that loss. I mean –
Mr Beer: Just to be clear, I realise, of course, you didn’t work in the NBSC. This was not your function. The purpose of these questions is to understand what you knew about what had been done before a call came across your desk.
Anne Chambers: Yeah.
Mr Beer: So on the face of this, it looks like nothing was done in relation to the report of £1,000 loss; would you agree?
Anne Chambers: I don’t know what they would have told him, and I think you have to bear in mind that, you know, discrepancies at branches are not at all unusual. Every branch will have had losses or gains occasionally, which they will then have tried to resolve. I mean, obviously making sure that the cash has been counted correctly and that what they’ve recorded on the system, which they can check against the reports, is actually what they have done in the office.
Mr Beer: Yes, and, on the face of it, there isn’t any record of that having been done on this occasion?
Anne Chambers: It’s not written down there but I’ve no idea what the NBSC procedures were.
Mr Beer: But something is supposed to be done, isn’t it, when a postmaster reports a discrepancy of £1,000?
Anne Chambers: I don’t know what the procedures were. I would still say that, you know, that the first thing is to look for differences between what is on the system and what actually took place in the office, because that is the cause of discrepancies.
Mr Beer: Okay. Can we move forwards a week, then, to 21 January 2004, and look at page 28. So this is the following Wednesday, and you’ll see that it’s a discrepancy, again; can you see that?
Anne Chambers: Yes, I can.
Mr Beer: The detailed description is:
“[Postmaster] has cash account discrepancy of £4,294.67.”
Anne Chambers: Yes, I see that.
Mr Beer: In the resolution is:
“[Subpostmaster] still has a loss and has logged the call with suspense.”
Anne Chambers: Yes.
Mr Beer: What was your understanding of the suspense account?
Anne Chambers: That was somewhere to which they could move losses or gains while they were being investigated but I think they were meant to get authorisation from a particular team in the Post Office in order to do that.
Mr Beer: Was it your understanding – I mean, it says here “and has logged call with suspense” – that it was he, the postmaster, that had to log the call with suspense or the NBSC logged the call with suspense?
Anne Chambers: I don’t have any knowledge of the process.
Mr Beer: But one of the two would refer the gain or loss to a team dealing with suspense accounts; is that right? You understood that?
Anne Chambers: I think that’s probable but, really, this was completely outside my knowledge.
Mr Beer: The next column recalls, after the text in lower case, in uppercase:
“Checked through transaction logs with [subpostmaster] and nothing showed except the DDN.”
Did you understand that to refer to a discrepancy?
Anne Chambers: Yes.
Mr Beer: “Advised I will call him back tomorrow to see if anything came to light when he balanced OOH …”
Out of hours, or wouldn’t you know?
Anne Chambers: Seems likely.
Mr Beer: “… and log call with suspense if necessary.”
So this is before the postmaster, is this right, has balanced a record of the NBSC saying, “You’re telling me you’ve got a loss. Let’s wait until you balance the next day and, if it’s still there, we’ll log the call with suspense”?
Anne Chambers: Yes, I seem to remember that Mr Castleton tended to start going through the balancing process on the Wednesday afternoon and the 21st would have been a Wednesday.
Mr Beer: Yes.
Anne Chambers: But he didn’t usually complete the final balance and produce a cash account until first thing on the Thursday morning.
Mr Beer: But, if you’d been reading this at the time, you would have understood this to be a postmaster saying, “Look I’ve already got a discrepancy” and they’re saying “You need to sign off your cash account the following day and see whether it’s there”.
Anne Chambers: If he hadn’t got as far as the final balance, if he’d just done a trial balance, that would have produced a discrepancy, but he could then have gone back through to try to see if he could spot any reasons for that discrepancy. He could then have changed the cash declaration, or whatever other figures, and done another trial balance.
So he’s started the process to the point that he’s realised it’s going to show – it has created a discrepancy but he hasn’t actually completed the rollover process.
Mr Beer: So “I’ll call back tomorrow to see if anything came to light”, so that’s the 21st. If we go over the page to the 22nd, we are at the next day. Brief description, “Discrepancy”:
“[Postmaster] has a loss of £4,000. He was in the office until 11.00 [pm] last night and could not find anything.”
Anne Chambers: Yes.
Mr Beer: “Resolution”:
“Went through all the balance checks with [the postmaster]. He had checked the rems in and out, his cash stock and the P&A …”
Do you remember what the P&A was?
Anne Chambers: Pensions and allowances?
Mr Beer: “… and was unable to find the loss. Advised I would pass through to suspense.”
So would you understand, at this point, that the postmaster had signed his cash account off by saying that there was a discrepancy, essentially, between the cash and stock, which Horizon showed he should have, and the cash and stock that he, in fact, had –
Anne Chambers: Yes.
Mr Beer: – and that, the NBSC are saying, they are going to pass through to the Suspense team, yes?
Anne Chambers: That’s what they appear to be saying, yes.
Mr Beer: Yes. You said, I think, earlier that your understanding was that the discrepancy, whether it was a gain or a loss, would be placed in a suspense account?
Anne Chambers: That was a manual action that, if authorised, he could take, or I think it could be taken – it could be done, even if not authorised, but my recollection is that they were meant to get some sort of authorisation.
Mr Beer: If a postmaster was placing an amount in the suspense account – or was authorised to place an amount in the suspense account – and was signing off the cash account, was it your understanding that he was acknowledging that he owed the money shown on the cash account, if it was a loss?
Anne Chambers: I had no idea of what the legal position might be on that money.
Mr Beer: Or was it your understanding that, despite signing the cash account, the money was, in effect, disputed and that’s why it was in the suspense account?
Anne Chambers: Again, I don’t know about the business and the legal side of it. All I would see would – if I looked, was an amount being moved from one place on the system to another.
Mr Beer: I mean, to be clear, Mrs Chambers, I’m not asking you for what your understanding of the legal position was because I can’t imagine you ever address your mind to it. It’s more what you thought was signified by an amount being held in a suspense account and was it that sum is disputed?
Anne Chambers: Um, I’m not even sure if I knew that at that point but then, yes, there’s a loss and they’ve parked it there.
Mr Beer: What did you think was the status of money then held in the suspense account or did you think nothing about that?
Anne Chambers: I don’t think I thought about it, just that it had been sort of a sum had been parked there.
Mr Beer: Parked: did you have an understanding of parked for what purpose or parked until what?
Anne Chambers: I don’t think I really thought about it.
Mr Beer: Can we move forwards, then, to 28 January 2004 and turn to page 32. So we’re back to the next Wednesday, yes?
Anne Chambers: Mm-hm.
Mr Beer: The 28th, the third week, the third Wednesday. I’m reading under “Detailed Description”:
“[Postmaster] says since broadband installed every time he receives stock into [the] office he is showing short by same amount. Has checked to make sure remmed in properly but still showing £2,500 short amount of stock. Rem needs CB to check if accounting or system [problem].”
Are you able to decode for us what that last part means?
Anne Chambers: No.
Mr Beer: Do you know what “CB” referred to?
Anne Chambers: No.
Mr Beer: “Resolution”:
“Advised [the postmaster] that if he feels this is a technical problem to call [the Horizon Helpdesk] but after talking to [the postmaster] he is entering all [transactions] ok, so this could be the case. Advised him to balance and roll for a definite figure then to call [the Horizon Helpdesk]. If no joy call TP.”
Do you know what “TP” was a reference to?
Anne Chambers: It might have been the Transaction Processing team but I’m not certain.
Mr Beer: What did the Transaction Processing team do?
Anne Chambers: I don’t know. I’m –
Mr Beer: Were they part of Post Office or Fujitsu?
Anne Chambers: Post Office, I think. I mean, there was a daily feed of figures at this point from Horizon to a Post Office team via a system called TPS. And so whether – I’m not – I really don’t know but it might have been a team inside Post Office who were getting transaction data at some level sent to them.
Mr Beer: But, again, is this the same as the previous week, essentially the Post Office saying to the subpostmaster “Let’s not sort your problem out now, do the end of week balance, fill out your cash account tomorrow, see if there’s still an issue then”?
Anne Chambers: That appears to be what they are saying.
Mr Beer: Now, we’ve seen therefore here, in the NBSC records, the postmaster was being told to call the Horizon Helpdesk, the Fujitsu side of the house, if there remained a problem. So can we turn, then, to the Fujitsu side of the house to see whether there’s anything in the Fujitsu records. Can we look, please, to FUJ00122322.
Are these a record of the PowerHelp calls? You have to say something rather than nod your head.
Anne Chambers: Sorry, yes. I didn’t realise it was a question.
Mr Beer: Yes, it was: are these a record of the PowerHelp calls?
Anne Chambers: Yes.
Mr Beer: Is the answer to that yes? Okay. These are things that you would have had access to when you came to look at the problem on 26 February 2004 but none of the documents we’ve looked at already?
Anne Chambers: Yes.
Mr Beer: Okay. We can see that the call was opened on 28 January at 11.13. Can you see that in the middle?
Anne Chambers: Yes.
Mr Beer: It was closed eight minutes later on the same day, at 11.21?
Anne Chambers: Yes.
Mr Beer: We can see that the caller on the left-hand side is said to be “Liam”, I think that’s supposed to be “Lee”. If you look at the “Problem Text”, which is just over halfway down:
“Caller states that discrepancies are going through on the system. And this has been the case for 3 weeks in a row. Week 1: £1,103 down. Week 2: £4,230.97 down. Week 3 (today): [approximately] £2,500.”
Can you see that?
Anne Chambers: Yes, I can.
Mr Beer: Then all of that essentially matches what we’ve seen in the NBSC logs, doesn’t it, in terms of the figures and the duration of the problematic events?
Anne Chambers: Yes.
Mr Beer: Then if we go down, please, to the call activity log. Thank you. The first line of text at 11.11:
“New call taken by Dane Meah: Caller states that discrepancies are going through on the system. And this has been the case for 3 weeks in a row.”
