18 January 2024 – Gerald Barnes, Peter Sewell and Donna Munro
Hide video Show video
(10.00 am)
Gerald Barnes
GERALD JAMES BARNES (continued).
Questioned by Ms Price (continued)
Ms Price: Good morning, sir, can you see and hear us?
Sir Wyn Williams: Yes, thank you very much.
Ms Price: Please may we continue with Mr Barnes’ evidence?
Sir Wyn Williams: Yes.
Ms Price: Good morning, Mr Barnes. Thank you again for making arrangements to attend this morning to complete your evidence.
The last topic I would like to deal with is the issue addressed in your second statement, the Apex Corner incident. This is an issue which was first brought to your attention by Fujitsu’s Legal Team on 14 November 2023; is that right?
Gerald Barnes: I thought it was December but you might be right. November/December, yes, yes. I can’t remember the exact date. Yes, that sort of time, yes.
Ms Price: In your statement at paragraph 9 you say:
“On 14 November 2023 …”
Gerald Barnes: Okay, right.
Ms Price: “… I was informed by members of Fujitsu’s legal team that a series of ARQ spreadsheets were provided by Fujitsu to POL in response to an ARQ request.”
Then some information that was provided to you at that time.
Gerald Barnes: Right okay.
Ms Price: Is that accurate?
Gerald Barnes: Well, if it’s written down it must be right. I can’t remember the specific date. It’s that sort of time, certainly.
Ms Price: If it assists you to have your statement in front of you, the bundle should have that second statement at tab A2.
Gerald Barnes: Right, okay, thank you.
Ms Price: You say at paragraph 9 that you were told that the issue related to a series of ARQ spreadsheets provided by Fujitsu to the Post Office, in response to an ARQ request from the Post Office, dated 11 August 2023, relating to the Apex Corner branch. The context for the ARQ request was an ongoing appeal by the former subpostmaster of Apex Corner, which was before the Court of Appeal; is that right?
Gerald Barnes: That’s right, yes.
Ms Price: In the request, the Post Office had requested transaction data relating to Apex Corner for a number of months, which included the months of March and April 2008; is that right?
Gerald Barnes: That’s right, yes.
Ms Price: In response, Fujitsu provided the Post Office with a number of ARQ spreadsheets, including a spreadsheet for March 2008 and, separately, a spreadsheet for April 2008; is that right?
Gerald Barnes: That’s right, yes.
Ms Price: As a result of comparing the spreadsheets for March and April 2008 with a Giro cheque report, dated 10 April 2008, produced by the postmaster for the appeal, it was discovered, wasn’t it, that there were 13 transactions which appeared in the Giro cheque report but did not appear in any of the ARQ spreadsheets produced by Fujitsu; is that a fair summary?
Gerald Barnes: That’s correct, yes, that’s correct.
Ms Price: By way of explanation, you say in your statement you were told that information from relevant PEAKs, a Known Error Log and Operational Correction Requests, showed a number of things. First, the 13 missing transactions, which had taken place in March 2008, had been marooned on the counter at Apex Corner together with a large number of other transactions in 2008, yes?
Gerald Barnes: That’s correct, yes.
Ms Price: Second, this had been discovered in April 2008 by the Software Support Centre and they had manually reinserted these marooned transactions into the Legacy Horizon correspondence servers, yes?
Gerald Barnes: That’s correct, yes.
Ms Price: Third, these marooned transactions were reinserted into the correspondence using a virtual counter ID and the use of that virtual counter ID was the reason that the SSC transaction reinsertions had been identified?
Gerald Barnes: That’s right, yes.
Ms Price: You have been investigating the Apex Corner incident; is that right?
Gerald Barnes: That’s correct, yes, yes.
Ms Price: Starting please with the first of the pieces of information you were provided with in November 2023, the fact that the transactions were marooned on the counter at Apex Corner in March 2008, can you explain, please, what you mean by this: being marooned on the counter?
Gerald Barnes: Well, it’s – this is really not my technical area but, basically, there was some technical problem and the messages weren’t copied to the correspondence servers at that time, so that they didn’t appear in the audit – the normal audit data. But it’s not really my area, that – my technical area, that.
Ms Price: To the extent that you can help, how would marooned transactions have appeared to a subpostmaster using the system in branch?
Gerald Barnes: I would have thought – well, I can’t be certain but I’d have thought they’d have looked okay, it was only sort of behind the scenes that you’d have had a problem. But I can’t be certain to that question – the answer to that question.
Ms Price: Coming on to the discovery of the marooned transactions, is it your understanding that these were discovered by the Software Support Centre, following a call from the subpostmaster reporting problems, or can’t you say?
Gerald Barnes: I think that’s – yeah, I can’t be certain but it sounds right, sounds right. As I say, it’s not really – that side of things isn’t my technical area but sounds right, and from what I’ve heard since.
Ms Price: Can you help with how the SSC discovered the marooned transactions when they investigated the matter?
Gerald Barnes: Can’t be certain on that point, no. No, no, I can’t really comment on that point.
Ms Price: Can you help with whether the marooned transactions would have come to light at all, had the subpostmaster not called the Software Support Centre?
Gerald Barnes: I can’t comment for sure. Sounds like probably not but, again, not my technical area of expertise, that.
Ms Price: Your understanding of what they did in April 2008, that is the Software Support Centre, was to remotely access the counter in branch using a virtual ID and reinsert the transactions which had become marooned; is that right?
Gerald Barnes: That’s right, now that bit I do understand. That’s correct. That’s what they did, yes, yes. Now, I’m understanding again, yes.
Ms Price: Setting aside the technical explanation for Fujitsu’s production of incomplete ARQ data, in simple terms, is it right that it was the remote reinsertion of transactions a month after they were actually done that caused a problem?
Gerald Barnes: That’s right exactly. The key thing here is it was a month afterwards. If they’d done it very quickly, there wouldn’t have been a problem with the audit system but because it was a month afterwards, there was.
Ms Price: Is it right that the SSC’s actions in this regard was only ascertained because of the presence of the virtual counter ID?
Gerald Barnes: Well, that – that was certainly an indicator, though the virtual – though you see – you can have counter – offices with 20 counters, so you’d need a bit more knowledge than that but it was an unusually high counter – they add ten to the normal counter number, I believe, as I understand it.
Ms Price: You say at paragraph 9.3 of your statement:
“These marooned transactions were reinserted into the correspondence using a virtual counter ID (ie a counter that did not exist at the branch which was used to identify that they had been reinserted by the SSC).”
Gerald Barnes: Ah, yes, that’s right. They didn’t exist at that branch but I’m saying, in general, with multi-counter offices, you could have had such a high counter number but at that branch there wouldn’t have been. Yes, that’s correct, yes.
Ms Price: Is it right that, had the subpostmaster in this case not had a Giro cheque report showing the 13 missing transactions, the inaccuracy of the ARQ data produced to the appeal court would not have come to light?
Gerald Barnes: I think that’s highly likely. I mean, it was a completely new issue to me, I’d never come across this before. So it was a completely new issue to me. So I would say what you say is correct, yes.
Ms Price: Before we come to your investigation of why the reinserted transactions were not retrieved by the ARQ process applied in 2023, I would like to ask you, please, about a discrete aspect of the Horizon Online ARQ process. There is a suggestion at paragraph 17 of your statement, that second statement in front of you, that, once an ARQ spreadsheet had been produced using audit work stations, Fujitsu’s Security Team would do an extra step.
Can we have that paragraph on screen, please. It’s page 10 of WITN09870200. You say:
“My understanding is that the Security Team would identify gaps and duplicates in messages through automatic checks, and occasionally identify that whole days of messages were missing at the end of an ARQ spreadsheet following a manual review of the spreadsheet. This would sometimes be drawn to my attention by the Security Team, who would ask me to investigate the gaps and find the missing messages by extending the retrieval range of the ARQ while keeping the filter range the same.”
Are you saying here that ARQ spreadsheets produced by the ARQ process were and are checked for completeness before they’re signed off? Is that what you’re saying here.
Gerald Barnes: Well, there’s two aspects for this. First of all, automatically, gaps in the message run and duplicates in the message run are performed by the software and, when the spreadsheet is produced, there’s a summary table which states whether there are any gaps or duplicates. However – so that identifies most of the problems but, obviously with gaps, if you get top the end of the range, well, you can’t really be certain because there’s nothing beyond it, as it were. So it’s really up to the operator, if he sees a whole day missing at the end of the range, then he knows something is wrong.
So that – so that would be drawn to my attention sometimes and the answer then, almost always, was to add a few extra days to the retrieval range because the relevant transactions were gathered slightly late so that was almost always the answer.
So it’s automatic checking of the gaps, plus, because the automatic gap checking can’t check at the very end of the range, manually checking to make sure there are not whole days missing at the very end, if that makes sense.
Ms Price: So if the Security Team considered messages were missing, they’d contact you, is that what you’re saying?
Gerald Barnes: Yes, that’s – well, sometimes they might take their own initiative and add an – initiative and add a few extra days, I suppose, but sometimes they would contact me and I’d go down and have a look and, as I say, I would investigate and very often say “Ah, yes, these files were gathered late, you just need to add a few extra days to your retrieval range”.
Ms Price: Just to explain what you mean by that: is that rerunning the retrieval request with a wider date range?
Gerald Barnes: Exactly. Exactly, yes, exactly.
Ms Price: You’re not talking, then, about manually inserting transactions?
Gerald Barnes: No, no, no. This is simply the missing transactions were just gathered late so you just need to – always we had an extra three days, I think it is – or there’s a configurable number of days that you can add to the retrieval range, we just make it a bit long – a bit bigger and that can cater for most issues.
Ms Price: Coming, then, to your findings as to the technical cause of the incomplete ARQ data being produced by Fujitsu, taking it as simply as possible – and please correct me if, at any stage, I fall into error – is it right that under the old Legacy Horizon ARQ process, transactions sent from the counter to the audit archive were given a transaction date as well as a sealed date on which the file containing them was added to the audit archive?
Gerald Barnes: That’s right, yes.
Ms Price: But –
Gerald Barnes: It just disappeared from my screen.
Ms Price: That’s fine, you don’t need that document at this stage. If there’s anything you’d like to see, your second statement, which you have in front of you, may assist.
The 13 missing transactions, which had transaction dates in March 2008, were not sealed in files in the audit archive until April 2008 –
Gerald Barnes: (The witness nodded)
Ms Price: – because they were marooned and then reinserted by SSC a month after they were, in fact, conducted.
Gerald Barnes: (The witness nodded)
Ms Price: When the Apex Corner ARQ request was processed, the data was filtered to retrieve (i) transactions with a March 2008 transaction date, from the file sealed in March 2008 –
Gerald Barnes: (The witness nodded)
Ms Price: – and (ii), transactions with an April 2008 transaction date from the file sealed in April 2008.
Gerald Barnes: (The witness nodded).
Ms Price: What were not sought were transactions with a March 2008 transaction date from the file sealed in April 2008 and, therefore, the 13 missing transactions were not retrieved.
Gerald Barnes: Exactly. That was the problem, yes.
Ms Price: In the course of your investigation, you applied a revised query for March 2008 transactions from files sealed in April 2008; is that right?
Gerald Barnes: That’s right, yes.
Ms Price: Could we have on screen, please, paragraph 20 of Mr Barnes’s statement that’s page 11 of WITN09870200. You say this:
“Once this revised query was applied, the 13 missing transactions were retrieved and presented on an ARQ spreadsheet and the automatic checks noted at 16(c) identified gaps in the messages that had been reinserted by the SSC on the virtual counter. At this stage, I am not sure why there were gaps in relation to these messages and the investigation is ongoing in this regard.”
Can you explain what you mean by “gaps in the messages”, which had been reinserted –
Gerald Barnes: Right, well, after all the files are retrieved, each message has a number and they’re all sequential. So always the software automatically checks that there are no gaps, so that you can be sure that nothing’s been missed out. But for these special inserted transactions, there were gaps.
Now, normally gaps is practically unheard of, it just doesn’t happen. We check for it all the time and it never happens, but they were happening for these inserted transactions by the SSC. Not too sure why that was. But I suppose because they were done in a slightly unusual way because of the manual insertion.
So normally gaps is unheard of, really. It just doesn’t – well, we always check for it but it is very, very rarely reported and always a thorough investigation occurs when there are gaps found.
Ms Price: Does this mean, on the face of it, that the SSC did not reinsert the transactions accurately?
Gerald Barnes: Well, I don’t know the answer, really. It just don’t know, I don’t know quite the answer there. So I can’t be certain on that point.
Ms Price: You say that “the investigation is ongoing in this regard”. It may follow from your last answer but do you have any update in relation to either your investigation or that of others?
Gerald Barnes: No, we’re looking at another aspect, actually, at the moment, we’re concentrating on that but, yes, I could get back – I could have another look at that point but I haven’t found anything myself further. I was hoping someone else might have commented on it.
Ms Price: Turning then to the extent and impact of the ARQ extraction issue, you deal with this over the page at paragraph 21. Could we go to that paragraph, please. You say this:
“Based on the investigation so far, in general terms, my understanding is that the ARQ extraction issue can occur in the following circumstances:
“a. There is delay between (i) the date that a transaction was carried out at a branch, and (ii) the date that the TMS file containing the transaction was sealed in the audit archive;
“b. The delay is caused by error or fault (eg counter hardware failures, a fault with the sealer, never connectivity problems), which leads to transaction messages that took place in month ‘A’ being stored in the out archive in TMS files that are sealed in month ‘B’ (eg in the Apex Corner incident, the SSC reinserted the 13 missing transactions (and others) using a virtual counter ID);
“c. An ARQ request is received requesting data for the branch including in relation to month ‘A’;
“d. The current Horizon Online ARQ process is followed to respond to the ARQ request, and the sealed TMS files relating to the branch for month ‘B’ are not searched for transactions that took place in month ‘A’; and
“e. The automatic checks, noted at paragraph 16(c) above, failed to identify any gaps in the transaction messages that would indicate the transaction is missing.”
You then say this at 22:
“The Apex Corner incident has shown that the current Horizon Online ARQ process has a flaw because transactions in Legacy Horizon for one month can be stored in the audit archive in the following month, such that the additional days allowed in the retrieval range are not enough to capture all the relevant TMS files that were sealed late. As a result, Fujitsu is modifying the process to allow three months in the retrieval range (ie the date range applied to retrieve TMS files). Hence it will retrieve other to 2 months of lately sealed or inserted messages.”
You say at paragraph 23 that you are working with other technical and operational staff in the POA to understand the extent and impact of the ARQ extraction issue, including in relation to Legacy Horizon and Horizon Online.