Then the three figures we’ve seen are set out, yes?
Anne Chambers: Yes.
Mr Beer: “Caller states that these discrepancies have been relevant to the level of stock currently being held.”
Anne Chambers: Yes.
Mr Beer: Then next:
“[Advised] caller that this problem will need to be thoroughly investigated by NBSC before the issue can be investigated as a software problem.”
Anne Chambers: Yes.
Mr Beer: “Transferred the caller to the NBSC so that the incident could be investigated further.”
Call closed, it’s an NBSC issue, transferred; can you see that?
Anne Chambers: Yes, I can.
Mr Beer: Was this something you came across frequently: subpostmasters reporting losses or gains, discrepancies, and being passed from one organisation to the other with neither taking responsibility?
Anne Chambers: I wouldn’t say frequently but, yes, it did happen.
Mr Beer: You told us, I think, on the last occasion that you were concerned about people being bounced from NBSC to the Helpdesk and back again?
Anne Chambers: Yes.
Mr Beer: And does this appear to be an early example of it?
Anne Chambers: Yes, it appears to be an example of it. Yeah.
Mr Beer: He had reported, consistently, calls to the NBSC; they’d not investigated them; they’d told him to contact the Helpdesk at Fujitsu; he contacts the Helpdesk at Fujitsu and they tell him this has got to be thoroughly investigated by the NBSC?
Anne Chambers: Yes.
Mr Beer: I think you can help us with this, you tell us in your witness statement – no need to turn it up now – the SSC wasn’t involved at all at this time because the HSH bounced it back to NBSC, and had not created a PinICL or a PEAK?
Anne Chambers: Yes.
Mr Beer: Thank you. Can we move forwards to 29 January, please, which is LCAS0000365, and page 33, please.
So he’s back with the NBSC now, yes.
Anne Chambers: Yes.
Mr Beer: The next day, on the 29th, “Cash account discrepancy”. Detailed description:
“Is showing a loss of £2,523.12. Says this is the third discrepancy in as many weeks.”
“Resolution”:
“Checked through figures using transaction log by mode and also amount looked at Rems declaration and cash flow. No trace of the discrepancy. Created call for Suspense Account team.”
Anne Chambers: Yes.
Mr Beer: So he’s been to the NBSC three times. They’ve said on the last occasion “Go to the HSH”. He’s gone to the HSH. They say “This needs to be fully investigated by the NBSC”. He’s gone back to the NBSC. They’ve said, “We’ll create a call for the putting of the money in the suspense account”.
Does that appear to be accurate?
Anne Chambers: That appears to be what they’re doing, yes.
Mr Beer: So, on the face of it, this call isn’t being investigated by the NBSC, the money is just being put, or potentially being put, in the suspense account again?
Anne Chambers: Yes, the NBSC are trying to help him find out what might be the cause of the discrepancy by helping him use the transaction log and checking the REM declarations but they’re unable to pinpoint anything there that might have caused the discrepancy.
Mr Beer: Can we move forward to later on the same day, I think, page 35, so still on the 29th. “Detailed description”:
“[Postmaster] would like to have his transactional archives looked at more closely to try to identify what is going wrong with his office. He is having a lot of losses over the last three weeks and thinks there is a system fault with his remittances.”
Anne Chambers: Yes.
Mr Beer: “Resolution”:
“I have followed KB instructions and sent an email to Adele Kilcoyne so [postmaster] can study his archives to try to identify what has gone wrong. All details are in the log.”
Anne Chambers: Yes.
Mr Beer: Is that a request that you would encounter often in your many years working at Fujitsu, subpostmasters wanting their/”transactional archives” raked over?
Anne Chambers: This is an NBSC call log so I can’t really comment on that. I don’t recall calls like that coming through to SSC, in particular.
Mr Beer: You can’t remember many calls or incidents passed to the SSC, where the subpostmaster was asking for, as it’s recorded here, his transactional archives looked at closely?
Anne Chambers: No, I don’t recall receiving calls at SSC that said that.
Mr Beer: Can we go back to the HSH, please, FUJ00122322, and look at page 2, please. Still on the same day – sorry, page 2, thank you – 29 January 2004. You can see call opened 10.26 and 10.31. I should make it clear I’m not completely clear as to the precise order of the last two documents and this one. These are timed; the other ones are not.
But, in any event, this is a record of a call made the same day and we can see that it lasted or the log was open for five minutes. The caller on the left-hand side is recorded, correctly this time, as Lee, the postmaster and we can see the “Problem Text”, a third of the way down the page:
“[Postmaster] reports [I think ‘he’] is having problems on his system connected to rems. Every time he rems in it leaves him with a discrepancy and he has been to the NBSC and back to us now and wants his system investigating.”
Then down to the “Call Activity Log”:
“New call taken by Mary Rainbow: [postmaster] reports he is having problems on his system connected to rems, every time he rems it in leaves him with the a discrepancy and he been to the NBSC and back to us and now wants his system investigating.
“Advice: advised the [postmaster] for this to happen he needs to be re-referred from the NBSC.
“Caller referred to the NBSC.
“Call [closed].”
Again, is that another example of what you told us about last time, postmasters being bounced between the two organisations?
Anne Chambers: Yes.
Mr Beer: Then lastly before lunch, can we look, please, at page 3 of this document, moving forward to 13 February, which is a Friday. Caller, Lee Castleton. “Problem”:
“Marie @ NBSC – [postmaster advised] his system is doubling up cash declarations and cutting off cheques. They still appear the next day.”
Then “Call Activity Log”:
“New call taken by Tony Law: Marie @ the NBSC – [postmaster advised] his system is doubling up cash declarations and cutting off cheques. They still appear the next day.
“NBSC [advise] they have: checked that he is cutting everything off properly.”
Just stopping there, what do you understand “cutting off” to mean in the context of cheques?
Anne Chambers: At the end of each day, they have to print off a report of cheques. They are then – the cheques had to be posted off somewhere, I think, with the report or a copy of the report as well, and then there was a button that they had to press on the system to say, “I’ve done that”, and that effectively sort of drew a line under that set of cheques so that they wouldn’t appear on the next day’s report.
Mr Beer: Thank you. So:
“NBSC [advise] they have: checked that he is cutting everything off properly, cash figures are being done properly.
“[Postmaster] has insisted on a system check.”
Skipping a line:
“Problem has been happening for 5 weeks.
“Every time stock has been remmed in they have had a loss that night.
“Snapshots and [transaction] logs agree with [the postmaster’s] figures.”
What would you understand that to mean: snapshots and transaction logs agree with the postmaster’s figures?
Anne Chambers: Not entirely clear. I mean, a balance snapshot was a report that they could print to get a picture of the current system figures. But I don’t know precisely what that sentence is meant to mean.
Mr Beer: “[Postmaster advised] NBSC have done: [transaction] logs, Girobank logs, reconciliations, rems in/out, stock holding.
“[Postmaster advised] there is a Sunday decs but no one is on site to do this on a Sunday.
“5 weeks ago [postmaster advised] he did not rem in any stock last week and balanced perfectly. Every week that he does rem stock in, the balance is wrong.
“Escalated to Heather Dryden.
“[Postmaster] states on the cheques listing for the 11th it states all of cheques for the 10th as well. When I got him to go through his cheques, [postmaster] stated that this happened more than once but when going through his cheques it had actually happened just the once. [Postmaster] stated he was sure he cut off, so advised I would log all details and call back if it happens again.
“Call [closed]. [Postmaster] states his cheques keep carrying over from the day before. Advised [the postmaster] to call back if it happens again …”
Yes?
Anne Chambers: Yes.
Mr Beer: So we see that, in the course of this call, it’s recorded that the postmaster insisted on a system check. That wasn’t actioned at the time, was it?
Anne Chambers: No, it appears that they followed up on the specific thing – problem with the cheques listing and – which I think they did actually deal with correctly but they didn’t then go back to all the other issues that he was also reporting.
Mr Beer: They didn’t go back to those?
Anne Chambers: No. They only dealt with the cheques listing, part of what – the problems that he was having.
Mr Beer: They dealt with that by saying, “Let’s see whether it happens again”?
Anne Chambers: No, they – I think that probably what they did was get him to look at the events – the log of Riposte events, which he could look at on his own system, which showed whether a report had been cut off on a particular day. And, I mean, I know from having looked at that same data subsequently, that, yes, there was a day where, although he was under the impression that he had done a cut-off, it had not been done and that explained why the cheques listing on the 11th included the cheques from the 10th as well.
Mr Beer: You tell us in your witness statement that a failure to cut off cheques wouldn’t be connected to the cash discrepancy issue?
Anne Chambers: No. It has no impact on the cash.
Mr Beer: Can you explain why, please?
Anne Chambers: Because this – the cut-off just affected what showed on the cheques report each day. As long as they’d remmed out the cheques correctly, which they had done, that meant that the value of the cheques had been removed from the system, as it should be. Cheques also didn’t directly affect discrepancies because a discrepancy is a difference in the cash totals.
Mr Beer: Thank you very much.
Sir, that would be a convenient moment before we move to 25 February 2004. I wonder whether we can break until 2.05.
Sir Wyn Williams: Certainly. Yeah.
Mr Beer: Thank you very much.
(1.04 pm)
(The Short Adjournment)
(2.05 pm)
Mr Beer: Good afternoon, sir. Can you see and hear me?
Sir Wyn Williams: Yes, I can, thank you.
Mr Beer: Thank you very much.
Good afternoon, Mrs Chambers. We had dealt with calls in January and the early part of February. We’d finished on 13 February. Can we turn to another Wednesday for Mr Castleton, Wednesday, 25 February 2004. It’s FUJ00122322, and to page 8, please.
So this is, is this right, a PowerHelp call record for 25 February 2004?
Anne Chambers: Yes.
Mr Beer: We can see it was open for half an hour.
Anne Chambers: Yes.
Mr Beer: We can see that this time the caller was Christine –
Anne Chambers: Yeah.