First of all, what steps had been taken to investigate this?
Gerald Barnes: Well, what we’re doing at the moment, we’re concentrating on the Legacy Horizon, but what we’re going to do is – a colleague of mine is writing some software to do this – is we’re going to extract every month of the cluster files and search them for any cases where there’s a transaction in them, which is in the following month, or any higher month, that is, and produce a report, and that’s – so we’ll see how common it is. So that’s what we’re doing right at the moment. That’s what we’re concentrating on.
Ms Price: Do you have any update or findings which you’re able to tell us about today?
Gerald Barnes: My colleague, I read an email from him saying he’s got some test results to be looked at but, unfortunately, like yesterday, I was concentrating on my statements but I shall be looking at that this afternoon, when I get back.
Ms Price: Sir, those are all the questions I have for Mr Barnes. I think there are some questions from Core Participants but before I turn to them, do you have any questions?
Sir Wyn Williams: Well, what I’d just like to know, just so there is no possibility of crossed wires, this last topic that you’ve been covering arose in the context of an appeal to the Court of Appeal, as I understand it. Does either Mr Barnes or does the Inquiry know whether that appeal has been determined?
Gerald Barnes: I know it was because of an appeal. I don’t know the answer to that. Our Fujitsu Legal Team would probably know but –
Sir Wyn Williams: You don’t know.
Gerald Barnes: Not personally.
Sir Wyn Williams: Do we know, Ms Price?
Ms Price: Sir, I’m told that it hasn’t by those who represent the Post Office.
Sir Wyn Williams: Right. Well, then I think, if there is an ongoing appeal, we all need to tread a little carefully, so I need to give some thought to how much further the Inquiry should delve into this, prior to a determination by the Court of Appeal.
That’s a rather longer winded way of saying, Mr Barnes, that the Inquiry will contact you rather than you contact the Inquiry, if we need any further information about this aspect of your evidence, just so I can be careful not to interfere in any way in the processes of an ongoing appeal.
Ms Price: Thank you, sir. Shall I turn to Core Participants?
Sir Wyn Williams: Yes, please.
Ms Price: Ms Page has some questions, sir.
Sir Wyn Williams: Yes.
Questioned by Ms Page
Ms Page: Mr Barnes, my name is Flora Page and I act for a group of subpostmasters.
Could we have please a document up, it’s FUJ00189289. I hope this document is one you’ve had a chance to look at. It’s only very recently been given to you. Have you had a chance to see this, Mr Barnes?
Gerald Barnes: Possibly. I think I might need to …
Ms Page: Perhaps we could zoom in a little bit on the lower half of the page, from the heading that says, “EOD and migration”.
Gerald Barnes: Yes, I read a lot of extra material. I don’t quite remember this one but, anyway, you’re welcome to ask me a question about it. I’ll do my best to answer.
Ms Page: Well, the first question which will tell me whether we need to ask any more, really, is whether MigrationPrep is the migration software that you said that you were primarily involved with?
Gerald Barnes: Oh, I think – yes, I think that was a different bit of software. That was – yes, ooh, it’s a long time ago. There was some counter software where you press a button to do of the migration, which I definitely remember writing. I think, yes, I think I did write the MigrationPrep too, but I might have got that wrong. Yes, it was an end-of-day process, yes, right? I think so, but …
Ms Page: The reason I ask is because what we see described here is MigrationPrep failing in the way that perhaps you say software should fail, in other words it’s very apparent when it encounters a problem, it just sort of falls over, I think. We see that the reason it has fallen over, when this sort of problem is described, is because SSC messages which were inserted remotely seem to have interfered in some way and caused MigrationPrep to fail. Does that make sense?
Gerald Barnes: Makes sense, yes. Makes sense.
Ms Page: So that might be an example of what you describe as sort of good error handling; is that right?
Gerald Barnes: Well, that’s the idea. If something is wrong, it’s far better just to stop than sort of keep going and report the error, then hopefully it can be fixed and then you can produce correct results. Yes, that’s the idea, yes, certainly.
Ms Page: What we seem to have here, when we go down a little bit, is, just stopping at the paragraph that starts “Hmmm”:
“Hmmm. In the last year or so, SSC have developed a tool (which did go through LST testing) which will insert EOD messages for a branch. This is normally used when a branch has closed down and the kit removed before EOD …”
That’s end of day, yes?
Gerald Barnes: Yes, that’s right, yes.
Ms Page: “… on the last day of trading – so there are messages on the [correspondence] server which will never be harvested unless we take the necessary action. The tool writes the necessary messages on the [correspondence] server – hence there may be [ends of days] on nodes other than 1.”
It then says:
“We have also used the same tool very occasionally on branches which aren’t closed but where, for example, one counter has been down for over a week resulting in none of the transactions for the branch being harvested, and there are continuing problems trying to replace the box”, and they give a number.
Then they also talk about, in the final sentence:
“Or … where kit was removed for a 2 week refurbishment without writing a [full end of day].”
So it looks like what’s happened is that those messages which are inserted following hardware failures or following a branch closing have caused MigrationPrep or the migration process to fail.
Gerald Barnes: Right okay, yes.
Ms Page: Is there really any way of knowing how often these inserted messages caused other processes to fail silently?
Gerald Barnes: Not really, I suppose. No, I suppose not. I suppose not, is the answer. Not for certain.
Ms Page: Thank you, Mr Barnes. Those are my questions for you.
Sir Wyn Williams: Is that it?
Ms Price: Sir, those are the Core Participant questions, yes.
Sir Wyn Williams: Thank you for returning today, Mr Barnes, and for answering further questions. As I’ve said, I don’t expect you to provide any more information to the Inquiry unless we specifically ask you to do so, all right?
The Witness: Okay, thank you.
Sir Wyn Williams: Right.
Where do we go now, Ms Price?
Ms Price: Sir, if we can take a five-minute break to enable the next witness to come into the hearing room, we have Mr Sewell next.
Sir Wyn Williams: Fine. So I will remain where I am, so to speak, but just turn off my video for a few minutes.
Ms Price: Yes, sir, just after 10.35. Thank you.
(10.32 am)
(A short break)
(10.38 am)
Mr Blake: Good morning, sir.
Sir Wyn Williams: Good morning, Mr Blake.
Mr Blake: The next witness is Mr Sewell.
Sir Wyn Williams: Yes.
Peter Sewell
PETER JAMES SEWELL (sworn).
Questioned by Mr Blake
Mr Blake: Thank you very much. Can you give your full name, please?
Peter Sewell: Peter James Sewell.
Mr Blake: Mr Sewell, you should have in front of you a witness statement. I think it’s either at the front of that file or behind the first tab.
Peter Sewell: Yes.
Mr Blake: It has a unique reference number of WITN09710100. Is that dated 8 September 2023?
Peter Sewell: Yes, sir.
Mr Blake: Could I ask you to have a look at the final page or the final substantive page, that’s page 12. Is that your signature?
Peter Sewell: It is.
Mr Blake: Thank you. Can you confirm that that statement is true to the best of your knowledge and belief?
Peter Sewell: Yes, it is.
Mr Blake: Thank you very much. That statement will go into evidence and will be published on the Inquiry’s website in due course.
I’d like to start with a bit of your background. I think you joined what was then ICL in 1997; is that correct?
Peter Sewell: Yes, ‘97.
Mr Blake: We’ve heard quite a lot of evidence about the rollout of Horizon. Were you involved in the rollout of Horizon?
Peter Sewell: Only in the positions that I’ve stated in my –
Mr Blake: Typically, say in the year 2000, then: what kind of involvement would you have had with the Horizon system?
Peter Sewell: I was probably manager of a developed team, that area.
Mr Blake: So you were on the technical side?
Peter Sewell: No, I was the manager. Not the technical –
Mr Blake: So a managed a group of technical people?
Peter Sewell: I did, sir, yes.
Mr Blake: In 2002, you joined the POA Security Team, that’s the Post Office Account Security Team?
Peter Sewell: Yes.
Mr Blake: Then in 2007 you became Operations Team Manager in that team; is that right?
Peter Sewell: Yes, that’s right.
Mr Blake: Briefly, what did the Operations Team Manager role involve?
Peter Sewell: It really managed the team of three or four people in the Security Team, who carried out various security processes and functions.
Mr Blake: You say three or four. Are you able to assist us with their names?
Peter Sewell: Andy Dunks, Neneh Lowther, Bill Membery and Penny Thomas.
Mr Blake: We’re also going to hear from Ms Munro later today. Can you assist us with where you fit in with that line settlement?
Peter Sewell: I don’t. I left ICL/Fujitsu before Donna took over my role.
Mr Blake: So she took over your role?
Peter Sewell: I believe so.
Mr Blake: Thank you. We’re going to see the name Brian Pinder as well. Can you assist us with where he fit into things?
Peter Sewell: Brian Pinder was my manager – he was the Security Manager – one of the managers while I was in the Security Team.
Mr Blake: Thank you. The first document we’re going to look at is FUJ00122151. This is a document from 7 December 2005, so it pre-dates your time as Operations Team Manager.
Peter Sewell: Yes.
Mr Blake: This time, then, were you just a member of that team?
Peter Sewell: Yes, I was doing various tasks for the manager, and there were several managers.
Mr Blake: Were you a more senior member of the team?
Peter Sewell: I guess so, yes. More of a project manager.
Mr Blake: Thank you. It’s an email from Penny Thomas to yourself and others in the team. The subject is “Witness Statement Review”; attachments, “Penny’s standard template [December 2005]”; and she says:
“Please find attached a copy of my initial mark up of my witness statement, which I will send to Graham Ward this morning.”
Can you assist us with what involvement you had with the standard template that was being circulated?
Peter Sewell: Not a great deal. I didn’t involve myself with any of the witness statements at all.
Mr Blake: Why would she have been sending it to you?
Peter Sewell: I think just out of a standard way of letting someone see what she’s done and I was that person because I was a manager.
Mr Blake: So you were her manager at this time?
Peter Sewell: What date was it?
Mr Blake: This was 2005?
Peter Sewell: I don’t think I was, no.
Mr Blake: So we have your name, we have Brian Pinder’s name, we have Neneh Lowther’s name –
Peter Sewell: Yes.
Mr Blake: – so only three core recipients –
Peter Sewell: Yes.
Mr Blake: – and you’re saying it’s just for information?
Peter Sewell: Well, information, as far as I can see. That was pretty much the Security Team, yes.
Mr Blake: Can we please look at the statement that she was attaching, that’s FUJ00122152. This is a template, we’ve already seen this a couple of days ago. If we perhaps turn to page 4, this is a slightly different version to the one we saw with an earlier witness. It has the following form of words. About halfway down the page, it says as follows:
“I have access to reports that monitor faults, polling failures, equipment failures and calls for advice and guidance logged by the Horizon System Helpdesk. During the …”
Those question marks, did you understand those to be part of the pro forma you would will in?
Peter Sewell: I think that’s the dates that were inserted when somebody was filling in the witness statement.
Mr Blake: “… there were [then X number of calls] from …”
Then that’s the place to insert the branch details, is it?
Peter Sewell: Yes, it looks like it to me.
Mr Blake: “… to the Helpdesk. None of these calls relate to faults which would have had an effect on the integrity of the information held on the system.”
If we scroll down this statement, over to page 7, please. Page 7, there’s another standard form of words that we have looked at already this week, which is as follows:
“There is no reason to believe that the information in this statement is inaccurate because of the improper use of the computer. To the best of my knowledge and belief at all material times the computer was operating properly, or if not, any respect in which it was not operating properly, or was out of operation was not such as to effect [sic] the information held on it.”
Can we now go to FUJ00122153. This is an email from you to Penny Thomas in the middle email. It says:
“Penny
“What about the paragraph that starts ‘None of these faults relate to etc’ is this now acceptable to provide this response once we have examined fault logs.”
Her response was:
“I agree. I’ve scoured it out. I will now send to Graham Ward.”
Can you assist us with the question you’re asking her there?
Peter Sewell: I can’t remember. I don’t know. That was 2006 – 2005.
Mr Blake: Yes. Perhaps if we could put that middle email side by side with the document that I’ve just taken you to, that’s FUJ00122152, please. It’s page 4 of that document. Just to assist you with the words that are in that middle email, we’ll just show you the part of the statement that that appears to be referring to, that’s FUJ00122152, page 4.
Peter Sewell: Okay.
Mr Blake: Thank you. So if we see there on the right-hand side, it’s the second paragraph, the final sentence of that second paragraph:
“None of these calls relate to faults which would have had an effect on the integrity of the information held on the system.”
I appreciate it’s some time ago but there certainly seems to have been some discussion at this time about the use of that sentence.
Peter Sewell: I think – I don’t really remember it but I guess I picked that out and thought “Is that right to say that”?
Mr Blake: The question – I mean, are you able to interpret your own words there, what you may mean by “Is this now acceptable to provide this response”?
Peter Sewell: I think – I don’t I liked the way it was written and that was it.
Mr Blake: Can we please now look at FUJ00122154. Thank you.
If we turn to page 4, we can see – you’ll recall we just looked at Penny Thomas’ email where she says she’s removed it.
Peter Sewell: Right.
Mr Blake: If we turn to page 4, we can see that form of words has been removed from this pro forma. Can you see there it’s the second paragraph.
Peter Sewell: Yes.
Mr Blake: Can we now, please, look at FUJ00122189. This is an email of 22 March 2006, so you’re not yet Team Leader or Manager of the team. It’s an email you’re copied in to – thank you – and it’s from Brian Pinder to Andy Dunks, copied to you. The subject is “Gaerwen Witness Statement”, and it’s attaching another witness statement with the title “Lordship Lane [22 July 2005]”.
Peter Sewell: Right.
Mr Blake: It says:
“Andy
“This is the statement template which you need to use. Fill it in with details from the calls and amend the details highlighted in yellow.
“Please return to me tomorrow, when completed as I would like to see it before we send it off to Graham.
“Many thanks for your help with this and I will amend/note this on your appraisal going forwarded.
“Any help always ask me or Peter but meanwhile I will have a chat with Mik Peach on this too.
“Once again thanks.
“Brian.”
Just looking at the words there about the noting on the appraisal, was provision of a witness statement for use in proceedings seen as, in some way, doing a favour for the company or something that would result in positive feedback from superiors?
Peter Sewell: I don’t think so. I thought it was a standard support to the prosecution –
Mr Blake: Was it part of, for example, Andy Dunks’ contract or standard working practice, as far as you were aware.
Peter Sewell: No, I think it was delegation. I don’t think it was.
Mr Blake: Can you assist us at all with why it might have been seen that something like this would have been worthy of noting on an appraisal going forward?