Mr Beer: – who I think was one of the clerks or a clerk at Mr Castleton’s branch. We can see the problem stated under “Problem Text”:
“Clerk reports that they have been having problems on the system when balancing that seems to be related to stock remmed in through the week.”
If we scroll down, please, to “Call Activity Log”:
“New call taken by Mary Rainbow …”
So we’re back with Mary Rainbow again:
“… clerk reports they have been having problems on the system when balancing that seems to be related to stock remmed in through the week.
“Clerk reports that over the last seven weeks they have had losses every week, at one point they had a problem with cash on hand but they was found to be an issue with ID numbers and has been resolved.”
Anne Chambers: Yes.
Mr Beer: “Clerk reports that last week when they rolled over they put a loss into suspense account and then took the unit back to trial balance and came out with a zero net discrepancy to start the new CAP …”
Is that cash accounting period?
Anne Chambers: Yes.
Mr Beer: “… with.
“Clerk reports that she printed a balanced snapshot on Monday and all looked okay but since then they have remmed in some stock which appears to have given them a loss.
“Advised the clerk that she will need to check her stock position for last week and then check her rems in summary, this should give her the stock she should be holding. This figure can then be compared with the stock showing in adjust stock and this will highlight any problems with stock on hand.
“Clerk reports they were told that checks would be made on the system but she is unsure if this information came from NBSC or HSH as she has no names or [reference] numbers.
“Advised the clerk that we need her to take the unit to trial balance this evening and come back before she rolls over so we can take down any detail she can give us.
“Clerk reports they usually report the balance at about [5.30 pm] or maybe before.
“Spoke to Matt Saunders and he suggests call should be passed to someone line, Heather Dryden [that’s presumably ‘someone like Heather Dryden’], if clerk does call back wanting further assistance.
“The clerk reports they are working in a shared AA stock unit.
“Clerk to call back tonight if further assistance required.
“Clerk to call back if further assistance required. Call [reference] taken.
“Call [closed]: clerk reports problems with the balance that appear to be linked to stock remmed in – clerk will call back tonight if further assistance required.”
Can we then look to later that day, please, page 10. So later on the 25th, we’re now at 12.03 pm on the same day. I think this is the NBSC calling the HSH; is that right?
Anne Chambers: It looks like it, yes.
Mr Beer: Looking at the “Call Activity Log”:
“New call taken by Robert Congerton: NBSC – [postmaster] has called the NBSC regarding problems with her balance.
“[Postmaster] called in at 11.03 today regarding problems with her balance. Advised NBSC that the agent advised the [postmaster] to call back in tonight when they have a net discrepancy on the cash account.
“Call [closed].”
Yes?
Anne Chambers: Yes.
Mr Beer: So then can we turn to page 14, please. This is still the same day, when the call is opened, Wednesday, 25 February at 5.33 pm. Again, can we read the call activity:
“New call taken by Kuljinder Bhachu: [postmaster] reporting they are getting large discrepancies for the last few weeks.
“Looking at closed calls for this site, there have been a number of calls logged regarding discrepancies. NBSC have been in contact with the [postmaster] and cannot find any user error.”
Just stopping there, do you know what NBSC used to do in order to determine whether or not a discrepancy reported had, as its cause, user error?
Anne Chambers: As I said earlier, getting the postmaster to check the transaction logs against any other records that he had in the Post Office.
Mr Beer: “Spoke to Sandra @ NBSC … regarding this issue. Checked Tivoli events and health checked. Site is health checking ok.”
Can you help us with what a “health check” was?
Anne Chambers: That the comms were all working okay, no sign of any comms problems.
Mr Beer: “Critical event seen … on 18 February 2004 …”
A KEL reference is given. I’m going to ignore the rest of it, until we pick up at 18.09:
“Spoke to [postmaster], who advises that the problem with the [Cash Account] started ever since the BT engineer came to move the BT box for the preparation of ADSL [as it’s called].”
Anne Chambers: Yes.
Mr Beer: “Username … other balance users … balance on Wednesday after 5.30.”
Then this:
“Could SSC please investigate why this [post office] is experiencing large discrepancies ever since BT engineer has moved box in preparation for ADSL [installation]. KEL [reference] given as possible problem.”
You’re later – taking matters shortly, to say that KEL reference was to do with something else completely; is that right?
Anne Chambers: Yes, as I recall, yeah.
Mr Beer: “NBSC have said there is no user error. Thank you.”
Is this, therefore, the event which generates the PinICL which triggers your involvement?
Anne Chambers: Sorry, yes, you’re not talking about a system event; you’re talking about the call being handed – passed over to SSC, yes.
Mr Beer: Yes, so the request for SSC involvement we see at 18.14:
“Could SSC please investigate why this [post office] is experiencing large discrepancies ever since the BT engineer has moved the BT box …”
Anne Chambers: Yes.
Mr Beer: Is that the task that you subsequently undertook, investigating all of the discrepancies that had been reported since the BT engineer had moved the BT box?
Anne Chambers: I can’t remember what the date was when the BT engineer did move the box.
Mr Beer: It’s described here as “seven weeks ago”.
Anne Chambers: Okay, I –
Mr Beer: I don’t think you did conduct –
Anne Chambers: No, I –
Mr Beer: – such a broad investigation?
Anne Chambers: No, I concentrated mostly on the last couple of weeks, which was when I had most of the evidence for.
Mr Beer: Given that this was the request, “Could SSC please investigate why this [post office] is experiencing large discrepancies ever since the BT engineer had moved the box”, why did you look only at the last couple of weeks?
Anne Chambers: Because that was the data that was most readily available and I think I assumed that, if there was a problem, an ongoing problem, then I would find evidence of it most easily in the most recent weeks.
Mr Beer: What about if there was more than one problem?
Anne Chambers: Gosh, um –
Mr Beer: A problem or problems in the earlier weeks, different from any problem in the later weeks?
Anne Chambers: Yes, it’s possible, then, if there was a problem in the – a different problem in the earlier weeks, that my investigations might not have found it. I – obviously, even 18 months beyond this, I couldn’t remember precisely what my investigation was. I knew I had very thoroughly investigated a week or two –
Mr Beer: My question is: why did you investigate only a week or two?
Anne Chambers: As I said, because I felt that, if there was an ongoing underlying cause, then I would find that most readily in the most recent week.
Mr Beer: Would you not take this as your terms of reference or your instruction, the request that essentially dates back to when the first problem was reported back on 14 January 2004?
Anne Chambers: I don’t think I would necessarily have done this. I was just doing a general investigation to see if I could find the cause for the discrepancies.
Mr Beer: But only the recent discrepancies?
Anne Chambers: That was my starting point, yes.
Mr Beer: Well, it was your ending point too, wasn’t it?
Anne Chambers: Yes, it was my – yes, given that I now cannot remember precisely what I did over which stage but, yes, if there’d been – I probably did not investigate thoroughly back towards the beginning of January.
Mr Beer: Can we turn, please, to the PinICL, please, which is essentially your originating document –
Anne Chambers: Yes.
Mr Beer: – would that be fair?
Anne Chambers: Yes.
Mr Beer: That’s FUJ00146165. In fact, it’s a PEAK, not a PinICL. We can see the PEAK number, PC0099954, and we can see it was opened on the day we’ve just referred to, 25 February 2004, at 6.19 pm; can you see that?
Anne Chambers: Yes.
Mr Beer: I think if we look at page 2, we can see that it was assigned to you at 9.41. Can you see that just below halfway down –
Anne Chambers: Yes.
Mr Beer: – and that’s the following day –
Anne Chambers: Yes.
Mr Beer: – 26 February –
Anne Chambers: Yeah.
Mr Beer: – at 9.41?
Anne Chambers: Yes.
Mr Beer: Does that mean that you get it then or does it just mean that it has been assigned and you don’t receive anything until you log on to a system?
Anne Chambers: When I next looked at my PinICL stack, I would have seen it but I don’t know – that wasn’t necessarily at 9.41.
Mr Beer: I think we can see that you had looked at your stack by at least 10.17 –
Anne Chambers: Yes.
Mr Beer: – because you make an entry at 10.17, right at the foot of the page –
Anne Chambers: Yes.
Mr Beer: – when you changed the description in the call summary box?
Anne Chambers: Yes.
Mr Beer: I think others may ask you about that. So this is the first record we see of you doing any work on this event, yes?
Anne Chambers: Yes.
Mr Beer: Can we go back to page 1, please. What on this page do you see when you open up this PEAK?
Anne Chambers: Just that they’re reporting large discrepancies. It says there’s been a number of calls logged.
Mr Beer: Just stopping there, it says:
“[Postmaster] reporting that they are getting large discrepancies for the last few weeks.”
That’s not really accurate, is it, on the basis of what we’ve seen?
Anne Chambers: Is that not accurate?
Mr Beer: Didn’t it go back to 14 January?
Anne Chambers: Well, I’d have said that the last few weeks from the 25 February probably does just about include 14 January.
Mr Beer: Was that phrase “last few weeks” what conditioned your investigation to any look at data for a week or two?
Anne Chambers: I don’t think so. I think I then did look at the closed calls and so then I did get the picture and I could see that, yes, they had been reporting problems since – was it 14 January – when they had the £1,100 loss.
Mr Beer: Where would you have seen that they had been reporting calls since 14 January from?
Anne Chambers: Was that not on the PowerHelp calls?
Mr Beer: Can you look, please, at FUJ00122322. The first PowerHelp call is on 28 January –
Anne Chambers: Yeah.
Mr Beer: – and it’s only in the NBSC call log that one sees the records for 14 and 21 January –
Anne Chambers: But this –
Mr Beer: I’m so sorry, you’ll see in the “Problem Text” that it’s recorded that it’s been the case for three weeks in a row?
Anne Chambers: Yes.
Mr Beer: Are you saying that you read this and realised that the 28th wasn’t the first report, it had been going on for three weeks beforehand?
Anne Chambers: Yes, I think so. I mean, I read that now and that’s what I read, and I think I would have seen that at the time.