Peter Sewell: No, it’s Brian that’s written that. I don’t know what he means. He’s obviously happy that Andy could help him out with it.
Mr Blake: Can we please look at FUJ00122190. This is the statement that was attached to that email, so it’s the Lordship Lane statement that was sent to Andy Dunks. If we look at that on the first page, we can see there’s reference to Lordship Lane in the second paragraph.
Peter Sewell: Right.
Mr Blake: Then that form of words that we saw originally taken out of Penny Thomas’ statement still appears in this statement that was circulated in 2006. So you can see there it says:
“I am of the opinion that none of these calls relate to faults which would have had an affect on the integrity of the information held on the system.”
There’s a slight change to the Penny Thomas version, the Penny Thomas version said, “None of these calls relate to faults”. Now, this version seems to read “I am of the opinion that none of these calls relate to faults”.
Is that a form of words that you recall at all?
Peter Sewell: No, not me. No. Somebody has obviously changed the wording to fit the thing and decided that’s the better way of doing it. Not for me, no.
Mr Blake: In fact, I think this statement, if we go by the date that is provided on the attachment, it says Lordship Lane, 22 July 2005. So this version may, in fact, pre-date the Penny Thomas version?
Peter Sewell: It might do, yeah.
Mr Blake: But is that something that would have caused you any concern at the time?
Peter Sewell: Not me. I wasn’t involved in witness statements, no.
Mr Blake: I mean, you were sufficiently involved to have sent that email querying the form of words earlier?
Peter Sewell: I obviously must have been, yeah.
Mr Blake: So, presumably, you did read these –
Peter Sewell: I obviously read that one, yeah.
Mr Blake: Can we now please look at FUJ00122197. We’re going to start at page 5, bottom of page 5 into page 6, please. This is a chain of emails. We’re going to see, in due course, you become copied in to the emails.
Peter Sewell: Right.
Mr Blake: It’s not clear at all from this email who the recipients were, it just seems to go to Fujitsu. Do you recall who Graham Ward was?
Peter Sewell: Graham Ward was a Case Manager for the Post Office.
Mr Blake: So he was at the Post Office –
Peter Sewell: Yes.
Mr Blake: – emailing a team within Fujitsu. Are you able to assist us with the name in the two –
Peter Sewell: He would email Penny Thomas.
Mr Blake: Penny Thomas.
Peter Sewell: Yes.
Mr Blake: I’m going to read from that email. He says as follows, he says:
“All …”
So perhaps it’s more than just Penny Thomas.
Peter Sewell: I think that’s a generalisation, yeah, but maybe Brian Pinder is there as well, yes.
Mr Blake: I think we’ll see Brian’s name. If we go to where it says “Brian”, it says:
“Brian – in the case of Marine Drive …”
That’s a case that we’ve heard in this Inquiry, that’s Mr Castleton’s branch.
Peter Sewell: Right.
Mr Blake: “… and Torquay Road for which you have previously provided written responses, I would like to ‘sound out’ the possibility of someone at Fujitsu providing a formal witness statement along the lines of the attachment below, which was provided by Bill Mitchell in one of our criminal cases …”
Who was Bill Mitchell?
Peter Sewell: Bill Mitchell was the predecessor manager to Brian Pinder, Security Manager.
Mr Blake: Thank you:
“… (whilst Marine Drive and Torquay Road are not criminal matters, given the allegations being made by the postmasters, I’m sure you’ll agree that it is very much in both ourselves and Fujitsu’s interests to challenge the allegations and provide evidence that the system is not to blame for the losses being reported). Whilst it may not be a statement that you, Penny or Neneh can provide, I’m shore there must be someone who can.”
Just pausing there, that concern that it’s “in both ourselves and Fujitsu’s interests” to show that the system is not to blame for losses, was that a concern that you were aware of at that time?
Peter Sewell: I was not aware of this, no.
Mr Blake: You weren’t aware that that was a concern?
Peter Sewell: Not – no, I didn’t realise that, no.
Mr Blake: Then the paragraph below:
“On a separate matter, I also require a witness statement in respect of the following ARQs [and he gives some ARQ numbers], all of which relate to Gaerwen [sub post office]. We need the usual … covering an analysis [and gives a period].”
He says:
“Penny – you may recall this one which relates to nil transactions, my previous emails dated 14, 21, and 25 October refer.”
If we scroll up to page 5, please – thank you very much, we can stop there – we now have an email from Mr Ward to that Fujitsu general address but now it’s copied to you.
Peter Sewell: Yes.
Mr Blake: It says:
“Brian/Penny/Neneh
“Can I enquire when the Gaerwen Statement will be ready please (bold paragraph below) … as it is required for the submission of prosecution committal papers which have to be in by the end of this week …”
Peter Sewell: Yeah.
Mr Blake: “Also have you made any progress in deciding whether a similar statement as to the one previously prepared by Bill Mitchell will be possible in the Torquay Road and Marine Drive cases … if we require one.”
Can you assist us with why you were copied into that email?
Peter Sewell: No. I think I was copied in to a lot of things, just to make me aware but, no, it had nothing to do with the statement.
Mr Blake: Is that because you were part of quite a small team?
Peter Sewell: Yes, I think so.
Mr Blake: If we scroll up slightly, thank you very much, you’re still copied into this email.
Peter Sewell: Copied in, yes.
Mr Blake: It’s a response from Brian, and he says:
“Graham
“No problem, we are happy to provide a statement presenting the Helpdesk calls regarding Marine Drive and Torquay Road when required. Grateful if you could provide us with a heads up nearer the time.”
So that’s answering, I think, the second of those questions in that email.
Peter Sewell: It looks like it, yes.
Mr Blake: Could we please turn to the bottom of page 3 and then to page 4, please.
Thank you. So we have here an email from Graham Ward to Brian Pinder and others but you’re not copied in at this stage, although I think you did receive the chain and we’ll come to look at that. But if we scroll down, please, down to the bottom of page 3.
It’s the bottom email there. From Graham Ward to Brian Pinder. As I say, you’re not a direct recipient of that, although we’ll look at the entire chain because I think you do possibly appear again. It says as follows:
“Brian, I’ll get back to you once I have confirmed whether we need these statements or not (in respect of Torquay Road and Marine Drive).
“Can I also take this opportunity to clarify our requirements in respect of the Gaerwen statement. In this case the subpostmaster is blaming Horizon for his losses claiming that for various banking related transactions the counter desktop records amounts entered for payment but then shows ‘Nil’ when the transaction log is printed, and it is this we need to refute.”
Just pausing there, as at this period, so March 2006, were you aware of complaints being made by subpostmasters blaming Horizon for losses?
Peter Sewell: No, sir.
Mr Blake: You weren’t aware of that?
Peter Sewell: No.
Mr Blake: “Various emails passed between myself and your team on this matter and the reply below was received from Penny on 20/10/05.”
Then the next paragraph appears to be a quote from an email that had passed between himself and Penny Thomas. It says:
“Nil transactions could also be caused by errors in PIN Pad, counter, agents or host code depending on what constitutes a ‘nil transaction’. This cannot be determined without access to the appropriate system logs.”
Then he continues:
“Penny also sent with the respective ARQ data, additional spreadsheets which showed all ‘Nil’ transactions for the periods.”
He says:
“We therefore require the usual statement producing the transaction and event logs (Penny has sent me a draft and I have suggested one or two minor amendments). We will also need the above spreadsheets produced by whoever put them together explaining the headings and under what circumstances ‘Nil’ transactions can occur. Finally, [one or two]”, et cetera.
The question I have for you is about the words from Graham in the second line, he says, “Penny sent me a draft and I have suggested one or two minor amendments”. Was it usual, to your understanding, for somebody in the Post Office Investigations Team to suggest amendments to witness statements?
Peter Sewell: I can’t recall whether that was a true statement or not. I don’t know. It’s Graham Ward talking to Penny Thomas.
Mr Blake: Yes, but, within your small team, you being copied in to emails about witness statements, you having, we’ve seen, made some comments on witness statements –
Peter Sewell: Very minor, very minor.
Mr Blake: – were you not aware – one said that you were not aware that subpostmasters were blaming Horizon for losses –
Peter Sewell: Yeah.
Mr Blake: – and (2), is it your evidence that you weren’t aware that the Post Office Investigators inputted, in some way, on –
Peter Sewell: I don’t know whether they did. I thought that was just advice but I don’t know.
Mr Blake: Can we turn to the first page, please, email from Neneh Lowther, so within your team, to Gareth Jenkins.
Peter Sewell: Yes.
Mr Blake: She says:
“Hi Gareth,
“I have updated your [witness statement] with all the column headings you explained to me earlier.”
I’m going to now take you to the witness statement that was attached to this email, and that’s FUJ00122198. This was the Gareth Jenkins statement.
Peter Sewell: Mm-hm.
Mr Blake: If we could scroll down. That statement included a couple of paragraphs that we have seen with previous witnesses.
Peter Sewell: Yes.
Mr Blake: If we have a look down the page. It’s these two paragraphs:
“There is no reason to believe that the information in this statement is inaccurate because of the improper use of the computer. To the best of my knowledge and belief at all material times the computer was operating properly, or if not, any respect in which it was not operating properly, or was out of operation was not such as to effect the information held on it.”
Did you have any concerns about those words being used in witness statements?
Peter Sewell: I don’t recall anything like that. This is a statement by Gareth Jenkins, not from me.
Mr Blake: No, but you’re a member of this small team. You were senior within that team.
Peter Sewell: Yeah, I didn’t involve myself with witness statements.
Mr Blake: Do you now have any concerns about those words?
Peter Sewell: Today?
Mr Blake: Yes.
Peter Sewell: Of course.
Mr Blake: Yes. Can we please look at FUJ00122203. We have a response from Gareth Jenkins – and I accept you’re not copied in to this email – and he says:
“I’ve annotated it with revisions.
“In particular, I don’t feel I can include the last two paras, which may make the statement useless.”
Do you not recall any discussion within your team about concerns about the accuracy of witness statements being provided?
Peter Sewell: I don’t recall my input into this at all, no.
Mr Blake: Perhaps we can look at FUJ00122201. That’s the statement that Mr Jenkins has attached to this email. Thank you.
If we scroll down to the end of the statement, please, he’s highlighted those two paragraphs at the end. He says at the bottom:
“I’m not sure that the yellow bit …”
Now, we’ve scanned it in black and white but it’s those two paragraphs there.
Peter Sewell: Yeah.
Mr Blake: “… is true. Can this be deleted? All I’ve done is interpret the data and spreadsheets that you have emailed me.”
So looking back at what we’ve already had this morning, we have Penny Thomas removing a definitive statement about system integrity in the pro forma that she had been working from. You have Gareth Jenkins here expressing concerns about a paragraph that says that the computer system was operating properly. As at 2006, do you recall there being any concerns within your team about what they were being asked to do in relation to the provision of evidence in criminal proceedings?
Peter Sewell: I don’t recall anything like that. This is what the part of the job was: to provide a witness statement with the figures from the ARQ.
Mr Blake: You don’t recall, within that small team, any discussions about concerns about the reliability of the evidence being given?
Peter Sewell: No.
Mr Blake: I’m going to move on to a specific issue and it’s an issue that we might refer to as the Craigpark issue or lock issue.
Peter Sewell: Yes.
Mr Blake: Can we please have a look at FUJ00154823, please. We’re now in August 2008, so by at this time you were a Manager of the team, or the –
Peter Sewell: Yes.
Mr Blake: Yes. Can you assist us with what management involved? Were there regular team meetings?
Peter Sewell: Team meetings, appraisals, objectives, typical manager-type roles.
Mr Blake: How often would the team meetings take place?
Peter Sewell: Various, as and when necessary. If there was some sort of issue there would be a team meeting, otherwise there would be a routine – maybe a monthly meeting.
Mr Blake: Appraisals, feedback?
Peter Sewell: Appraisals would be annually.
Mr Blake: Was it a team in which people who were in the team felt able to speak freely about concerns that they had?
Peter Sewell: I think so, yes.
Mr Blake: Let’s look at this particular issue. We have here, if we turn to the final page please, if we start at the bottom of the email chain, an email from Mik Peach, 11 August 2008. Mik Peach, he was the SSC Manager was he?
Peter Sewell: Yes, he was, yes.
Mr Blake: This is an email from him to Gareth Jenkins. You’re not on this particular email but you do appear in the chain and we’ll go to that email.
Peter Sewell: Mm-hm.
Mr Blake: He says as follows:
“Gareth,
“OK – I understand that you don’t want this to be left unfixed …”
We can see in the subject it’s about a particular problem at a branch, Craigpark branch:
“On the basis of the evidence we have – there are 35 errors per week (inside the 7-8 pm Wednesday window) …”
Now, “Wednesday window”, is that the balancing day?
Peter Sewell: No idea.
Mr Blake: No idea.
“… and two in the 35*52 (weeks) = 1,820 are known to have caused a discrepancy.
“a) SSC staff spending lots of time monitoring these events for 1-2 per year is simply not cost effective.
“b) Fixing the underlying problem of holding the ‘lock’ for too long is feasible …”
It refers to a PEAK and we’re going to that PEAK shortly.
Peter Sewell: Mm-hm.
Mr Blake: He says:
“… BUT
“c) I would want some assurance that making this change to the live estate, to resolve 2 reported issues, is NOT going to have a knock-on effect anywhere else …
“I know this is a difficult request – but I don’t like changing Horizon at this stage – and I would like to be convinced that it is necessary, and that we won’t make [matters] worse …”
If we go up, please, to page 3. So summarising that, Mik Peach seems to not want a fix to Horizon and is looking at some workarounds.
Peter Sewell: It looks like it, yes.
Mr Blake: Yes.
Peter Sewell: Yes.
Mr Blake: Gareth Jenkins responds to Mr Peach, and he says:
“Mik,
“As discussed, I am still uneasy about this, but I agree it’s probably safer to leave things as they are.
“I’ve discussed this with Mike and I’ll mention this to Pete Sewell so he can ensure that if we’re providing evidence for an ARQ that we also check on relevant events.”
Now, your evidence so far has been that you didn’t get involved in witness statements.
Peter Sewell: Tried not to, yes.
Mr Blake: Well, why is Mr Jenkins there seeing you as the relevant person to go to in respect of providing evidence for an ARQ?
Peter Sewell: I can only assume that’s because I was Penny’s manager, Penny Thomas, and Penny Thomas was the ARQ expert.
Mr Blake: So you managed the person who was providing evidence in proceedings?
Peter Sewell: Yes.
Mr Blake: If we scroll up, please, we can see that Gareth Jenkins emails you and he says as follows:
“Pete,
“Over the last couple of years we’ve had a couple of cases where EOD …”
I think that stands for “end of day”.