Mr Beer: Yes. So why wouldn’t you investigate the three weeks beforehand?
Anne Chambers: Because the message store data would not have gone back to 14 January.
Mr Beer: How far back would it have gone, when you were looking at 26 February?
Anne Chambers: I’m hesitating because –
Mr Beer: We’ve heard different dates in the Inquiry, so I’m not going to suggest how long the message store was retained for?
Anne Chambers: At one point, messages were kept for 42 days and then that was reduced and they were then kept for only around 35 days, I think it was. But I can’t remember when that change came in.
Mr Beer: We’ve heard both of those dates. Thank you. So was it that you thought that, if there was a system problem, it would be disclosed by investigating recent weeks, that you limited your investigation to recent weeks or was it because the data wasn’t available on the message store?
Anne Chambers: I think, primarily, it was because I thought, you know, if there was an ongoing problem I would find the evidence for it in the recent weeks and that was the obvious place to start looking.
Mr Beer: Can we go back, please, to FUJ00146165, which is the PEAK?
Anne Chambers: Yes.
Mr Beer: So you can see all of this data on the first page, ie every entry that’s made before you look at 10.17 the following day?
Anne Chambers: Yes.
Mr Beer: Would your practice have been to read what’s here or were there certain bits that you know to go to, without reading it line by line?
Anne Chambers: I certainly would have glanced over it. I probably would have gone back and looked at all the PowerHelp calls, as well, in case there was more information on those that, for some reason, wasn’t on the PEAK. Certainly the PEAK would only contain the information from the latest, that – the PowerHelp call on which this was based. But I would have gone and looked at everything on PowerHelp.
Mr Beer: Do you see anything else automatically, whether by sort of hyperlink or other electronic connection, when you open up the PEAK, or do you have to go and find it yourself?
Anne Chambers: I have to go and find it myself.
Mr Beer: I think you tell us that, first off, you looked for other PEAKs or PinICLs and you tell us in paragraph 29 of your statement that there were none?
Anne Chambers: Yes.
Mr Beer: That, would you agree, would be because none had been raised because Mr Castleton had been passed backwards forwards between NBSC and HSH a number of times and nobody had referred the matter to the SSC?
Anne Chambers: Yes, but I went looking for other PEAKs purely because of that. I’d have seen that from the PowerHelp calls anyway. I was also looking in case there were any reconciliation calls or system event type calls, for which PEAKs had been raised, which I might not have found so readily on PowerHelp.
Mr Beer: How would you search PinICLs or PEAKs, by reference to the FAD code?
Anne Chambers: The FAD code, yes.
Mr Beer: So you’re looking whether there’s anything branch specific?
Anne Chambers: Yeah.
Mr Beer: You tell us in your witness statement, there’s no need to turn it up, it’s paragraph 30, that you checked whether the branch appeared in any reconciliation reports?
Anne Chambers: Yes.
Mr Beer: Can you explain what reconciliation reports are, please?
Anne Chambers: There was a whole suite of checks that were made comparing, for example, totals from the counters, for the transactions each day, with the totals that were – had reached the data centre to make sure nothing had got lost being moved from when it was replicated from one to the other. Yeah, there was a large suite of checks.
Also, the cash account was recalculated at the data centre, based on the copy of the transactions there, and compared with the cash account that had actually been produced at the branch. So this was just checking the integrity of the data, if you like.
Mr Beer: For what period did you check the reconciliation reports?
Anne Chambers: I believe those reports were only kept for two weeks. That’s what I said, I think, back in 2006, when I probably knew, and so I just would have checked all the reports as far as back as they existed.
Mr Beer: Can we look, please, at LCAS0000112. This is your witness statement in the proceedings. As you say, it’s dated 14 September 2006. Can we look at the second page and look at paragraph 7 at the bottom. You say:
“On 26 February, I also checked for any central reconciliation report entries for the branch for the [past] 2 weeks which might indicate a system problem.”
So that’s the two-week period?
Anne Chambers: Yeah.
Mr Beer: You don’t say there “They were the only ones that are available to me”.
Anne Chambers: No, I didn’t say that then.
Mr Beer: Were they the only ones available to you or did you frame the request, namely only to look back a couple of weeks?
Anne Chambers: No, I mean, the way I checked was just to look for all occurrences of the FAD code in any files in the folder that held the reconciliation reports. So I checked everything that was available at that time.
Mr Beer: Were those reports automatically generated by the system?
Anne Chambers: Yes.
Mr Beer: That can come down, thank you.
Which part of the system were they automatically generated by?
Anne Chambers: There was – part of the overnight processing at the data centre produced the – well, compared the sets of figures that it received from various sources.
Mr Beer: Did they rely on Riposte as part of the process for the compilation?
Anne Chambers: Only in so much the data that was aggregated for the totals to be compared had to be – I mean, Riposte was the mechanism which read the message store. So – sorry, I’m trying to think about this.
So yes, I mean, on the counters, the figures that were used for comparison, there must have been some sort of Riposte query, saying “Add up this data”, out of the message store. And then I presume at the data centre it was also using Riposte to access the data centre to access the messages for the branch.
Mr Beer: If there were errors or discrepancies in the compilation of these reports, would you have any means of checking that that was so?
Anne Chambers: I mean, I think if there were errors on one side or the other, then we would be seeing a lot of – you’d get a lot more entries on the reconciliation reports because, otherwise, it – it seems pretty unlikely that you would get the same Riposte error happening on a counter and at the data centre at the same time, if – and if you had it – had an error on one side but not on the other then the figures wouldn’t match and you’ll get an entry on the reconciliation reports to be investigated.
And I’ve – I think, very occasionally, there were entries that were due to some sort of inconsistency in calculation rather than anything else but they were all investigated, as were any reconciliation report entries.
Mr Beer: You tell to in your witness statement, and this is paragraph on page 9 – no need to turn it up – you looked at the HSH raised calls for the branch on the PowerHelp system as you’ve described?
Anne Chambers: Yes.
Mr Beer: We’ve seen those already. They go back to 28 January and the NBSC call log goes back further than that?
Anne Chambers: Yes.
Mr Beer: But there’s a reference on that first page to three weeks that the problem has been occurring for, yes –
Anne Chambers: Yeah.
Mr Beer: – with the amounts written down –
Anne Chambers: Yes.
Mr Beer: – on each of those three weeks?
Anne Chambers: Yes.
Mr Beer: I don’t think you investigated those historic balance discrepancies, did you?
Anne Chambers: At that point no, I probably didn’t.
Mr Beer: In paragraph 34 of your witness statement – I wonder whether we could turn that up, please, WITN00170200, page 11, please. Paragraph 34, which is at the foot of the page, you say:
“As well as examining the message store using a text file viewer, I probably extracted all the transaction messages into a spreadsheet so they could be more easily examined. I certainly did this for the cash lines (product 1). I cannot remember whether this was for a week or longer, nor which week(s) I checked.”
Anne Chambers: Yes.
Mr Beer: Now, of course, when you were doing this you didn’t realise that you would be called to give evidence about what you had done?
Anne Chambers: Yes.
Mr Beer: Is that fair?
Anne Chambers: Yes, that’s fair.
Mr Beer: So you didn’t keep a record of the work that you had undertaken?
Anne Chambers: No, I –
Mr Beer: At the end of the process, you summarised it in an entry in the PEAK?
Anne Chambers: Yes, I would have kept the spreadsheet and the message store in my own file store for some time afterwards but I didn’t still have it in 2006.
Mr Beer: So when it came 18 months later to make the witness statement – in fact, it’s longer than 18 months later, it’s two and a half years later – you didn’t have your workings out available to you?
Anne Chambers: No.
Mr Beer: If you’d known that you were going to be a witness, whether a witness of fact or an expert witness, would you have kept them?
Anne Chambers: Yes, I would have done. I could have attached them to the PEAK, which would have been a safe place to keep them, but we tended only to put data on PEAK for calls that were then going to be passed on to Development or whatever.
Mr Beer: Again, you say that you can’t remember whether you did this, ie extracting messages into the spreadsheet from the message store, for a week or longer. Why wouldn’t it be for all of the period, given that the concerns had been raised a month and a half previously?
Anne Chambers: Yes, it might have been. I can’t remember. I know I – I didn’t want to say that I had done more than I had done, when I couldn’t truly remember what I’d done or not. I know, I absolutely certainly did it for a week. It could well have been longer than a week but I can’t remember.
Mr Beer: If you had a problem revealed on the PEAK to be of seven weeks’ duration, wouldn’t the natural thing to do, if the data was available, to examine the available data for that seven-week period?
Anne Chambers: Yes, it would seem to be so, and I may have done it but I cannot swear that I did do it.
Mr Beer: Again, the two weeks of reconciliation reports you looked at, that was a limiting factor only because they were the only reconciliation reports available?
Anne Chambers: I checked all the reconciliation reports that were available, yes.
Mr Beer: That two-week period wasn’t the governing period for the entirety of your investigation?
Anne Chambers: No.
Mr Beer: How much time did you take undertaking the investigation?
Anne Chambers: Well, I’m aware I closed it before the end of that day, so it was a few hours’ work.
Mr Beer: If we look at FUJ00146165, second page, please. If we scroll down to 10.17, we can see your entry at 10.17. So you’re certainly aware of this PEAK by the time of that entry?
Anne Chambers: Yes.
Mr Beer: If we look at the bottom of the page, please. We can see your entry of 3.16 pm that day –
Anne Chambers: Yes.
Mr Beer: – which is your last entry, essentially?
Anne Chambers: Yes.
Mr Beer: Would you have spent the five or so hours between those two times only on this or would you have been looking at PEAKs and other issues too?
Anne Chambers: I was probably only looking at this.
Mr Beer: You said a couple of hours earlier, it looks like it’s about five hours?
Anne Chambers: Yes.