Peter Sewell: Yes, I believe so.
Mr Blake: “… (which runs at [7.00 pm]) interferes with transactions being written at the counter. If this happens, then there is an Event written to the NT event Log.
“Given we only have couple of instances, and a fix is as likely to cause further problems, then we’re reluctant to make a change to Horizon. However if Horizon data is being used in evidence for the prosecution of a postmaster, it is probably wise to also check to see if any such events were produced during the period in question, is this something that can/should be built into the ARQ process?”
Then if we look up, please, if we go up to the previous page, page 2. We have an email from you, following this up – is that within your team to Alan Holmes and Penny Thomas?
Peter Sewell: Yeah, Alan Holmes was the, I guess the design authority for the audit system.
Mr Blake: It says:
“Alan
“Can we set up a meeting please, Gareth has raised a potential issue with events which might require a change in our ARQ process.”
So it seems as though, as at 12 August 2008, you were taking things forward, arranging a meeting about this issue that had been raised by Gareth Jenkins.
Peter Sewell: That’s exactly what that is, I think, yes.
Mr Blake: Yes. Can we please look at FUJ00155232, please. This is an email slightly before you’ve arranged that meeting. It’s a response to Gareth Jenkins and you say as follows:
“Gareth
“When you say interfere, are transactions actually lost when the [end of day] is run?”
Can you assist us with any information you received in that respect? Do you recall this conversation?
Peter Sewell: No, no. I just don’t recall it.
Mr Blake: Do you remember receiving an answer?
Peter Sewell: No, I don’t recall it at all.
Mr Blake: You do seem there to be sufficiently involved that you are –
Peter Sewell: I think I was, with Craigpark, yeah.
Mr Blake: Yes. Okay. Can we please look at FUJ00155231, please. Thank you. An email from Penny Thomas to Gareth Jenkins and others, including you. It says:
“Hi all
“Pete has asked me to send a note to set up a meeting to discuss this issue.”
Then you ask if everybody can make 14 August and she attaches PEAKs and KELs so the PEAK is the incident log and the KEL is the Known Error Log. Were those things that you were familiar with at that time?
Peter Sewell: I knew what they were, yes.
Mr Blake: So she is sending around, effectively, information to be discussed at a meeting?
Peter Sewell: Yeah, these are the three technical people that would have had real relevant input into this.
Mr Blake: Yes, thank you. If we look over to page 4, please, that’s the first of the PEAKs that she has attached. Again, it’s a PEAK we’ve seen quite a lot of over the last couple of days, it’s PC0152376, and it begins on 20 December 2007. So by the time of this discussion in – I think we’re in August now, August 2008, so by August it had been known for eight months, this particular issue?
Peter Sewell: Yeah.
Mr Blake: Is that right?
Peter Sewell: Reading this, yes.
Mr Blake: Yes.
Peter Sewell: Yes.
Mr Blake: Presumably, prosecutions had been going on during this period and other court cases?
Peter Sewell: I don’t recall, I’m not sure.
Mr Blake: Do you recall, for example, a pause in 2007 to August 2008 following this issue?
Peter Sewell: Yes.
Mr Blake: You recall a pause in 2007 or do you recall a pause later?
Peter Sewell: I recall there was a pause while this was checked out.
Mr Blake: Yes, and that pause presumably followed the August meeting, rather than prior to the August meeting –
Peter Sewell: I think so, yes.
Mr Blake: – because you weren’t aware of it before –
Peter Sewell: I think so.
Mr Blake: – this period?
Peter Sewell: Yes.
Mr Blake: So are we to understand that, after discovery, 20 December 2007, up until the date of this meeting, there hadn’t been, from your team at least, any significant impact on the work that was being carried out?
Peter Sewell: I don’t know whether things were being checked at that time or not. I don’t recall.
Mr Blake: But, as manager of the team, do you recall any significant change to your practices between December 2007 and the date of the meeting in August 2008?
Peter Sewell: I believe the error on Craigpark was 2007.
Mr Blake: Yes. The error was in 2007. You’re manager of a team that provides, for example, witness statements and prosecutions.
Peter Sewell: Mm-hm.
Mr Blake: Do you recall from December 2007, up until the date of this meeting in August 2008, any significant activity in relation to this issue?
Peter Sewell: I don’t recall. I don’t recall.
Mr Blake: You don’t recall or you don’t believe there was any?
Peter Sewell: I don’t remember, I don’t remember.
Mr Blake: If we turn over the page to page 6, please. I won’t spend much time on this PEAK because we have, as I said, seen it a number of times here but I can just summarise it for you: the middle of this page gives an indication of the issue. It says:
“The messages that should have posted the £465.73 gain in stock unit BM to local suspense failed to be written. Consequently, when local suspense was cleared (written off to [profit and loss] in this case) the £465.73 wasn’t taken into account and this resulted in the [minus] £465.73 trading position seen on the branch trading statement.”
So it seems as though the issue is that the subpostmaster’s branch trading statement would show a discrepancy as a result of this error.
Peter Sewell: Yes, it would suggest it, yes.
Mr Blake: Yes?
Peter Sewell: Yes.
Mr Blake: If we go over the page, please, to page 7. We’ve heard from Gerald Barnes, there’s an entry here that we, again, as I say, have heard quite a lot about, and he says as follows, he says:
“The fact that the EPOSS code is not resilient to errors is endemic. There seems little point fixing it in this one particular case because there will be many others to catch you out. For example when I tried to balance with CABSProcess running I found that declaring cash failed with the same sort of error message!”
So the issue being here that there would be a discrepancy and it wouldn’t be showing as an error to the subpostmaster; is that what you understood the issue to be?
Peter Sewell: I don’t understand this. This is Gerald Barnes.
Mr Blake: Yes.
Peter Sewell: He’s one of the technical guys in the – was in the team of SSC.
Mr Blake: He has summarised the issue in lay terms as, effectively, an error that is silent to the postmaster; is that something that you were aware of –
Peter Sewell: No.
Mr Blake: – that this issue that caused a discrepancy wouldn’t be seen, wouldn’t be known to the subpostmaster?
Peter Sewell: I wouldn’t know. I don’t know.
Mr Blake: You wouldn’t know?
Peter Sewell: I don’t know whether the postmaster was aware of this.
Mr Blake: Was that not something that was explained to you at the time?
Peter Sewell: Explained to me?
Mr Blake: Yes. It wasn’t explained to you?
Peter Sewell: I don’t know. I don’t recall it.
Mr Blake: You don’t recall?
Peter Sewell: No.
Mr Blake: I mean, something that affected the balancing of a subpostmaster, the branch trading statement, the statement that they would see that would show a discrepancy, is that not something that would be of concern to you?
Peter Sewell: If I was involved at this level, yes, I guess so. But I wasn’t.
Mr Blake: But you were the manager of a team that provided evidence in prosecutions of subpostmasters?
Peter Sewell: Yeah, I don’t think I recall this at all.
Mr Blake: “Not resilient to errors”, it suggests that in fact this is just an example of a problem that the underlying code could cause, rather than – the real problem being the EPOSS code itself. Is that something that was ever discussed with you?
Peter Sewell: No, no. Too detailed for me.
Mr Blake: I mean, during Phase 2 of this Inquiry we heard quite a lot about the EPOSS code. We heard about Whac-a-Mole type problems where something would be fixed, something else would crop up. You were at ICL at the time of the rollout, was that a kind of issue that you knew anything about –
Peter Sewell: No.
Mr Blake: – that nobody discussed with you at the time?
Peter Sewell: No.
Mr Blake: Can we please turn to page 11. This is the Known Error Log. If we could scroll down and over to the next page, please. We see the solution being explained. It says:
“No fix planned for Horizon given the relative rarity of the problem. However, should the problem start occurring more often then the need for a fix should be reviewed. Add any cases to list below.”
Then we have a list of cases. There we have three, by that time, PEAKs that addressed – so three recorded incidents that were sufficiently serious enough to result in an error log –
Peter Sewell: Yes.
Mr Blake: – 12 December 2007; 5 March 2008; 27 December 2007.
Over to the next page, please, we have – and can I just be clear, those were just the reported errors that were sufficient to make it into an error log, is that – do you understand PEAKs to be something –
Peter Sewell: No, you’re right. Yes, they’re the logs.
Mr Blake: Over the next page is another PEAK. So this one we’re looking at PC0152421, and perhaps we could go over to page 15. Here we have Anne Chambers reporting on 21 December 2007 and the second entry in her entry says as follows:
“The stock unit was being balanced 7.00 pm at night, and, at the point where the stock unit gain should have been written to local suspense, there was some contention with the End of Day processes which were running in the background, and the messages were not written.”
She says:
“At the branch, the loss for TP8 was £465.73 bigger than it should have been. The loss (£1,083.76) was written off to [profit and loss]. As I understand it, this means the branch is not personally out of pocket, and there is no need to attempt to correct anything at the branch. The [branch trading statement] shows a trading position of [minus] £465.73.”
There is then a meeting held, and I’d like to take you to a note of the meeting. That’s at FUJ00154824. So the meeting is held on 13 August 2008.
Peter Sewell: Yeah.
Mr Blake: Present in the room is Gareth Jenkins, Alan Holmes – can you assist us, Gareth Jenkins and Alan Holmes, they were both technical specialists?
Peter Sewell: Yes.
Mr Blake: Steve Meek, Steven Meek?
Peter Sewell: He was technical as well.
Mr Blake: Then we have Penny Thomas and you join by phone. Is there a particular reason why you joined by phone?
Peter Sewell: I might have been away somewhere else, another location.
Mr Blake: I’m going to read to you a fair bit from these minutes before we take the mid-morning break. We’re going to start with the second paragraph:
“Gareth Jenkins explained the issue as described in the PEAKs and KEL listed above.”
Those are the documents we’ve just been looking at:
“An [end of day] process … was being run between [7.00 pm and 8.00 pm], and at the same time the user was performing a balancing process on the gateway PC. During the [end of day] operation the CABSProcess created a ‘lock’ on the message store during which time (30 seconds) causing any other message writes to wait, subject to a 10-second timeout, until the lock was released. The balancing operation attempt to write messages to the message store but this operation timed out and the messages were discarded. Due to a deficiency in the implementation of the counter code the end user was not informed of the failure and the transaction (the balancing operation) appeared to complete successfully.”
So, in essence, the subpostmaster wouldn’t be aware of the issue.
Peter Sewell: I don’t think so, no.
Mr Blake: Yes.
“When this type of error happens riposte records an event in the event log. It was said that this type of error could happen with any type of transaction.”
He then quotes the words we’ve already looked at from Mr Barnes, so the record of the minutes records that detail. Then it goes on and says, as follows:
“When this error condition occurs, the message is discarded and no gap is left in the message sequence numbers. The messages that fail to be written represent auditable events/transactions and this throws the credibility of the message sequence number check used to prove the integrity of data provided to [the Post Office] under the ARQ service. The question is, should any of these errant messages have been included in data returns and under what other circumstances could this type of failure arise?”
Pausing there, did you see this as a significant potential issue?
Peter Sewell: Yes. Yes.
Mr Blake: It then goes on to say:
“The discussion then focused on the way forwarded. It was agreed that we needed to understand what types of transactions had been subject to this error. To do this we needed to retrieve all of event logs, filter the Riposte error messages and analyse what was found. Only event logs from 8 January 2003 have been retained due to a previous retention agreement with [the Post Office].”
Just stopping there, so because the data was only retained for a certain number of years, any, for example, ARQ data from the rollout of Horizon, so 2000 to 2003, by this stage would no longer have been held?
Peter Sewell: Yes, I think that’s right.
Mr Blake: Yes, and over the page:
“At the same time we needed to consolidate all of the ARQ outlet and time frame data requests into a single Excel spreadsheet so that ultimately any relevant errors found in the event logs above, could be compared to ARQ data provided to [the Post Office] for litigation purposes to confirm the text of the data provided. This exercise can only be carried out from 8 January 2003”, for the reasons we’ve just explained.
Peter Sewell: Yes.
Mr Blake: “We cannot provide any further ARQs until this exercise is complete as the audit server is being fully utilised retrieving the 5.5 years worth of event log data.”
So at this stage, five and a half years worth of event log data was being gathered for some sort of analysis.
Peter Sewell: Yes, looks like it, yes.
Mr Blake: “We must question whether it is advisable to provide further ARQ data or witness statements until we have a process in place to fully validate our returns.”
So do you remember some concern within the team at this time about witness statements and data that was being provided to the Post Office and the reliability of that data?
Peter Sewell: Yes, as a result of this, yes.
Mr Blake: Yes.
“It was agreed that the process of retrieving all of the available event logs would be carried out and would start immediately. A sample would be provided to Steven to review. Also, the consolidation of the ARQ requests would commence.”
That’s a note of this meeting. We’re going to come to what happened after that, after the mid-morning break.
So, sir, if we could stop there for 15 minutes, and return at 11.45, please.
Sir Wyn Williams: Certainly.
Mr Blake: Thank you very much.
(11.30 am)
(A short break)
(11.46 am)
Mr Blake: Sir, can you continue to see and hear me?
Sir Wyn Williams: I can, thank you very much.
Mr Blake: Mr Sewell, we’re going to turn now to a meeting that took place in September 2008. Can we please look at FUJ00155257, please. That’s a meeting that took place on 3 September and this is an email dated 5 September with some notes that followed, sent to you by Roy Birkinshaw. Who was Roy Birkinshaw?
Peter Sewell: I think one of the managers in one of the teams. I don’t quite remember his position.
Mr Blake: “Draft statement [there]:
“PEAK 153276 triggered a review of the audit mechanism and of the Horizon counter’s behaviour. This review has been going on over the last two weeks. Our conclusion is there is not sufficient evidence to warrant continuing the review at the scale with which it was being conducted. There are nevertheless some residual actions that need to be driven forward.”
Are we to take it, then, that the significant exercise that had been planned, the five and a half years worth of ARQ data, it was decided on the 3 September that there wasn’t sufficient evidence to warrant continuing that kind of a review?
Peter Sewell: I don’t know. I don’t recall that. I don’t remember that.
Mr Blake: Do you remember five and a half years worth of ARQ data being pored over for a considerable period?
Peter Sewell: That was one of the plans that was coming out of the remedy but whether it actually happened, I don’t remember.
Mr Blake: Does this email suggest, in fact, that it didn’t happen?
Peter Sewell: If that is what that is referring to.
Mr Blake: Yes. Then there are number of actions for people.
JB somebody called John Burton; is that a name that’s familiar to you?
Peter Sewell: The name is familiar, yes.
Mr Blake: Do you know what his role was?
Peter Sewell: No, I don’t.
Mr Blake: “JB to review with Hilary over the extent to which the programme might need to revisit the history of ARQs that are closed.”
Number 2, “PS” is presumably a reference to you?
Peter Sewell: I think so.
Mr Blake: “… Audit and Security Teams to progress changes to the current process to tighten any weaknesses perceived therein responding to Open ARQs.”
If we look at number 4, “PS”, so again your name:
“… with assistance from the Audit Team – to review the words currently offered to the Post Office in support of ARQ requests and prosecutions in the light of the review run.”
Can you assist us there with the task that you had been set.
Peter Sewell: Actually, what it says, “review the words”, so I think the main words there is assistance from the Audit Team. I think they were the players who put the wording in.
Mr Blake: It says “PS with assistance from the Audit Team”, so it seems as though you were personally tasked with this?
Peter Sewell: Maybe I was tasked with it but then I delegated that down to the team that were relevant to putting the wording in.
Mr Blake: So where the task involved, for example, reviewing the words currently offered, for example, in, perhaps, witness statements, that wasn’t something that you, yourself got involved in?
Peter Sewell: Absolutely not. No. I relied on the technical people to put those words in.
Mr Blake: Despite being the named person there to carry out –
Peter Sewell: Well, I think the named person is the person maybe who will make it happen.
Mr Blake: Can we please now look at FUJ00155263. We’re moving now to 16 September 2008. This is an email from Anne Chambers to Penny Thomas but you are copied in alongside Gareth Jenkins.
Peter Sewell: Indeed, yes.
Mr Blake: Presumably your evidence is that this was just because you were her manager, or something along this is lines?
Peter Sewell: I think so, yes, yes.
Mr Blake: “Penny,
“We discussed this event when it occurred while CABSProcess was running (at 7.00 pm) but we didn’t explain why it might be seen at other times – and if you were ever questioned about it, it might confuse you.
“Basically it happens when one process has locked the message store (usually only very briefly) and another process tries to access the message store at precisely the same time.
“The worst offender for doing the locking is CABSProcess, but it can happen at other times too.”
Did you understand that the issue wasn’t just at the 7.00 pm time but it could also happen at other times?
Peter Sewell: The only thing I was aware of was the end of day process that seemed to affect it.
Mr Blake: Do you read this in the same way as I read it, which is that, in fact, it’s not just the end of day process; it can happen at other times too?
Peter Sewell: That’s what it suggests here, doesn’t it?
Mr Blake: Is that something that you were aware of?
Peter Sewell: No, no.
Mr Blake: “Whether it causes a problem or not depends on (a) what the second process is trying to do and (b) whether that process handles the error situation in a sensible way.
“All the checks we have made have shown that, in the vast majority of cases, what is being done has no financial impact and doesn’t affect the integrity of the system in any way, and/or the error situation is handled sensibly.”
Just pausing there, “in the vast majority of cases … has no financial impact”: as somebody whose team was providing evidence in court cases, do you think reference to “vast majority of cases” is reassuring or not reassuring?
Peter Sewell: This has been written by Anne Chambers who was Technical Design Authority.
Mr Blake: I didn’t ask who it was written by. She refers there to it not affecting the vast majority of cases, in respect of financial impact.
Peter Sewell: I would –
Mr Blake: Your team is providing witness evidence in proceedings against subpostmasters, is it reassuring to you to hear that it doesn’t happen in the vast majority of cases or would you like it to happen in no cases?
Peter Sewell: No, obviously no cases. That’s what the choice is, yes.
Mr Blake: Were you aware at this stage that, in some cases, it could cause a financial impact?
Peter Sewell: I wasn’t aware, no.
Mr Blake: If that happened or something similar to this happened in, for example, a prosecution of a subpostmaster who wasn’t aware of the issue happening because there was no error notice provided to them, might it result in a serious injustice to that subpostmaster?
Peter Sewell: I think it would, yes.
Mr Blake: Can we please turn to FUJ00155265. Penny Thomas to you:
“Pete
“As an afterthought, what happened with regard to checking event errors for cases we are not advised of? Was someone actioned to deal with this?”
Was that a concern that you recall at all?
Peter Sewell: I can’t remember it, no.
Mr Blake: Because what Ms Thomas seems to be concerned about here is errors that you’re not advised of need to be checked as well. Do you recall doing anything about that?
Peter Sewell: I don’t recall. I don’t remember it.
Mr Blake: Putting aside the particular issue, do you remember at this period, September 2008, some significant taskforce grouping together to have a look at all the historic cases, for example, at Fujitsu?
Peter Sewell: The one thing I do remember is the locking issue with the entered of day, and that was proven to be a bug in the system which was corrected and then the ARQs and the events were rechecked after that to prove that they were okay.
Mr Blake: What she’s expressing concern here is that there may be issues that you’re not aware of, subject “Other Event Error Checks”. Did you instigate some grand taskforce to review –
Peter Sewell: We checked event errors, yes, to check – yes.
Mr Blake: You checked all historical event errors –
Peter Sewell: Yes.
Mr Blake: – all previous court cases historically from the time that –
Peter Sewell: From that period when we knew the period where the error was, yes.
Mr Blake: When you say you knew the period the error was, we will see in due course references 2007 to 2008.
Peter Sewell: That’s the period.
Mr Blake: It was, in fact, confined to that period, wasn’t it?
Peter Sewell: Yes.
Mr Blake: We saw earlier that the original intention had been to review historic cases for as long as you had records for, dating back to 2003?
Peter Sewell: Yes.
Mr Blake: But it seems, certainly by this stage, that that didn’t take place, that wider exercise?
Peter Sewell: Yeah, I don’t remember – I don’t remember why it was not done.
Mr Blake: Were you of the person who was responsible, if it had taken place, to have instigated it?
Peter Sewell: I don’t believe so no.
Mr Blake: Who do you say should have instigated that?
Peter Sewell: I don’t know, someone from the design authority of the audit system.
Mr Blake: Somebody from the design authority of the audit system?
Peter Sewell: Yes.
Mr Blake: What do you mean by that? Who might that be?
Peter Sewell: It may be Alan Holmes.
Mr Blake: So a technical person?
Peter Sewell: A technical person, yes.
Mr Blake: Not somebody who is directly involved in the team that is assisting with the prosecution of subpostmasters?
Peter Sewell: I think one of the technical team should have taken it on, yes.
Mr Blake: Can we please look at FUJ00155268, an email from Gareth Jenkins to you, 8 October. He says:
“Pete,
“I’m not sure that I’m the best person to be checking through the ARQ events for Penny.
“I think it would be better if you arranged with Mik for SSC to do this as part of their normal activities. Presumably they were doing this while I was on leave, but now that I’m back Steven has started sending them back to me.
“I’m happy to advise on specific questions, but I think SSC have a better detailed knowledge of what causes these events and what are known to be benign than I have. They also have processes in place to cover for leave etc.”
It certainly seems, as at 8 October 2008, that Gareth Jenkins saw you as the person who was responsible for coordinating who was carrying out various checks.
Peter Sewell: I’m not sure that’s true, I’m not sure I’m the person, but I think he’s going through me because I can then go back to SSC and maybe change it.
Mr Blake: So he saw you as what: a postbox, a coordinator?
Peter Sewell: Manager of Penny, who was actually managing the checking, yes.
Mr Blake: It says:
“I think it would be better if you arranged with Mik for SSC to do this …”
Peter Sewell: Yes, well –
Mr Blake: The suggestion being that you were doing the arranging; is that not right?
Peter Sewell: Yeah, suggests it, yes.
Mr Blake: Pardon?
Peter Sewell: Suggests it, yes.
Mr Blake: Sorry?
Peter Sewell: Yes, it suggests that I was managing Penny.
Mr Blake: Is that right or wrong?
Peter Sewell: Well, I think –
Mr Blake: It doesn’t suggest that you were managing Penny. The question was about the second paragraph. It was “I think it would be better if you arranged with Mik for SSC to do this”, it reads as though you were the one coordinating the response. Were you coordinating or weren’t you coordinating?
Peter Sewell: I don’t remember.
Mr Blake: Gareth Jenkins is a distinguished engineer. We’ve seen provided witness statements in proceedings. He is saying there that the SSC have a better detailed knowledge of what causes these events and what are known to be benign than he has. Did that cause you any concern at all?
Peter Sewell: Not concern. I think he’s probably valid in the fact that he was busy doing other things and the SSC had more of a – more influence on what they could check.
Mr Blake: But he says there that they have a better detailed knowledge of what causes the events, so the suggestion being that he wasn’t up to speed in some way as to what caused the events?
Peter Sewell: Well, that’s what he’s saying. The SSC were very technical.
Mr Blake: More technical than Mr Jenkins?
Peter Sewell: That’s a difficult question.
Mr Blake: Do you want to try and answer it?
Peter Sewell: No.
Mr Blake: No?
Peter Sewell: No.
Mr Blake: Okay. FUJ00155270. We have here 10 October 2008, Anne Chambers to Gareth Jenkins and Penny Thomas. She says:
“Although Mik’s line is, very strongly, that SSC should have no formal responsibility for checking events connected with ARQs, in the short term he is happy for me to help with this on an informal basis (as I have been doing already).
“This may have to stop as SSC involvement with HNG-X [that’s Horizon Online] increases, and will always be a low priority.”
Penny Thomas then emails you and says:
“A cap-in-hand jobbie.”
Can you assist us with what this might mean?
Peter Sewell: Well, we needed help with the analysation (sic) of events and Anne Chambers would be the ideal person.
Mr Blake: You – I think your evidence was that you weren’t coordinating that is particular process – seemed to be emailed by Penny Thomas forwarding that email; did Penny Thomas not think that you were the person who was coordinating the response?
Peter Sewell: I don’t know what that means, “cap-in-hand jobbie”.
Mr Blake: Why do you think people didn’t want this responsibility, didn’t want to be carrying out this task? We’ve heard Gareth Jenkins not wanting to do it, we’ve now heard Anne Chambers happy to do it on an informal basis in the short term. What do you think people were reluctant to get involved in that process?
Peter Sewell: Well, the only thing I could say is they were all quite busy with other things and it required a technical knowledge to go through the events to look for this.
Mr Blake: Do you recall any concerns you had about the inability to have sufficient people checking what seemed quite like a serious matter?
Peter Sewell: Well, I think we found the appropriate people and they did the job.
Mr Blake: Can we please look at FUJ00155271, please. We’re now moving to a proposed technical solution. So we have all these people carrying out checks that we’ve had a look at but we’re now moving on to a change proposal, a formal change proposal. Did you understand what a change proposal was?
Peter Sewell: Yes. Yes, I did.
Mr Blake: Can you briefly explain to us what that might be, a change proposal?
Peter Sewell: When the project decided it would be a change to the way the things were being done, it would formally be done via a change proposal, which specified what the action was and why it was being done.
Mr Blake: We have the email from Alan Holmes to you and others:
“Gents
“As discussed last week, I have put the attached together as a proposed [Horizon Online change proposal] to handle the processing of counter events within Audit.
“Any initial comments?”
Do you recall that the plan was for Horizon Online to automate the process that was being undertaken?
Peter Sewell: In time, yes.
Mr Blake: Yes?
Peter Sewell: Yes.
Mr Blake: Let’s have a look at the attachment to that email. That can be found at FUJ00155272. We see there “HNG-X [that’s Horizon Online] Change Proposal”, date raised, 13 October 2008, and it has you named there as the “change owner”; is that correct?
Peter Sewell: I think it was because I was the manager in the – at that particular sort of work.
Mr Blake: That’s quite a responsibility, isn’t it?
Peter Sewell: I think it’s default because it was a security thing.
Mr Blake: So is your evidence that you were or weren’t significantly involved in this change proposal?
Peter Sewell: Significantly involved insofar as I knew what was going on and I bought into it, yes.
Mr Blake: How high up within the company would this proposal have been seen?
Peter Sewell: It would depend on what the change proposal was, how important it was.
Mr Blake: So you as the change owner here, would you have raised it with people who managed you?
Peter Sewell: Yes, my manager would have been involved, yes.
Mr Blake: So who would you have raised it with?
Peter Sewell: 2010. I think that would be Howard Pritchard.
Mr Blake: 2008.
Peter Sewell: 2008? Um … I think it was Howard Pritchard still. I think it was still Pritchard.
Mr Blake: Is the purpose of a document like this to ultimately share it with the Post Office?
Peter Sewell: The ultimate is to cost out what this is going to cost and agree to it with all parties that are involved.
Mr Blake: The counterparty being the Post Office?
Peter Sewell: I don’t remember the Post Office being involved in this CP, no.
Mr Blake: Well, if we look at the very top we have Fujitsu’s logo, we have the Post Office’s logo, it is a change proposal to the Horizon system. Presumably this is a document that you are preparing for the Post Office?
Peter Sewell: No, it’s an internal document. It’s change proposal to our existing systems.
Mr Blake: So was the intention for this document to always be an internal document that wasn’t seen by the Post Office?
Peter Sewell: I just think it’s an internal document from ICL –
Mr Blake: I’m going to read to you from the document. The second substantive paragraph there says:
“Historically, the Horizon Audit Service has relied solely on the retrieval and analysis of archived Riposte message store data when servicing [the Post Office] audit data requests for Horizon branch transaction data. A recent issue …”
That refers to the PEAK incident log that we have seen this morning:
“… has identified a deficiency in this approach. In certain failure scenarios, it is possible that the Horizon counter may write an inconsistent set of messages to the local message store. This casts doubt over the overall integrity of the resulting transaction data.”
If we could have a look at the paragraph below that. About halfway through that paragraph, it says:
“A tactical solution has been incorporated into the Horizon audit retrieval process to provide a short-term remedy to this problem. For every branch Riposte data retrieval, the archived events generated by counters at the branch are also analysed to identify any possible occurrences or problems which might adversely affect the integrity of the transaction data.”
So having identified the problem, the process that was being undertaken prior to the change was a manual solution that, as it explains there, remedies the problem?
Peter Sewell: Checking the events, yes.
Mr Blake: Checking the events.
Peter Sewell: Yes.
Mr Blake: Could we please have a look below that, thank you very much. It then highlights deficiencies with the current solution. It says:
“It is a largely manual process which is error prone and time consuming.”
Is that something you were aware of, that the process that was being undertaken up until the change is made was error prone?
Peter Sewell: I don’t know about that. I wasn’t aware there was – error prone. It meant it was a manual exercise. Any manual exercise contains risk.
Mr Blake: You say you don’t know about that. I mean, this is a document that was sent to you.
Peter Sewell: Everything we did was to check the events without finding errors.
Mr Blake: This is a document that was sent to you of which you are the owner?