Mr Beer: Can we turn, please, to your witness statement, WITN00170200, and look at page 4, please, and paragraph 13. You say here that a call – this not one we’ve looked at, and you give the number:
“… was not obviously referring to discrepancies. It was logged when Mr Castleton found the message ‘Desktop intialisation failed’ on the counter 2 screen on the Monday morning. Attempts to clear the problem by rebooting, and by deleting the training message store, were not successful so an engineer was sent to replace the base unit with a new one. As part of the standard base unit replacement process, a zipped copy of the previous night’s message store was copied from counter 1 to the new counter 2, then all subsequent messages were replicated across. This is completed at around 2.20 pm and then LCA001 was able to log on to counter 2. It was not possible to carry out transactions on counter 2 before then, (though see below).”
This issue you’re talking about here, the installation of the new base unit, was this part of your investigation at the time, ie on 26 February 2004?
Anne Chambers: I don’t recall that I did look closely at this at that time.
Mr Beer: So this is something that you’re telling us now –
Anne Chambers: I – yes.
Mr Beer: – by looking at documents now –
Anne Chambers: Yes.
Mr Beer: – rather than something you did back in 2004?
Anne Chambers: Yes, I looked at it, of course, in 2006 and I’ve looked at it again now.
Mr Beer: These messages that you’re talking about here are dated 1 and 2 February 2004. Was the reason that you didn’t look back at those at the time that they were outside the date range that you were looking at?
Anne Chambers: No, I think it was because it wasn’t relevant to discrepancies, rather than that it was outside the date range.
Mr Beer: So you would have looked at them and seen that they – that there was this issue about the installation of a new base unit?
Anne Chambers: Sorry, when you say “them”, what do you mean?
Mr Beer: Messages from Mr Castleton about the installation of a new base unit?
Anne Chambers: No, that was a message that was displayed on his computer –
Mr Beer: Screen?
Anne Chambers: – screen, that he saw, and so that was when he logged a call about it with the Helpdesk, he said that was what he reported was showing on the screen.
Mr Beer: So why were you, when you looked at these messages, content that they could have had no impact on discrepancies when Mr Castleton was saying it’s since the installation of this new base unit that the problem has occurred?
Anne Chambers: I’m not sure he was. He was saying it was from the installation BT box? That message that he saw on the screen meant that the computer was not working at all, which is why it had to be replaced. If it’s not working, you can’t be doing transactions on it. I’m sorry, I’m not quite sure where we’re trying to go.
Mr Beer: If we carry on in your witness statement, please, at 14, you say:
“Looking at the … event messages, there are none written on counter 2 between 1 February and 2.24 pm on 2 February. All counters at the branch regularly exchange handshake messages to check they are all up and running; counter 1 realised it could not communicate with counter 2 and so wrote an event (and also displayed a message to the user) that it was disconnected from the network. I think the message that it was disconnected is slightly confusing; the network was ok (and counter 1 was in communication with the data centre and could do online banking transactions) but counter 2 was effectively dead.”
What do you mean by the messages produced by, I think, Riposte were slightly confusing?
Anne Chambers: Because – I put this section in because I was questioned about it in 2006 and it was obviously an area of concern to Mr Castleton and, because I hadn’t really covered this in my 2004 investigation, I thought it was worth trying to spell out here what I can now see. So to go back a bit, the – there was an event that was included in the ARQ event data that said node 1 is completely disconnected from the network, and I think Mr Castleton asked me questions about this in 2006 but, in fact, yes, the – this message was being produced on counter 1 because it couldn’t communicate with counter 2, and that was because counter 2 had failed and was being replaced.
Mr Beer: Can we look, please, at EXPG0000001 and turn to page 174, please. You can see this has just extracted into an expert report that the Inquiry has received a KEL. Can you see it was raised back in 1999 and updated in 2004?
Anne Chambers: Yes.
Mr Beer: The symptoms are:
“Riposte error demodify operation failed.”
Is that I/O or L/O?
Anne Chambers: I/O.
Mr Beer: What is the “I/O completion weight operation”?
Anne Chambers: I assume I/O is input/output but this isn’t something I have any memory or knowledge of.
Mr Beer: Then some code is given:
“… error occurred within the cache manager. The I/O completion wait operation timed out … The message server will be shut down abnormally.”
Then “Solution”:
“Reboot counter. If message appears then send engineer. If a single counter outlet engineer is to replace the mirror disk first and if the message reappears to then replace the base unit … the base unit is replaced … Contact the SMC to synchronise the message stores … See [another KEL] for further details … On a multi-counter outlet, replace the base unit.”
Anne Chambers: Yes.
Mr Beer: Is this KEL essentially explaining that, after hardware replacement, engineers need to make sure that they synchronise machines so that transactions are not lost?
Anne Chambers: That’s a single counter office.
Mr Beer: I’m sorry?
Anne Chambers: It’s – yes, so it’s hard to read because you haven’t got it formatted – it’s not formatted very well but it’s “If a single counter office”, which is SCO, “the engineer must contact the SSC to synchronise the message stores”.
So the synchronisation is vital if replacing the base unit at a single counter office.
Mr Beer: Do you recall discussing this issue in the run-up to Mr Castleton’s trial?
Anne Chambers: No, I don’t, and he had a multi-counter outlet anyway.
Mr Beer: Let’s look at what was discussed, then.
Anne Chambers: I mean, this precise error isn’t the error that he was getting anyway. So …
Mr Beer: I see. This is a different –
Anne Chambers: This is a different, the probable disk problems is the underlying problem but it was for a very specific Riposte error, which was not seen at Marine Drive.
Mr Beer: Got it. Let’s look at the discussion that did take place before the trial, then. POL00071165. Can you see this is an attendance note of a meeting at which you and a number of other Fujitsu and Post Office witnesses were all present?
Anne Chambers: Yes.
Mr Beer: Can you see that –
Anne Chambers: Yes.
Mr Beer: – dated 6 June 2006?
Anne Chambers: Yes.
Mr Beer: Some solicitors from Bond Pearce, a solicitor from Hugh James, Brian Pinder, Peter Sewell, Andy – I think that’s Dunks –
Anne Chambers: Yes.
Mr Beer: – D-U-N-K-S, rather than “Dunce” –
Anne Chambers: Yes.
Mr Beer: – Anne Chambers, Naomi Ellis, Gareth Jenkins –
Anne Chambers: Yes.
Mr Beer: – a “distinguished engineer of Fujitsu” –
Anne Chambers: Yes.
Mr Beer: – Gareth Ward of the Post Office, yes?
Anne Chambers: Yes, it was actually Naomi Elliott, who was my manager’s manager.
Mr Beer: Can we turn to page 6, please. Can we look at the third main paragraph down:
“At approximately 3.30 am the PCs do a refresh and occasionally you get glitches in the system and this sometimes causes an initialisation failure. An operational integrity violation points to a refresh not starting up properly. An engineer was sent out to sort the base unit and node. It is worth noting that all messages will be copied from the other node. Potentially could lose some information if the two PC nodes were not communicating at the point of breakdown. There is nothing to suggest there was a problem at the end of the previous day. This can be checked by looking at the end of day marker to 1 February.”
Then “AC”. I think, in that context, that must mean you?
Anne Chambers: It must.
Mr Beer: “AC stated that if it is a problem can forensically check the old hard drive but you would need the postmaster to be aware of transactions having been lost.”
If this had occurred, would it be shown on standard, filtered ARQ data?
Anne Chambers: If the transactions were lost, then they wouldn’t have got anywhere to be audited.
Mr Beer: So if the postmaster was not aware at the time, and the synchronisation didn’t work, the transactions could be permanently lost?
Anne Chambers: Possibly, yes, but you can tell from the ARQ data whether the synchronisation was working. You can certainly tell from the underlying audited messages where the synchronisation was working.
Mr Beer: What about from the standard, filtered ARQ data?
Anne Chambers: You could certainly see whether somebody had logged out, for example, at the end of the previous day, which would sort of imply a clear closedown. But – sorry, I’m just trying to remember. I think it would be hard to tell 100 per cent from the ARQ data whether this had happened or not.
Mr Beer: Were, at this time, the hard drives in the Post Office estate known to be subject of high failure rates?
Anne Chambers: I’m not sure about high failure rates but, yes, there certainly were problems.
Mr Beer: Was it regarded as a significant issue?
Anne Chambers: I don’t know if it was or not.
Mr Beer: Was it talked about within the SSC, the number of hard drive failure rates?
Anne Chambers: Not that I recall. There –
Mr Beer: I’m sorry?
Anne Chambers: Yes, I was just going to say there were also times when base units were replaced when, in fact, it might have been possible to sort out the problem in some other way, but it was actually the quickest way to get a – if, for some reason, a counter was unable to restart and run Riposte, it was actually quicker to get them up and running again by sending an engineer out to exchange the base unit, rather than by digging down as much as you could potentially have done into, you know, precisely what the problem was.
Mr Beer: Thank you, Mrs Chambers.
Sir, we’re finishing at 4.00 pm today. Might that be a time for the afternoon break until 3.10?
Sir Wyn Williams: Yes, that’s fine, Mr Beer. Thanks.
Mr Beer: Thank you very much.
(2.55 pm)
(A short break)
(3.09 pm)
Mr Beer: Sir, good afternoon, can you see and hear me?
Sir Wyn Williams: Yes, I can, thank you.
Mr Beer: Thank you.
Mrs Chambers, in your statement, you deal with the question of what would happen if Mr Castleton was logged on to node 1 at the branch during the time that node 2 was out of action, and then node 2 came back into action, he logged out – sorry, he logged on to node 2 without logging off node 1.
Anne Chambers: Yes.
Mr Beer: First of all, can you explain in simple terms what a node is?
Anne Chambers: A serving position, a counter, a separate – two separate computers.
Mr Beer: So he’s initially logged on to node 1 –
Anne Chambers: Yes.
Mr Beer: – at a time that node 2, the other counter, is out of action?
Anne Chambers: Yes.
Mr Beer: Node 2 comes back online?
Anne Chambers: Yes.