Peter Sewell: Mm-hm.
Mr Blake: It describes the process as “error prone”. Is that something that you were aware of?
Peter Sewell: Well, I think you have to be because it’s a manual process, yes.
Mr Blake: It says:
“It involves moving large volumes of data between the audit server and workstation.”
I think we’ve seen that that in itself carries risks because it’s taking something from a server to a workstation. Keeping data such as that on a workstation is itself inherently problematic.
Peter Sewell: There is a risk of course, yes.
Mr Blake: “It requires local and insecure storage of event audit data, invalidating certain statements made within the current witness statement.”
Again, something you would have been aware of –
Peter Sewell: Yes.
Mr Blake: – that the process invalidated certain statements that had been made in witness statements.
“It has no DR mechanism in the event of DR [and gives a reference there].”
Are you able to assist us with that or is that too technical?
Peter Sewell: No, that’s the disaster recovery mechanism, with the disaster recovery site at Lewes.
Mr Blake: Could we please go over the page. It says:
“Whilst we believe that we have to live with this tactical solution for the remaining life of the Horizon audit system, a permanent solution for the [Horizon Online] audit solution is required which addresses the above deficiencies.”
Then it sets out some requirements.
Under the final heading on that page, “Reason for Change and Justification for Required Date”, it says:
“While we do not believe that (due to time constraints) it is practicable to introduce this change into Horizon, it is required to ensure the viability of the ongoing Prosecution Support Service within [Horizon Online].”
So it seems to be that there wasn’t sufficient time or perhaps sufficient – I think we’ve heard some evidence about it costing a lot to introduce into Horizon, what we know as Legacy Horizon, and it was instead going to be introduced when the new system was implemented.
Peter Sewell: Yes, that’s right.
Mr Blake: Would you agree with the costs’ issue as well as time, or …
Peter Sewell: That was a major player in this, yes, the cost of introducing it into the Legacy system, yes.
Mr Blake: If we go over the page, please, just pausing there, though, with the time constraint and the cost constraints, people were, during this period, being prosecuted or there were court cases that were going on relating to the Horizon system. It might be asked why it wasn’t seen as sufficient priority in those circumstances?
Peter Sewell: To introduce it into the earlier release?
Mr Blake: Yes.
Peter Sewell: (a) the cost – (a) the resource availability, and this would have to be accepted by the project, the Post Office project internally for this to go – be accepted, and we feel the board – it went through a change control board – would probably not have accepted it.
Mr Blake: If, as we’ve seen, the process that was being undertaken in the interim period was error prone, as I say, if there were court cases that were ongoing, why do you think it was not seen as that significant a priority?
Peter Sewell: Well, there was risk attached to it because it was a manual process. It was just important that this was carried out successfully.
Mr Blake: Yes, and why do you think a more reliable solution couldn’t have been implemented earlier?
Peter Sewell: For cost, as much as anything, and resource availability, and I think it would have put the whole HNG-X proposals pushed back.
Mr Blake: Thank you. “Consequences if Not Approved”:
“We are obliged to present and vouch for the integrity of audit data that is fit for purpose – ie admissible as evidence in court. If this change is not approved, we will need to continue operating the current Horizon tactical process for the lifetime of [Horizon Online]. This raises the following issues:
“We are liable to service penalty payments if we cannot provide dependable audit data and witness statements when requested by [the Post Office].
“There is a risk of Prosecution Support Service suspension if there is any interruption to the current tactical process.
“Will require ongoing allocation of resource [and it’s to insert the number of man-days per month] to operate the current tactical process.”
Then it says:
“Data integrity issues inherent with the current process need to be addressed by weakening the content of the witness statement.”
Were you aware that data integrity issues that were inherent with the process that was ongoing needed to be addressed by weakening the content of the witness statement?
Peter Sewell: Only by reading these words. They’re not my words.
Mr Blake: That wasn’t a concern of yours at the time?
Peter Sewell: I was concerned with, overall, getting the thing through and ensuring that events were checked period to going to HNG-X.
Mr Blake: Can we please look at FUJ00155276. If we look at the bottom email, there seems to have been a meeting on 15 October, and it says:
“This is a follow-up to today’s meeting, minutes of which roughly below.”
So it provides the minutes of the meeting of 15 October from somebody called Steve Evans. Who was Steve Evans?
Peter Sewell: I think he was a technical person from SSC.
Mr Blake: He says there, towards the bottom, he says:
“However the real cost of this development (or rather of not doing it) is in the potential for mistakes (especially by a ‘new’ resource, without the experience of SM) to be made in a manual process which uses data so far extracted from the original source: which is the proposed new wording for the CP.”
If we scroll up, please, we have Alan Holmes sending a new version of the change proposal to yourself and others, and he says:
“As discussed at the last meeting, I have watered down the proposed [change proposal] – copy attached.”
Are you able to assist us with what was meant by “watered down”?
Peter Sewell: I don’t recall. I don’t recall.
Mr Blake: The change proposal appears on the next page so, if we could go to page 2, please, this is the version he described as “watered down”. Could I ask for it to be brought up side by side with the earlier version, which is FUJ00155272. It should be the first page of that document.
So that’s the earlier version on the right-hand side and the watered down version on the left-hand side. We see there at the bottom, on the left-hand side, it now says:
“The current Horizon tactical solution is a largely manual process, the operation of which is reliant on a few key individuals. Whilst we believe that we will have to live with the tactical solution for the remaining life of the Horizon audit system, a permanent solution for the [Horizon Online] audit solution is required. In outline, this will require the following …”
What has been removed from this version, we can see on the right-hand side, is the number of deficiencies that were identified on the right-hand side. So the reference to, for example, the manual process being “error prone” does not appear on this watered down version; do you see that?
Peter Sewell: Yes.
Mr Blake: If we, on the left-hand side, turn to page 4, please, and on the right-hand side turn to page 3., we have there “Consequences if Not Approved”. Now, we saw on the right-hand side reference to, for example, that final bullet point in the first box:
“Data integrity issues inherent with the current process need to be addressed by weakening the content of the witness statement.”
That no longer is included in the watered down version on the left-hand side. It says instead:
“We are obliged to present and vouch for the integrity of audit data that is fit for purpose – ie admissible as evidence in court. If this change is not approved, we will need to continue operating the current Horizon tactical process for the lifetime of HNG-X.”
So “data integrity issues inherent with the current process” no longer appears.
Do you recall discussion at this meeting about watering down that version on the right-hand side?
Peter Sewell: No, that’s the design authority that’s decided to do that.
Mr Blake: When you say that’s the design authority, what do you mean by that?
Peter Sewell: Alan Holmes.
Mr Blake: Alan Holmes. So we saw on the front, if we stick with the left-hand side, and look at page 2 on the left-hand side – the right-hand side can come away – we have Alan Holmes as the “originator” but we have yourself as the “change owner”?
Peter Sewell: Mm-hm.
Mr Blake: Are we to understand from your evidence that, despite being the “change owner”, that wasn’t something that was discussed with you?
Peter Sewell: I would listen to the technical sponsor, the originator, they’re the same person and, if that was their wording, I would go along with it.
Mr Blake: Mr Sewell, your evidence so far about witness statements, for example, was “I didn’t look at witness statements, I wasn’t involved in them”. Your evidence about to be the change proposal of which you’re named as the change owner is, effectively, “I would have just seen what those with greater knowledge did, I would have approved it”.
Some people might be struggling to understand quite what you did. What did you see as your role, if not to get involved in things like witness statements or if not to get involved in something where you are named as the change owner.
Peter Sewell: I relied on other people with the technical knowledge to give me the advice.
Mr Blake: You may have relied on other people but don’t you think as manager of your team, the team that was assisting with the prosecution of subpostmasters, do you not think you should have been more involved in the detail?
Peter Sewell: I’m the change owner here. I’m not the originator of this CP. Change owner by default because I was in the Security Team, and it’s a security change proposal.
Mr Blake: If we look at the covering email, that’s on page 1, there are very few people who are involved in this. There is meeting and meeting taking place about this issue. You’re named there as a senior individual, as a recipient from Mr Holmes, circulating a document that was discussed at the last meeting. Do you not think that you should have played more of a role in this significant issue?
Peter Sewell: I played a role in the issue.
Mr Blake: Do you not think you should have got down into the detail of what was going on, given your team’s role with regard to the prosecution of subpostmasters?
Peter Sewell: My detailed knowledge was limited, so I couldn’t get any more involved than I did.
Mr Blake: But you had seen documents that relate to concerns about the integrity of the data?
Peter Sewell: Mm-hm.
Mr Blake: Should you not have been more concerned?
Peter Sewell: I would always listen to the technical authority to advise me.
Mr Blake: You may have always listened to people but people may be asking why you weren’t doing more about it?
Peter Sewell: What do you mean by that?
Mr Blake: Well, you’ve seen, for example, concerns about data integrity.
Peter Sewell: Yes.
Mr Blake: You are managing a team that provides witness statements in criminal prosecutions and civil claims against subpostmasters. Why weren’t you raising this at the highest levels? Why weren’t you getting more involved in resolving the issues and ensuring the integrity of the data that Fujitsu were providing to the court that led to people’s prosecutions?
Peter Sewell: This was at the highest level. This is Alan Holmes, the design authority for the audit system.
Mr Blake: Are there no higher levels within Fujitsu in the United Kingdom?
Peter Sewell: I guess there would have been, yes.
Mr Blake: Yes. So Alan Holmes was the highest level, as far as you were concerned, that this was being raised with?
Peter Sewell: Regarding the audit system, yes.
Mr Blake: You didn’t see if it as your job, as the person managing the team that was involved in criminal prosecutions, to do anything more than you were doing?
Peter Sewell: I did what was necessary.
Mr Blake: What was necessary?
Peter Sewell: I listened to Alan Holmes and took his recommendations.
Mr Blake: That was the limits of your job, was it?
Peter Sewell: Regarding to the audit, yes, on this occasion, yes.
Mr Blake: Can we please look at FUJ00155278. 24 October 2008, there seems to be another meeting. This is from Penny Thomas. She says – I believe this is from Penny Thomas, her name is at the top – it certainly is recorded there from somebody. It says:
“At today’s meeting, Pete agreed that (with Alan and Roy’s input) we urgently need to thrash out the words to sell the CP to interested parties.”
Now, she doesn’t say, “Alan agreed”, she says, “Pete agreed” – or whoever recorded this says “Pete agreed”. It does seem, from the contemporaneous documents, that you were more involved perhaps than your evidence today is suggesting.
Peter Sewell: Well, I’m the sponsor that wanted to see that the CP was approved, so that would be my interest.
Mr Blake: So now you’re involved because you were the sponsor?
Peter Sewell: Well –
Mr Blake: But before, when we were looking at drafts, you weren’t involved because you were just the change owner?
Peter Sewell: Well, the change owner – sorry, I didn’t mean sponsor. Change owner, that was my responsibility.
Mr Blake: So you weren’t significantly involved to actually get into the detail of the –
Peter Sewell: No.
Mr Blake: – the change proposal that we’ve just seen but you were significantly involved enough to have agreed that you need to thrash out the words to sell the change proposal to interested parties; is that right?
Peter Sewell: Yes.
Mr Blake: How could you have formed that view if you weren’t involved in the detail of the change proposal itself?
Peter Sewell: Because the wording would be put together from, as we said here, Alan and Roy’s input, and I would then take that CP to the board.
Mr Blake: You were at meetings where the change proposal was discussed; there was a version that raised issues with data integrity; there was then a decision to water down that version; you were present at those meetings; you were receiving the various drafts; and you, here, say that you urgently need to thrash out the words to sell that proposal to interested parties. Surely you were more involved and knowledgeable about the words that we’ve looked at today than your evidence today is suggesting?
Peter Sewell: I offered whatever I could. These words are not mine “We urgently need to thrash out this” is correct but it wasn’t labelled on to me. It’s the people who put the words in.
Mr Blake: But you want to sell a proposal that your evidence is suggesting you weren’t really very much involved in?
Peter Sewell: I was selling the proposal to the change board, to assure that we got the board to approve it.
Mr Blake: Was your intention to approach the board in ignorance of the history of that change proposal, in ignorance of, for example, concerns that were raised in earlier versions about system integrity?
Peter Sewell: That was taken out.
Mr Blake: Indeed. Do you think you were well placed to address that board in ignorance of that?
Peter Sewell: I wasn’t qualified to question what the design authority said.
Mr Blake: So you would take whatever the design authority suggested to you and try and sell that without knowledge, despite having been in those various meetings?
Peter Sewell: Yes.
Mr Blake: Can we please look at FUJ00155 –
Sir Wyn Williams: Sorry, Mr Blake.
Just so I’m clear. That last document uses the phrase “interested parties” in terms of to whom it is to be sold. Can I be clear what your understanding of “interested parties” is, Mr Sewell?
Peter Sewell: These parties were relevant people who the CP would normally affect, with regard to resourcing or costing, or affect on the business side.
Sir Wyn Williams: Yes, but that’s generality. In this particular case, can you identify who they might be: are they departments of Fujitsu; are they the board of Fujitsu; are they the Post Office or what?
Peter Sewell: No, they would be working managers that formed the board of the CP board.
Sir Wyn Williams: Right, so all Fujitsu people?
Peter Sewell: Yes, yes, sir.
Sir Wyn Williams: All right, fine.
Mr Blake: Can we please look at FUJ00155371, please. We have there from Penny Thomas – 26 November 2008, she says:
“Attached: my précis with Alan’s comments.
“Plus a standard ARQ form.”
If we turn over the page, it is a document that we have looked at, although we haven’t looked at it with the various comments in it. Just to be clear, you are named on the first page as a required attendee of this meeting on 26 November 2008.
Could we please look at that first section, “The Audit System and ARQ … Service”. There is a reference there, in the second bullet point – it says as follows, it says:
“The completeness of the data extracts provided is assumed, and witness statements state as much.”
There’s a comment there from Mr Holmes. He says:
“It is more than ‘assumed’ or at least so we thought.
“The Riposte sequence numbers are checked for gaps and from this we assert that the extract shows a true and complete representation of what happened at branch.”
If we scroll down, please, under “Problem”, if we look at the fourth bullet point, it says:
“The statements currently asserted in Witness Statement cannot be guaranteed in all cases (after this [change proposal]) (See example on last page) …”
The words “example on” and we will see the word “reliably” are added in this document:
“… but this [change proposal] seeks to strengthen the process and allows to us reliably identify where the assertion can or cannot be made.”
So it was known at this stage, it seems, that there were concerns about not just a particular paragraph in a witness statement but in witness statements plural, because the words changed there are the words “example on”; do you see that?
Peter Sewell: Yes.