Mr Beer: He logs on to that node 2 –
Anne Chambers: Yes.
Mr Beer: – but without logging off from node 1?
Anne Chambers: Yes.
Mr Beer: You say, cutting through things, the result is that any transactions that he had done on node 1 would travel with him for completion on to node 2?
Anne Chambers: Any transactions that hadn’t been settled on node 1 would be moved over to node 2.
Mr Beer: Can we look, please, at LCAS0001300. Can we look at page 337 in the bundle, please?
If you can go back a page. I think that was it. Yes, I think that’s 337, at the top there. Can that be expanded, please? Thank you. On this page, can you, in broad terms, without doing it column by column, explain what is shown by this document and where the data comes from?
Anne Chambers: Right. This appears to be part of an ARQ extract, what’s, I think, usually called the transaction log.
Mr Beer: So just stopping there, this shows transactions, does it –
Anne Chambers: This shows transactions.
Mr Beer: – as opposed to events?
Anne Chambers: Yes.
Mr Beer: Okay. Just in broad terms, tell us what the difference between a transaction and an event is?
Anne Chambers: A transaction has a financial value and is – will subsequently be included in the branch accounts. An event is various things, showing users logging on/off –
Mr Beer: Printing?
Anne Chambers: Some – yeah, AP and reports being printed.
Mr Beer: You said that this is ARQ data represented on this page. Is this or could this be described as raw ARQ data or has something been done to get it into this format?
Anne Chambers: I – the underlying data, and I don’t know precisely what “ARQ” means, but the underlying archived messages are the raw messages as written on the counter, which get replicated to the data centre and then get funnelled off into files for audit.
Mr Beer: How is that, I’ll call that raw data, translated into a spreadsheet such as this?
Anne Chambers: An extract is – would be run against that raw data, pulling out all transactions in this case, which is where you’ve got – I’ve forgotten what the extract did but it pulls out all lines where you’ve got a product number and various other attributes.
Mr Beer: Is that pulling out – can that be described as parsing?
Anne Chambers: I think parsing is more the sense where you’ve found the records that you like but then, out of those records, you pull out various pieces of information, for example, user, session ID. So the pasting is the breaking up of a message and just pulling out certain pieces of information from that message.
Mr Beer: Those two parts of the extraction and presentation, respectively, were they done by software that had been written in the SSC?
Anne Chambers: No. The access to the audited data was – could only be done by the Security team and they took total responsibility for that and the SSC weren’t allowed anywhere near the audit data.
Mr Beer: So the Security team had to get the data – the raw data, as I’m calling it – from where?
Anne Chambers: There were very big files that were accumulated day, after day, after day, and then they had tools which SSC did not support, which enabled them to extract the data for the particular branch for a particular date range and then to format it in this way and to split it into event data and transaction data.
Mr Beer: When it came to you, was it already in this type of format?
Anne Chambers: I didn’t normally look at data in this format at all. We didn’t use this data. Except – I think the first time probably I ever saw data in this format was for Marine Drive.
Mr Beer: Was for this case?
Anne Chambers: Yes. In 2006.
Mr Beer: So this first page, then, is looking at transactions extracted from ARQ data?
Anne Chambers: Yes.
Mr Beer: Then if we skip over two pages at 339 – and just if that can be expanded a little bit so you can see – is that showing the events data?
Anne Chambers: That’s the events data, yes.
Mr Beer: Thank you.
Anne Chambers: There would also have been messages that didn’t fall into either of those categories.
Mr Beer: Thank you. Looking at 339, first, please. I can’t quite see what’s happened on the screen there. Thank you. Can we find the line which is 12.41.50. Can you see that? It’s almost exactly halfway down the page.
Anne Chambers: Sorry, yes. I can see it.
Mr Beer: I wonder whether that can be highlighted. 12.41.50. It’s now about eight lines in. Just the one below that. Thank you. Does that show that at 12.41.50 pm, the user, LCA001, logged on to node 1?
Anne Chambers: Yes, it does.
Mr Beer: Can we see the node in the second column from the left?
Anne Chambers: That’s the node, yes, on which the message was written and that must have been the node to which he logged on.
Mr Beer: On the same page, can we see at 2.24.58, node 2 was up and running and LCA001 logged on to that?
Anne Chambers: Yes.
Mr Beer: Can we go back, please, to page 337, and scroll down, please. Can we see between 14.21.12 and 14.22.14, before LCA001 had logged on to node 2, those credentials appear against a series of, I think, 14 pension transactions?
Anne Chambers: Yes.
Mr Beer: If we just track those, 14.21.12, right down to 14.22.14, so about 14 columns on – 14.22.14 – and one more. Thank you very much.
So before node 2 was up and running again, at 2.24 pm, it’s shown on these transactions, on node 2, as appearing against 14 transactions that are carried out in, I think, a period of about 1 minute, 2 seconds; is that right?
Anne Chambers: Yes.
Mr Beer: Can you see in column F, in the session ID, there is a series of numbers with “-1” after them?
Anne Chambers: Yes.
Mr Beer: Do you understand from that that that is the transactions travelling from node 1?
Anne Chambers: I wouldn’t have – well, yes, it’s – the transactions were carried out on node 1. That’s why the session ID, which is the same for that complete set, has got “1” in the third position of it, after the branch code. So they were carried out on node 1, but then finally at 14.22.14, the session – ah, no.
Where’s the – the settlement’s further down somewhere, isn’t it, I believe? Yes, we haven’t got a settlement in there at all. The confusing thing about looking at the data in this format is the time, it’s the time that the transaction was started, which isn’t necessarily the time at which the session was settled.
Mr Beer: If the transactions were made here with LCA001’s log-in, how could that happen before LCA001 had logged in to node 2?
Anne Chambers: Because they were done on counter 1, which is why the session ID and the transaction IDs all have “1” in the third part of them. They were carried out on counter 1 but they were not settled before he logged on to counter 2. So when he log on to counter 2, those transactions, because they were still just on the stack and hadn’t been written to message store, so they were transferred across to the second counter. I think this is all explained very clearly in John Simpkins’ witness statement.
Mr Beer: I’m asking you for your view at the moment. We’ll get to Mr Simpkins, I think, after Christmas.
Anne Chambers: Yes. My view, when looking at this, was that yes, they were done on counter 1 but because they weren’t settled before Mr Castleton logged on to node 2, they were carried across to node 2 and somewhere further down we’ll have a transaction with the same session ID which is the settlement for that session.
Mr Beer: Can we scroll down, please, and see whether we can find that?
Anne Chambers: It’s that one at 14.28.17.
Mr Beer: So four down from the top of the page.
Anne Chambers: I’ve lost …
Mr Beer: Can you explain what that shows?
Anne Chambers: That shows that at 14.28.17 on counter 2 the session that had been started on counter 1 with the session ID 1-899855 was settled on counter 2 to cash for £1,350.75.
Mr Beer: Thank you. That can come down.
It’s right, isn’t it, that each week the subpostmaster would carry forward cash in hand and the stock in hand, so that one set of figures, from, say week 1 would feed into the figures for week 2.
Anne Chambers: Yes.
Mr Beer: Can we, please, look at LCAS0000362, and page 29, please. Just forgive me a moment whilst I catch up in my hard copy papers.
(Pause)
Mr Beer: Is this the cash account for week 41?
Anne Chambers: It appears to be, yes.
Mr Beer: We can see that in the top right-hand corner –
Anne Chambers: Yeah.
Mr Beer: – in respect of Marine Drive –
Anne Chambers: Yes.
Mr Beer: – Bridlington. Can we see that that week ended 7 January 2004?
Anne Chambers: Yeah. Cash account.
Mr Beer: Can we go to page 30, please. If we just go back. I was taking the date from underneath “Cash Account (Final)”, “Week Ended” underneath it?
Anne Chambers: That’s the end of the accounting period but this report wasn’t actually printed and produced until the –
Mr Beer: Until the 8th?
Anne Chambers: Until the 8th, in the morning.
Mr Beer: So I wonder whether that can be highlighted underneath the words “cash Account (Final)”, the words “Week Ended [7 January 2004]”. Thank you.
Can we go to page 30, please, and scroll down. Can you see the section of the cash account dealing with cash and stock in hand.
Anne Chambers: Yes.
Mr Beer: Can you see that the cash in hand is £43,757.92?
Anne Chambers: Yes.
Mr Beer: Can you see that the stamps in hand are £5,335.11?
Anne Chambers: Yes.
Mr Beer: So those figures ought to be the same when we look at the transaction data in Horizon, yes, in the ARQ data?
Anne Chambers: There wouldn’t be – that wouldn’t be held as transaction data in Horizon.
Mr Beer: It would be held as?
Anne Chambers: Opening figures, which aren’t included in the ARQ extract.
Mr Beer: Would they appear as “declare cash” or “declare stamps” before the cash report account?
Anne Chambers: You would expect to see those figures or things that added up to those figures in the event data, yes.
Mr Beer: In the event data. Thank you very much. Can we try and look for that, then, please, remembering those figures: 43,757 and 5,335, yes?
Anne Chambers: Yes.
Mr Beer: Can we look, please, at LCAS0000224. I wonder whether that can be expanded, so we can see a little more of it, please. Thank you. Can you help us as to what these data are?
Anne Chambers: This is an extract from the ARQ event data. It looks like it might not be all the –
Mr Beer: I missed the end of the sentence?
Anne Chambers: It’s some lines, I think, from ARQ event data. It’s not a complete set of ARQ event data. It’s a subset.
Mr Beer: If we look for 8 January so if we scroll down, please, and for 8 January 2004, can we see the declare cash figure at 7.01.52 am?
Anne Chambers: Yes.
Mr Beer: The declare cash figure is £43,757.92?
Anne Chambers: Yes.
Mr Beer: The same figure?
Anne Chambers: I didn’t write down the figure that we were looking at before.
Mr Beer: Yes.
Anne Chambers: Yes.
Mr Beer: It’s the same figure, yes.
Anne Chambers: Okay.
Mr Beer: That appears twice, declare cash total twice. can you see that?
Anne Chambers: I can, yes.
Mr Beer: It doesn’t matter for present purposes why that is. Then a little while later, at 7.49.24, it says, “Report Cash Account, Report Printed”, yes?
Anne Chambers: Yes. Sorry I’m rather puzzled by that data not being in date order but never mind.
Mr Beer: Ie not in chronological time order?
Anne Chambers: Not in time order. The ONCH total above is obviously from later that day so this data has been manipulated in some ways. Sorry, I don’t mean that in a bad way but I’m just pointing it out. But, yes –
Mr Beer: But these should be chronological time order?
Anne Chambers: They would have been when it – I would have thought they would have been when extracted for the ARQ event data but, yes. So you’ve got a cash account at 7.49.
Mr Beer: So would that have been the printing of the document that we just looked at?
Anne Chambers: I assume so, yes.
Mr Beer: So all okay, so far?
Anne Chambers: Yes.
Mr Beer: Can we look, then, at the declare stamp total figures on 7 January at 17.06 and 17.41. If we just scroll up a little. That’s it, we’ve got it, 17.06.
Anne Chambers: Yes, and then –
Mr Beer: Can you see “Declare stamp total, £1,183.22”?
Anne Chambers: Yes, I can. Again, they’re not in date order, in time order.
Mr Beer: There’s a previous one –
Anne Chambers: Yeah.
Mr Beer: – 35 minutes later, printed before –
Anne Chambers: Yes.
Mr Beer: – namely 7.41.30, “Declare stamp total, 0”.
Anne Chambers: Yeah.
Mr Beer: There aren’t any other declare stamp total figures on this page, are there, before the report cash account entries the following morning?
Anne Chambers: Doesn’t look like it, no.
Mr Beer: Those two figures, 1,183.02 and then 0, at 17.46 and 17.41, neither of those match the “5,335.11 figure for stamps in hand, as it appears in the final cash account, do they?
Anne Chambers: They don’t appear to, no. Could we just go up slightly further to the previous cash account?
Mr Beer: Yes.
Anne Chambers: Mm. Yes. No, I was just – from this data, no, I cannot explain that. One thing is that you could make stamps and cash declarations with different declaration IDs and then they got added together, so the 0 wouldn’t necessarily wipe out the 1,183.22 but I don’t know why what is on that cash account –
Mr Beer: Is £5,335.11 for stamps?
Anne Chambers: Unless there was another declaration using a different ID again, since the previous cash account. But I can’t –
Mr Beer: It’s not shown on here, is it?
Anne Chambers: It’s not showing on there, no.
Mr Beer: So the value of stamps had somehow reduced, either to zero or £1,183.02 –
Anne Chambers: Yes, I can’t explain that, looking at this.
Mr Beer: – on these ARQ data, and that has not been translated into the cash account for week 41, has it?
Anne Chambers: That appears to be something that, at the moment, I cannot explain, and could be an error.
Mr Beer: That would have disrupted the figures for week 42, as well, wouldn’t it?
Anne Chambers: What was – that might have given them a loss in week 41, but it shouldn’t have then had any – I wouldn’t have thought it should have had any knock-on effect but without looking at the data and exactly what happened, I cannot tell. Did they have a loss in –
Mr Beer: Yes, this is the first week. The first week, week 41, that Mr Castleton phones in and says, “I’ve suffered a loss, an unexplained loss”.
Anne Chambers: Yes, I was unaware of this.
Mr Beer: Did you look at these data?
Anne Chambers: I thought that in the run-up to the 2006 trial I looked in great detail at all the data from January and February but I don’t recall seeing this particular issue, whether I looked at it and could explain it, I now don’t know. As I’m saying, obviously, there’s something slightly odd about this particular dataset, in that it’s – it is an extract, and it does seem to be a slightly odd order.
Mr Beer: Just go back to the previous page, please. Sorry, the top of this page. Thank you. Is this – are these data produced by Fujitsu? Can you tell from the character strings set up?
Anne Chambers: Yes, this is data that originally was produced by Fujitsu, and you can see that you’ve got the sort order there, so it should be – attribute, date and time is what it should be sorted on. Now, just looking at it, you can see it is no longer sorted on date and time. So I’m wondering – and, also, as I said, it’s not a complete set of event data in that there would have been many other things – you’ve not got anybody logging on and off, for example, in that.
So this is – what was provided by Fujitsu would have been a much bigger Excel spreadsheet, and this is a subset, not a –
Mr Beer: Sorry, somebody coughed there, I couldn’t hear that. This was?
Anne Chambers: This appears to be a subset of that data and that subsetting would have been done by somebody other than Fujitsu. And it’s also been sorted into an order which is not the order that it would have been provided by Fujitsu.
Mr Beer: Do you recognise the format of the presentation of these data?
Anne Chambers: Oh, yes, it’s in the format that you would expect, and those lines at the top are what you would expect to see at the top of the ARQ event data. But the content is not – I mean, we’ve got the full set of events for this period somewhere in the evidence set and we could go and look at that and see what was actually presented by Fujitsu.
Mr Beer: That might be homework overnight.
Anne Chambers: I think it might be.
Mr Beer: But, on the face of it at the moment, these data don’t – do not make sense to you, in that the value of stamps has been reduced dramatically on the ARQ data but not in the cash account for week 41?
Anne Chambers: Yes.
Mr Beer: Can we look, please, at POL00112440 and look at page 52, please. This is the first page of a PEAK in relation to an entirely separate branch.
Anne Chambers: Yes.
Mr Beer: You can see the FAD code there under the summary.
Anne Chambers: Yes.
Mr Beer: It’s not Mr Castleton’s branch.
Anne Chambers: Yeah.
Mr Beer: So the summary is “Discrepancy with [cash account] for the last few weeks”. Can we read, please, the first few entries under the narrative:
“Call details have been taken from Andrew Wise at NBSC on telephone number stated above. [Postmaster] has a discrepancy with his cash account for the last few weeks.”
So this is 13 January, so it’s four days before Mr – four or five days – no, it’s the day before Mr Castleton makes his first report, yes?
Anne Chambers: Yeah, yes.
Mr Beer: That was on 14 January?
Anne Chambers: Yes.
Mr Beer: “Postmaster has a discrepancy with his cash account for the last few weeks.”
Anne Chambers: Yeah.
Mr Beer: “The NBSC have advised that the [postmaster] can only declare the holding amount or 0 not a negative figure.”
Then reading on:
“The NBSC have been through the checks with the [postmaster] and feel there is a software error as the [postmaster] has negative figures which he would not have been able to enter.”
Anne Chambers: Yes.
Mr Beer: “In week 37 the [postmaster] was showing a surplus of £19.66 on the front page of the cash account.
“In table 5 cash and stock he is showing a surplus cash figure of £42,860.61 and a surplus cheque figure of £116,248.50.”
Anne Chambers: Yes.
Mr Beer: “The cash on hand was declared at £159,109.11. In week 38 the [postmaster] had a surplus of £49.22 on the front page of the cash account.”
Yes?
Anne Chambers: Yes.
Mr Beer: Then, if we carry on reading, please. Just scroll down. If you read to yourself, so I don’t have to read the figures out, what’s recorded in the second box from the bottom there?
Anne Chambers: Mm-hm.
Mr Beer: Then over the page, please. Read the top box, please.
Anne Chambers: Yes.
Mr Beer: Then scroll down, please. We see at 16.01 on 13 January, this call is assigned to you?
Anne Chambers: Yes.
Mr Beer: What did “ESC” mean?
Anne Chambers: Sorry?
Mr Beer: It says, “Assigning call to Anne Chambers in ESC”; is that the SSC?
Anne Chambers: SSC or EDSC, which we were sometimes known as. I don’t know why –
Mr Beer: Okay. It’s not a different capacity you were being assigned this call in?
Anne Chambers: No.
Mr Beer: You speak to the postmaster the next day. Can we see that entry at the bottom?
Anne Chambers: Yes.
Mr Beer: “Spoke to [postmaster] to get some more info. Before he balances he rems out his cheques, although sometimes one or two more cheques are taken before he balances the stock unit. He declares cash then declares stamps then finally declares stock. On the first declare stock line he declares any rest home cheques he is holding.”
Can you help us with what “rest home cheques” mean.
Anne Chambers: I had no idea when I picked up this call but it was some sort of a cheque that he received that I think then pensions for everybody in the rest home got –
Mr Beer: So like a care home?
Anne Chambers: Yeah.
Mr Beer: Okay, that’s not a technical description, it’s a reference to something like a care home?
Anne Chambers: That was how the postmaster described it to me.
Mr Beer: “This results in a discrepancy between the system check figure and the declared figure.”
Anne Chambers: Yeah.
Mr Beer: “Something has changed in the counter code recently which causes the discrepancy to be recorded wrongly. So the cheque discrepancy instead of being cleared is doubled and the cash is wrongly adjusted.”
Anne Chambers: Yeah.
Mr Beer: “However, I think the [postmaster] should not be declaring his rest home cheques in this way, even if he’s always done so. Need to get advice on this or preferably get NBSC to explain what the proper procedure is.”
Anne Chambers: Yeah.
Mr Beer: Was this a postmaster declaring these care home cheques in a slightly unusual way but he’d been doing it for years, yes?
Anne Chambers: Yes, he was doing something odd and – but it had never shown up as a problem on the system but, because something had changed and suddenly he started getting these very big numbers in both cash and cheques showing in table 5 of the cash account.
Mr Beer: Something had changed in January to start –
Anne Chambers: Yeah.
Mr Beer: – causing these problems –
Anne Chambers: Yeah.
Mr Beer: – with, essentially doubling up, hadn’t it?
Anne Chambers: It wasn’t quite doubling up but it was the way that, if you rolled over with having declared that you held a cheque, when it was treated with the wrong sign, and then impacted the cash as well.