Mr Blake: Wasn’t that a serious issue, then, if the witness statements currently couldn’t be guaranteed, the accuracy of those witness statements couldn’t be guaranteed?
Peter Sewell: I don’t remember, I don’t remember.
Mr Blake: We’ve seen you tasked earlier with reviewing things such as witness statements. I think your evidence was you were named but it was people underneath you?
Peter Sewell: That was correct.
Mr Blake: But, as the named individual who was responsible for reviewing historic or previous witness statements, does that not cause you some concern at the time?
Peter Sewell: I didn’t review any witness statements.
Mr Blake: You were named as being responsible for the review of witness statements, as somebody who was named as responsible for the review of witness statements, does that cause you or did that cause you any concern?
Peter Sewell: At the time, I don’t remember it. I don’t remember it.
Mr Blake: Does that cause you concern now?
Peter Sewell: It’s too long ago for me to remember. I don’t remember.
Mr Blake: I didn’t ask you to remember, but the fact that there were witness statements that had been used that couldn’t be guaranteed, does that cause you some concern?
Peter Sewell: Today, yes, that sounds alarming.
Mr Blake: If we go over, please, to page 4, there’s the attachment of the standard witness statement. That’s a document that we’ve already seen but, if we scroll over – scroll down, over the page, into the next page, if we keep on going, please, into this next page – we see there the words that I started with today:
“The integrity of audit data is guaranteed at all times from its origination, storage and retrieval to subsequent despatch to the requester. Controls have been established that provide assurance to Post Office Internal Audit that integrity is maintained.”
Those aren’t actually the words I took you to letter, these are the words but they’ve been highlighted in red, presumably as some sort of concern, and you’ll see another significant passage that I have taken you to highlighted in red. That’s on page 10.
Those are the words:
“There is no reason to believe that the information in this statement is inaccurate because of the improper use of the computer. To the best of my knowledge and belief at all material times the computer was operating properly, or if not, any respect in which it was not operating properly, or was out of operation was not such as to effect the information held on it.”
That has been highlighted in red and is circulated prior to this meeting on 26 November 2008. Those are the same words that, as we saw, Gareth Jenkins expressed a concern about in relation to his use of those sentences. Do you recall having a concern about the use of that passage at this time?
Peter Sewell: I don’t recall, no.
Mr Blake: As somebody who was in charge of the team that was assisting with criminal prosecutions, do you think that it should be perhaps more prominent in your memory?
Peter Sewell: This is 15/16 years ago. No. Not for me.
Mr Blake: No, not given everything that’s happened with Horizon?
Peter Sewell: I haven’t seen some of these documents for many years.
Mr Blake: Don’t bring back any recollections at all?
Peter Sewell: No.
Mr Blake: Can we please now turn to FUJ00155373. We’re now in December 2008, 1 December, an email from Penny Thomas to yourself:
“Please find attached my weekly report.”
So it seems as though she is sharing with you a weekly report:
“As you will see, no work has been undertaken in the audit room this week. As a result the ARQ OLA may again be breached as a result of my absence from the office.”
So it seems as though she wasn’t in the office this week, but she says as follows:
“Also, as a result of Steve Evans and Alan Holmes note concerning the audit CP and the witness statement content I do not believe we should send any further standard witness statements until we have had the chance to discuss what was said last week and the implications. I currently have 3 outstanding.”
So she, at that stage, raises quite serious concerns about the content of witness statements arising from this issue.
Peter Sewell: Yes.
Mr Blake: This isn’t something that you recall?
Peter Sewell: I would think that’s got something to do with the manual exercise that was going on, the manual checking of events.
Mr Blake: It follows the meeting where the note is circulated about the audit CP and the witness statement with the red highlighting that we’ve just been looking at. It follows that being circulated. Was this not a matter that needed to be brought to the attention of very senior people within Fujitsu?
Peter Sewell: I don’t remember whether it did or not.
Mr Blake: That wasn’t a “remember” question; that was a question about whether it should or shouldn’t have been. The question is: given that Penny Thomas is expressing concern about witness statements that were being used in criminal proceedings and civil proceedings, should that not have been a matter to have raised at the very highest levels of your company?
Peter Sewell: I think the concern was with the witness statement and what it was saying.
Mr Blake: Yes, and my question was about whether it should have been raised at senior levels within your company?
Peter Sewell: I don’t recall.
Mr Blake: It’s not a recollection question; it’s a question about whether you now, looking at it now –
Peter Sewell: Well, now, yes.
Mr Blake: – think that it should have been raised.
Peter Sewell: Yes, I do.
Mr Blake: In terms of your recollection, do you remember whether that was or wasn’t raised?
Peter Sewell: I don’t recall.
Mr Blake: You’re being asked by the stenographer just to speak up slightly.
Peter Sewell: Sorry.
Mr Blake: If you could just repeat – I think he said, “I do not recall”.
Can we please bring up onto screen FUJ00155378, please. I’m going to start with the very bottom email, same day, 1 December 2008, from yourself to Howard Pritchard; can you remind us who Howard Pritchard was?
Peter Sewell: He was the Security Manager:
“Howard
“Some brief words …”
This is entitled “ARQ Service problem”:
“… the problem first raised in SI has been fully investigated by SI, Audit and SSC.
“The real problems I can see is the overhead in the event checking and Penny’s statement which contractually is now incorrect.”
You seem to describe there to Mr Pritchard that Penny’s statement is contractually incorrect. What do you mean by “contractually is now incorrect”?
Peter Sewell: I don’t remember. I don’t remember what that means.
Mr Blake: An incorrect witness statement is not simply a contractual problem, is it? It’s a more significant problem than that, isn’t it?
Peter Sewell: It’s probably relating to the wording.
Mr Blake: Yes.
Peter Sewell: Yeah.
Mr Blake: The use of incorrect wording, for example, in criminal proceedings, that would be a very serious matter indeed, isn’t it?
Peter Sewell: Yes.
Mr Blake: Why are you there describing it as, in effect, a contractual problem, rather than a real life problem affecting people’s lives?
Peter Sewell: Choice of words was probably wrong.
Mr Blake: It may be a choice of words but does it imply some degree of seriousness in that you didn’t see it as a serious problem affecting people’s lives; you saw it as more of a business problem, a contractual problem?
Peter Sewell: I think it was the words but I don’t remember it that well.
Mr Blake: If we could scroll up slightly, please, thank you, to that email above. Penny Thomas to yourself:
“Hi Pete
“Is the [change proposal] now in the system? It must be stressed that the current process for event checking is not an acceptable procedure.
“We need to consider what [to] do with regards to witness statements already provided, (1) where the case has not yet gone to court and (2) where the case has gone to court. The identification of ask (1) may well result in questions seeking the viability of (2).”
So she seems to raise a very serious concern there about witness statements having been provided already in court proceedings and, insofar as there are cases that haven’t gone to court, if it’s raised, that in itself could raise questions about cases that have already gone to court. Did you not see that as a serious issue to be dealt with?
Peter Sewell: I don’t recall. I don’t recall it.
Mr Blake: You don’t recall that?
Peter Sewell: No.
Mr Blake: Was it not significant enough in your memory to recall –
Peter Sewell: No.
Mr Blake: – a concern by the person who had been providing witness statements in court proceedings raising concerns about the accuracy of those statements?
Peter Sewell: Yes, I don’t remember what the action from it.
Mr Blake: Do you remember concerns? I mean, you had a very small team. Penny Thomas was somebody you managed. Do you not remember her expressing concerns to you about witness statements that she had provided?
Peter Sewell: Well, this – the CP says that, the –
Mr Blake: Yes, but do you not remember it? You were managing her, you were having team meetings, you were having feedback sessions, you had appraisals?
Peter Sewell: I don’t remember individual things. No, I don’t. I don’t.
Mr Blake: Could we please scroll up. Howard Pritchard, to you. I’m going to need you to interpret this particular email. He says:
“Pete.
“At the ISMR, the [change proposal] was discussed and it was agreed …”
Can you just assist us, what does ISMR …
Peter Sewell: I can’t remember.
Mr Blake: No?
Peter Sewell: I can’t remember.
Mr Blake: “… was discussed and it was agreed that the content will need to be rewritten as there are possible conflict … ie potential … This will be reject by the board.
“Please rewrite the [change proposal] and if required speak to Hilary to get further wording so that it can be accepted as soon.”
Can you please assist us with the language that is being used here? There seems to be some issue that he won’t perhaps commit to writing.
Peter Sewell: I don’t know. I don’t know. I don’t know.
Mr Blake: “The content will need to be rewritten as there are possible conflict … ie potential”: potential what?
Peter Sewell: I don’t know, sir.
Mr Blake: Did you email him back and say, “What are those dots? What do you mean by that?” He seems to assume that you know what he would be talking about there?
Peter Sewell: Mm. Well, I don’t.
Mr Blake: Was there something so bad that was unspeakable that couldn’t be put into writing?
Peter Sewell: Not that I was aware of, no.
Mr Blake: Can we please now look at FUJ00155385. We’re now on 11 December 2008, an email from Penny Thomas. You are a recipient of this email. “Proposed Slides for ARQ Service Issue”, and she says there:
“Please find attached proposed slides for presentation to Wendy.”
Can you assist us with who Wendy was?
Peter Sewell: Wendy was the director of the project.
Mr Blake: Now, we’re going to look at those slides in a moment. I’m just going to take you to a further email before we do that, and that is at FUJ00154833. Thank you. So those slides, the original slides having been circulated on 11 December, by the 15th they had been altered slightly. This email you’re included as well.
Peter Sewell: Yes.
Mr Blake: Now, it’s a little difficult to read this email because there are words that Penny Thomas has quoted from Graham Allen’s email below, and there is her response to those questions.
So starting with that first substantive paragraph, he says, Graham Allen says:
“Do we need to add the last point on slide 2 that although we know of no instance where we will not get an error which will indicate incompleteness, we cannot guarantee this.”
Her response is:
“Tivoli event data is known to be incomplete, viz turn off TECs during event storms, gaps in the events sequences generate by OMDB, there are occasional corrupt records within the events audit tracks.”
He then also asks:
“Do we need to add something about if we find a gap we do not know what to do about this? If we do say this we will need to say what we are doing to progress a solution to this or what the options are to tell [the Post Office] that we can’t provide data?”
She says, “Added to slide 5”, and we will come to look at slide 5 or the new slide 5.
Then he comments on slide 3:
“… I think the second point should say ‘prone to human error’. I’m presuming if we automated this the error indicated in this point would be removed.”
She says:
“It’s not just human error, the process is not secure. But yes, that is my belief, partially automating will remove this point.
“Slide 3, why does the [change proposal] not suggest full automation or does it to automate as much as possible in which case it should probably be worded like that?”
She says:
“We cannot fully automate, we will always need someone to check unfiltered errors.”
Then she attaches the amended presentation and says:
“Please let me know if I haven’t fully covered your comments, or if any others have been identified.”
I’d like to take you to the presentation, which is behind that, so if we just go over the page and onto page 3, please.
So there is a PowerPoint presentation. If we scroll up, please, it’s “Prosecution Support Urgent Issue”. Do you recall this PowerPoint presentation?
Peter Sewell: Yes, I think so.
Mr Blake: Do you recall that there was going to be this meeting with Wendy and that this was a presentation to be made to her?
Peter Sewell: Yes, I’m not sure I was at the meeting but, yes.
Mr Blake: If we scroll down, please, the first substantive slide, “ARQ service (Audit System)”, concerns being addressed here:
“The completeness of data was underwritten by our witness statement.
“Counter problems – PEAK [and it’s a reference to that PEAK we looked at] – ‘The fact that EPOSS code is not resilient to errors is endemic’.”
Peter Sewell: Mm-hm.
Mr Blake: It says:
“We are manually cross-checking with available event data but completeness is still not guaranteed.”
If we go over the page, please, “Manual and Proposed Process”:
“Manual process is onerous and must be reviewed.
“It is error prone …”
So we, again, see that phrase that was ultimately taken out of the change proposal.
Peter Sewell: Yes.
Mr Blake: “It is error prone and time consuming.
“It involves moving large volumes of data between the audit server and workstation.
“It requires local and insecure storage of event audit data, invalidating certain statements made within the current witness statement.”
If we go over the page please, “Immediate Issue – Witness Statements and Court Attendance”:
“Current standard witness statement is now incorrect – we guarantee completeness and integrity.”
Is your understanding of that that, in the pro forma witness statement that we’ve seen quite a lot of, Fujitsu or the author guarantees completeness and integrity of the data?
Mr Blake: Yes?
Peter Sewell: Yes.
Mr Blake: Over the page, please, “Associated Issues”:
“Historic and current data has proven to be incomplete.
“Ramifications of historical data provisions.
“Fujitsu reputation.”
Wasn’t this the moment to have a fundamental rethink of Fujitsu’s assistance in respect of prosecuting people based on Fujitsu data?
Peter Sewell: You’re asking me that question?
Mr Blake: Yes, you were the manager of the team that provided all these witness statements. We’re reading here a PowerPoint presentation that is prepared internally, which raises concerns about – in fact it says, “Current standard witness statement is now incorrect”. Knowledge – corporate knowledge – that the current standard witness statement was incorrect, was this not a time to have a real hard think about the way that Fujitsu went about its assistance to the Post Office?
Peter Sewell: I think it is now I look at it now, yes. At the time this went to senior management of the project.
Mr Blake: Is your evidence, then, that, yes, now, reflecting on this, that was the moment but, at the time, it wasn’t, didn’t seem to be as significant as it now seems? Or –
Peter Sewell: I don’t really remember my views on it, no.
Mr Blake: But if it was seen as significant, presumably you would remember?
Peter Sewell: No, it was a long time ago.
Mr Blake: So even something that led to or could be associated with the prosecution, conviction, imprisonment of a subpostmaster because of an incorrect witness statement, might that have been a significant event in your life?
Peter Sewell: It would have been and I didn’t realise it at the time.
Mr Blake: Can we please look at FUJ00155389. This is an email from Penny Thomas to you and others. She says:
“Anne’s comments need to be part of our discussion tomorrow.”
That’s comments of Anne Chambers. If we scroll down, we can see subject “New Witness Statement Request Support”, and Anne Chambers has provided some comments to Penny Thomas and to Gareth Jenkins, which are forwarded to you and others. She says as follows, she says:
“When such long periods are covered, especially at branches with many counters, there are almost certainly going to be some events which look alarming but are, as far as I’m concerned, not particularly unusual over the estate as a whole. We wouldn’t normally investigate them unless there were some grounds for thinking they had caused a problem – maybe because the [postmaster] queried something or something showed up on the reconciliation stream.”