Mr Beer: We see later in the PEAK – I’m not going to go to the detail, that the problem had been caused by a Horizon fix that had been released in November 2003; do you remember?
Anne Chambers: Yeah.
Mr Beer: What was the Horizon fix that had been released in 2003, November?
Anne Chambers: I cannot remember – no, I’m sorry, I can’t remember.
Mr Beer: Okay, but it was the release of this fix by Fujitsu that had caused what had previously not been a problem to become a problem for this postmaster –
Anne Chambers: Yes.
Mr Beer: – and to cause discrepancies?
Anne Chambers: Yes.
Mr Beer: So it was the release of new software, the fix, that was causing the problem?
Anne Chambers: Yes.
Mr Beer: Do you remember that this PEAK was signed off, saying that the problem was the subpostmaster not using the correct or standard procedure?
Anne Chambers: I don’t recall that that was my conclusion on the PEAK.
Mr Beer: Can we scroll down then, please. I think we can see a continuation of your entry at the top of the page there, yes?
Anne Chambers: Yes.
Mr Beer: On 15 January?
Anne Chambers: Yes.
Mr Beer: Then, if we carry on scrolling down, please.
Anne Chambers: “At that point I spoke to the PM and explained it was a software problem.”
Mr Beer: Yes. Later on the 15th, you email Julie Welsh, who will pass it on to the Post Office, and you asked the EPOSS Development to have a look at it?
Anne Chambers: Yeah.
Mr Beer: Why were you asking the Development team responsible for EPOSS to have a look at this?
Anne Chambers: Because EPOSS were – that was the counter software and it was a bug in their software.
Mr Beer: So it was a – can I describe it this way, a software bug in EPOSS –
Anne Chambers: Yeah.
Mr Beer: – that was the root cause?
Anne Chambers: Yeah.
Mr Beer: You describe it as a nasty problem?
Anne Chambers: Yes, it was nasty in that every week things got worse and worse and worse for a branch that was encountering this problem.
Mr Beer: Then scroll down, please. Some more process entries on the rest of that page. Then, at the foot of the page, “Fix for 97081 was to blame”. That’s the November ‘03 fix, yes?
Anne Chambers: Sorry, that was the?
Mr Beer: That was the November 2003 fix –
Anne Chambers: Yes.
Mr Beer: – that was to blame?
Anne Chambers: Yeah.
Mr Beer: “Initialisation of the session, effect variable, with [and then some code] was not initialised. Alas, this will affect products such as cheque.”
Yes?
Anne Chambers: Yes.
Mr Beer: Then scroll down, please. Some more process entries, yes?
Anne Chambers: Yes.
Mr Beer: Forward to the 19th, scroll down, please. You speak to the postmaster on the 19th. Is that you?
Anne Chambers: No.
Mr Beer: That’s somebody else, is it?
Anne Chambers: The call has been closed for some reason and then reopened and so everything that was on it before appears again.
Mr Beer: Okay. Oh, I see, yes. If we scroll down, please, and again, and again, and again, and again, and again. Just stop there.
Do you see at the top of the page an entry is made:
“Phil needed this information for a disciplinary with the [postmaster] tomorrow. Advised Phil that this is basically user error and 3rd line had advised the [postmaster] of correct procedures.”
Anne Chambers: Yes, that’s not an update that I put on there you can see, that’s something that’s been sent across from PowerHelp. You can see HSH – HSH1 is a PowerHelp user. So somebody on the Helpdesk has looked at what I’d put previously and has interpreted it, saying it was basically user error, which was not my conclusion.
Mr Beer: It wasn’t correct, in your view, was it?
Anne Chambers: No, it’s not correct, no.
Mr Beer: It was a bug?
Anne Chambers: Yes, it was a bug.
Mr Beer: You hadn’t advised third line of the correct procedure?
Anne Chambers: I was third line.
Mr Beer: Yes. Sorry, you, third line, had not advised the postmaster of the correct procedure?
Anne Chambers: I had spoken to the postmaster and I believed to an auditor who was in the branch when I phoned, and explained that I thought this was something odd that they were doing but I had also said that it was a software error.
Mr Beer: The further fix to deal with the bug that had been introduced by the November 2003 fix was to be part of the S60 release – do you remember that –
Anne Chambers: Yes.
Mr Beer: – which didn’t proceed until July 2004; do you remember that?
Anne Chambers: I can’t remember the dates.
Mr Beer: Okay I’ll give a cross-reference for that. There’s no need to search for it, it’s FUJ00155590 at page 4, with S60 being authorised to proceed in July 2004.
Anne Chambers: Okay.
Mr Beer: When you came to Mr Castleton’s case, do you think that there was any coincidence of timing or issues here, given that Mr Castleton complained of difficulties with cheques?
Anne Chambers: I looked at Mr Castleton’s cheque handling and he certainly was not declaring cheques in the same way that this branch had been doing. He didn’t use declare stock, he used adjust stock, and it was very obvious for this particular instance, which was the only one I ever saw with this particular problem, because on your balance account, the balance report or, indeed, in the cash account, it gave extremely large numbers increasing week-by-week for both cash and cheques in the method of payment section on the balance reports and in table 5 on the cash account report. And they were not present for Mr Castleton’s branch.
Mr Beer: Did you speak with the – anyone at Marine Drive to discuss their cheques practices?
Anne Chambers: No, I didn’t, because I – they’d already talked to the NBSC and to the Helpdesk about that, and the only problem with – that I could see with their cheques was the one day where they hadn’t cut off the report, which wasn’t an uncommon problem. It was – there were so many things they had to do, it’s not surprising that branches very occasionally failed to do one of the things that they were supposed to.
Mr Beer: What would you have thought if you had spoken to the branch and they told you that cheques often seemed to clear to cash?
Anne Chambers: I’d have gotten them to give me some examples. So you’re saying that when they received a cheque in payment then it showed up on the system as cash instead?
Mr Beer: Yes, and that they got to the stage where this had happened more than once and that Mr Castleton and the clerk would watch the other do it, so that they had two pairs of eyes watching what was happening when they had a cheque transaction to complete?
Anne Chambers: So they were certain that they were pressing the cheque button –
Mr Beer: Correct.
Anne Chambers: – that it was actually being treated as cash?
Mr Beer: Yes.
Anne Chambers: I would have advised them to get the screen calibration checked.
Mr Beer: Why would the screen calibration have raised its head with you?
Anne Chambers: Because if the buttons on the screen – if they were using the buttons on the screen – were – if the calibration was slightly out, you could press one button and it would have a slightly different effect. It shouldn’t have been that far out and that, in fact, could have given all sorts of problems. But that was part of the standard Helpdesk stuff, I think, so that if – you know, if they said, “But we’re pressing this button and something else happens”, then you recalibrate the screen.
Mr Beer: You wouldn’t have been able to tell any of that from just looking at the Horizon data?
Anne Chambers: No, to me, if it’s settled to cash, I would assume that they had either pressed the fast cash button or that – the cash button, I believe they were two different ones.
Mr Beer: Was that a problem sometimes, calibration of the screen, so that where you pressed a tile on the – I’m calling it a tile, that might not be the correct expression –
Anne Chambers: Yeah.
Mr Beer: – you know what I mean, an icon –
Anne Chambers: Yeah.
Mr Beer: – on the screen, because of a miscalibration the function performed was not what was intended?
Anne Chambers: That could be a problem but it would be pretty consistent, so for everything you did it would be out and I would have thought, although I never worked in a branch, that it would be fairly obvious fairly quickly to the user if that were happening.
Mr Beer: But cheques clearing to cash may have fed into what you saw when you examined the data, that there were large discrepancies between daily cash declarations and what the system expected the cash to be?
Anne Chambers: No, because at the end of each day when they had to go through their physical checks, they’d print off the cheque report, which would show the cheques that had been recorded for payments on the system. They then had to compare that with the physical cheques that they were holding and if there were any differences. So if they had a cheque and it went on the list of cheques, they could do an adjustment which would adjust between cash and cheques. So there would be no loss or gain as a result of doing that.
Mr Beer: What if they did that at the end of the day, where they could see that the cheque transactions hadn’t cleared to cheques, they’d cleared to cash, what would happen to the earlier misapplication of the cheque funds?
Anne Chambers: Nothing would happen to that, so you’d have your earlier transaction, which would be, say, a bill payment settled to cash, so you’d have – those lines would remain unchanged because once they’re written, they stay there. And then further down at some point, you would see – I mean, there were various ways that the postmaster could do it but one way would be doings a stock adjustment.
So you’d see a line then with “mode SAP”, stock adjust positive, so your cheque going up by whatever the amount was and the cash then would come down by the same amount.
Mr Beer: Thank you very much.
Anne Chambers: There are examples of that in a very large spreadsheet, which is available to everybody.
Mr Beer: Thank you.
Sir, I don’t know whether that’s a convenient moment for you. We’ve just reached before 4.00 pm and it’s a convenient moment in the narrative.
Sir Wyn Williams: Yes, of course. Thank you, Mr Beer. So we’ll resume again at 10.00 tomorrow.
Mrs Chambers, I got the impression that you’d intended to do some homework, as it was described, in respect of one line of questioning this evening. Would you need to speak to anyone about that or is that you just looking at the documents, so to speak?
Anne Chambers: That’s me attempting to look at documents on my iPad, which may not be very easy.
Sir Wyn Williams: Okay. I only ask because you will appreciate that, unless I give you permission to do so, you shouldn’t speak to anyone about your evidence.
Anne Chambers: I won’t speak to anyone.
Sir Wyn Williams: I take it you don’t need my permission, if you decide to do some homework.
Anne Chambers: Thank you.
Mr Beer: Thank you, sir. We’ve set it for ourselves, too – or I’ve set it for Mr Blake!
Sir Wyn Williams: So there will be competing homeworks this evening. Very good.
Mr Beer: Yes, thank you very much.
Sir Wyn Williams: See you in the morning to hear the result of it.
(4.00 pm)
(The hearing adjourned until 10.00 am the following day)