Just pausing there, knowing that there was an issue that wouldn’t be recognised by the subpostmaster because there wasn’t an error message coming up on their screen, do you think that it is sufficient to rely on the postmaster to have identified a problem?
Peter Sewell: Not necessarily, if he didn’t know about it.
Mr Blake: Yes, and she continues to say:
“Trying to justify and assess them so long afterwards, without knowing what/when the problem was is not feasible. While I’m happy to help out with this in the short term, I think I’m being pulled much further into this than I should be. So someone is going to have to work out what Security’s approach to this is. In the meantime perhaps we should continue to check the lock events since those are the ones which [need to] have been proved to be associated with a financial problem in a handful of cases.”
Were you aware of concerns on the part of Anne Chambers in respect of what was being asked of her?
Peter Sewell: I wasn’t aware of this email, no.
Mr Blake: No. I mean, it was sent to you, if we look at the top, “Anne’s comments need to be part of our discussion tomorrow”. Do you recall any significant discussion?
Peter Sewell: I don’t, but there are a number of names on there.
Mr Blake: Can we look at FUJ00155394, and it’s the first page. It says as follows – it’s from you to – who is David Hinde?
Peter Sewell: I don’t remember.
Mr Blake: “David
“The slides were presented to Steve Denham on behalf of Wendy Wednesday afternoon. He is now aware of the problem and is going to talk with Legal. In the meantime we will be progressing with the [change proposal].”
So it seems as though Wendy wasn’t available or didn’t attend; do you recall what happened?
Peter Sewell: No.
Mr Blake: No?
Peter Sewell: No.
Mr Blake: Steve Denham received that PowerPoint presentation.
Peter Sewell: It looks like it. I think he was the Customer Services Director.
Mr Blake: Thank you. Can we, please, look now at FUJ00155399. I’m just going to take you to two documents before we break for lunch. We’ll go shortly after lunch but not too much over.
We’re now in January 2009 and Wendy Warham sends a message. If we look at the top email from Penny Thomas to Dave Posnett, she says:
“Please see note sent by my senior management this morning. We need to discuss urgently.”
If we scroll down, we can see this note. This is a note being sent from Wendy Warham to people at the Post Office, so to counterparts at the Post Office. Are you aware of any of those names at all?
Peter Sewell: Yes, yes.
Mr Blake: Penny Thomas appears to be concerned by the contents of this. She says as follows:
“Sue I have left you a voicemail as I need to update you on a recent issue that has occurred and been resolved but does have some short-term impacts. In summary the issue is as follows:
“In December 2007 an occurrence was reported in one office where a stock unit rollover coincided with the end of day process running. This led to a previously unseen database lock where an administrative balancing transaction failed to be written to the local message store database. This generated a generic and non-specific software error event which went unnoticed in the monitoring of events. A financial imbalance was evident and was subject to investigation by Fujitsu’s Service Support Centre and Post Office Limited. The financial imbalance has been resolved.
“A software correction was applied across the estate in early November 2008 to ensure that any such event generated would be monitored. Testing of that correction has established that the unmonitored error does not occur elsewhere in the system.”
Just pausing there, this seems to be a senior level email from Fujitsu to the Post Office informing them of the problem that we’ve been looking at for much of today.
Peter Sewell: Yes, sir.
Mr Blake: Yes? The event occurred in December 2007 but it’s taken until 7 January 2009 to provide that high level confirmation; do you agree with that?
Peter Sewell: Yes.
Mr Blake: Yes?
Peter Sewell: Yes.
Mr Blake: “Impact
“We need to work with the Post Office to recheck the ARQs and reconfirm the data integrity during the period of May 2007 to November 2008 – Penny will do this.”
Now, we are looking at a much shorter period. I think we discussed this earlier today: we were originally looking at a review of five and a half years worth of data but, by this stage, it seems as though the period for checking was May 2007 to November 2008?
Peter Sewell: Yes.
Mr Blake: “We need to discuss how we close the issue on the witness statements and we have some words which may be appropriate – Both need to discuss and agree the words.
“Identify which witness statement we have supplied and are still awaiting court to confirm whether or not the data provided was May 2007 to November 2008 to (a) ensure events have been checked and (b) to recall and replace witness statements …”
It says “POL/Penny”, so the Post Office or Penny seem to be tasked with that particular task?
Peter Sewell: Yes, they’d worked together on it, yes.
Mr Blake: “Further Action
“Automate the message store alerts on the system so that no manual intervention is required – A [change proposal] has been raised for this work.
“Education to ensure that this type of incident is raised as a major incident in the security stack so that we can communicate and manage this in accordance with incident timescales.
“Apologies that this has not been communicated earlier but the review of security incidents should improve this issue.”
The impression that’s given by this email is very much that it was a one-off incident from 2007; would you agree with that?
Peter Sewell: I would, yes.
Mr Blake: Yes. There’s no mention of, for example, Gerald Barnes’ concerns that we saw in that PEAK of wider problems with the coding, for example?
Peter Sewell: Yeah, I don’t understand Gerald Barnes’ level of detail.
Mr Blake: No, but there is no mention in this notification of wider concerns of issues that may affect subpostmasters without the subpostmasters realising, for example?
Peter Sewell: Yeah, I don’t really know. I think Wendy is talking about this particular issue.
Mr Blake: Focusing on the 2007 incident –
Peter Sewell: Yes, sir.
Mr Blake: – there’s no mention of the kinds of wider concerns that we have been discussing today.
Peter Sewell: Not in this, no.
Mr Blake: No. Why did Fujitsu hang onto it from 2007 to 2009 before having this high level discussion with the Post Office?
Peter Sewell: I think there was a fair period of time when nobody actually knew what the problem was and it took a fair bit of investigation to find it.
Mr Blake: Was it standard for Fujitsu to wait until they had worked out and come up with a solution to notify the Post Office, rather than keeping the Post Office abreast of what was going on throughout?
Peter Sewell: In this case, yes, this is what happened.
Mr Blake: Did you personally see it as important to protect the name of Fujitsu?
Peter Sewell: Not really. I think it was more a concern to find out what the problem was but –
Mr Blake: But your general approach to your work, did you see it as important to your work to protect the name of Fujitsu?
Peter Sewell: To protect the ARQ service.
Mr Blake: Not protect Fujitsu’s overall reputation?
Peter Sewell: I think it was more to find out what the problem was with the ARQ.
Mr Blake: But my question is, did you see it as important to your work to protect the name of Fujitsu?
Peter Sewell: I guess I did, but not purposely.
Mr Blake: Not?
Peter Sewell: Not purposely trying to protect Fujitsu’s name.
Mr Blake: What do you mean by that?
Peter Sewell: I was really concerned with finding out what the – where the error was and what it was and how we correct it.
Mr Blake: So it would be unfair to describe you as somebody who saw protecting Fujitsu as an important part of their job?
Peter Sewell: We all protect our own companies, yes.
Mr Blake: One final document before the break. If we go to FUJ00154750. We’re going back in time now to 2006 but this is an email from you to Andy Dunks –
Peter Sewell: Yeah.
Mr Blake: – and it relates to the Lee Castleton trial.
Peter Sewell: Yeah.
Mr Blake: That’s a case that we’ve seen a lot of in this Inquiry:
“See you in court then, Fetters Lane is where they used to hang people out to dry. I don’t suppose that type of thing happens any more though.
“That Castleton is a nasty chap and will be out to rubbish the [Fujitsu] name, it’s up to you to maintain absolute strength and integrity no matter what the prosecution will throw at you. WE will all be behind you hoping you come through unscathed. Bless You.”
Is that typical of your approach to the work you were doing?
Peter Sewell: No, no. I don’t know why that was written.
Mr Blake: Does that help explain some of the work that –
Peter Sewell: I don’t know why it was written.
Mr Blake: – we’ve seen today?
Peter Sewell: I don’t know why it was written. I don’t remember writing it but obviously I did. But certainly don’t understand it.
Mr Blake: Sir, might that be an appropriate moment to break for lunch? I don’t have that many questions. I have, I would say, ten minutes, ten to 15 minutes. There will be some questions from Core Participants.
The next witness won’t be longer than one hour, I am told, so we will finish comfortably today.
Sir Wyn Williams: All right. Very good, so we’ll begin again at, what, 2.00?
Mr Blake: 2.00.
Sir Wyn Williams: Yes, fine.
Mr Blake: Thank you very much.
(1.02 pm)
(The Short Adjournment)
(2.00 pm)
Mr Blake: Good afternoon, sir, can you see and hear me?
Sir Wyn Williams: Yes, I can, thank you.
Mr Blake: Thank you very much.
Can we start this afternoon with FUJ00155400. Thank you very much.
Mr Sewell, before the break, we were looking at the minutes of a meeting. I’m just going to turn back to those in my own bundle. So we were looking at an email that was sent from Wendy Warham to the Post Office on 7 January 2009.
Peter Sewell: Yes.
Mr Blake: We’re now on 8 January 2009 and, if we look at the bottom, it’s an email from Penny Thomas to Wendy Warham and Steve Denham, you’re copied in, and it says:
“Please see email trail.
“The Post Office clearly don’t want the specific details of this incident included in the witness statement.
“I will hold off providing the 4 outstanding statements until our review is complete.”
Then behind that we can see the discussion that has taken place. Perhaps we can start at the bottom of page 2 into page 3, please. So we have an email at the very bottom from Rob Wilson to – sorry, to Rob Wilson from Dave Posnett, and that says –
Peter Sewell: Other way round.
Mr Blake: Pardon?
Peter Sewell: The other way round, isn’t it?
Mr Blake: Yes, if we scroll down, it’s to Rob Wilson from Dave Posnett?
Peter Sewell: Yeah, okay.
Mr Blake: He says:
“In relation to the standard witness statement Fujitsu provide:
“1) The following addition has been inserted … This addition seems okay (it’s just another check that Fujitsu conduct – to ensure the ‘security incident’ doesn’t occur again).”
Then it quotes the proposed addition to the witness statement, that simply says:
“Windows Events generated by the counters within the branch/time frame in question are checked to ensure the counters were functioning correctly.”
Then it says as follows:
“The following additional paragraphs have been inserted … I personally do not see the need for these, if there are no problems identified with the data relating to the case in question. Why inform anyone about a problem we’ve had within the network, but possibly only at one branch, if it bears no relation or relevance.”
The proposed passages for insertion in the witness statement were as follows, they say:
“In December 2007 an occurrence was reported in one office where a stock unit rollover coincided with the end of day process running. This led to a previously unseen database lock where an administrative balancing transaction failed to be written to the local message store database. This generated a generic and non-specific software error event which went unnoticed in the monitoring of events. A financial imbalance was evident and was subject to investigation by Fujitsu’s Service Support Centre and Post Office Limited. The financial imbalance has been resolved.
“A software correction was applied across the estate in early November 2008 to ensure that any such event generated would be monitored. Testing of that correction has established that the unmonitored error does not occur elsewhere in the system.”
So that was the proposed form of words in the statement, which Mr Posnett was saying he didn’t consider the need for; is that your reading of that?
Peter Sewell: Yes. Yes, sir.
Mr Blake: It continues:
“Fujitsu have 4 statements outstanding and I’d be grateful if you could consider the above (ie should they include the above in statements from now on?). Happy to discuss if need be.”
The response is on the previous page, from Rob Wilson, the Head of Criminal Law at the Post Office. He says:
“Dave,
“Thanks for both of your emails. So far as the addition is concerned my view is that if we are sure that there are no incidents then there is nothing undermining that will need to be flagged up to the dense. The incident will have no relevance to our cases and as such could only lead to fishing expeditions if we added anything into the standard statement.”
If we look above, we have the email from Dave Posnett to Penny Thomas. He says:
“Penny,
“To note emails below.
“I would say Business As Usual regarding witness statements ie don’t include the two additional paragraphs on the last page.
“If any issues materialise in due course, we can address then – suggest the ARQs for these 4 cases are assessed first.”
Over the page, please, to the first page. We then have Penny Thomas emailing you that we’ve seen on the first page, saying that the Post Office don’t want the details included in the witness statement.
Was that something that you recall discussion taking place?
Peter Sewell: Well, I’ve read the paperwork and, obviously, I’ve picked up on it through reading the paperwork, yes.
Mr Blake: But it’s not something that stood out at the time?
Peter Sewell: No.
Mr Blake: If we look at FUJ00122604, we see the amendments to the statement that Penny Thomas proposed. If we go to page 7, please, we can see that’s the form of words that she was proposing that generated that email chain that we’ve just been looking at. It seems as though those proposals were rejected. Are you able to offer a view as to whether you think that they were even sufficient in themselves? In other words, referring only to the December 2007 occurrence, rather than the wider issues that we were discussing this morning.
Peter Sewell: I don’t know, really. They’re relevant to the Post Office, they issued that statement and the legal people absorbed it and said they’re okay with it.
Mr Blake: But, as somebody who was managing Penny Thomas, the author of this statement, we know that that wasn’t included but, even if it were included, do you think that would have adequately addressed all of the problems that we’ve been discussing today –
Peter Sewell: I don’t know.
Mr Blake: – the wider issues with, for example, subpostmasters not being aware of a potential problem that causes an imbalance?
Peter Sewell: Well, that particular problem was resolved.
Mr Blake: Yes, but do you think the potential for that to occur and the underlying code issues, for example, do you think those should have been brought to people’s attention, defendants in criminal proceedings?
Peter Sewell: Then or now?
Mr Blake: Do you think now they should have?
Peter Sewell: Maybe, yes.
Mr Blake: Yes. Reflecting on that, do you think that, even this proposed changed form of words would have been sufficient to have reflected those wider issues?
Peter Sewell: I don’t know, I think it’s – I really didn’t have an opinion at the time. I was happy to go with the flow that was generally released.
Mr Blake: Can we please look at FUJ00155402. On the same day – we’re sticking with the 8 January 2009 – there seems to have been another meeting. We have the bottom email from Penny Thomas, you’re a recipient, and she says:
“As a result of our meeting today the following actions have been agreed:
“We will event check all transaction data supplied to the Post Office where that data falls between May 2007 and November 2008.”
So there’s a narrow limitation in the time period for which the data is being selected.
Peter Sewell: That was the time, that was the – when the events were – potentially had an error in them. That’s when the correction was corrected in November, and was found in May.
Mr Blake: But you’ll recall from earlier this morning, discussion earlier on about looking at a much wider period –
Peter Sewell: I don’t know when that was stopped. Sorry, I –
Mr Blake: Yes, you don’t know when that was stopped but it seems January 2009, the decision is taken to only look at a narrow period of time.
Peter Sewell: Yes.
Mr Blake: “The check will focus on events where the CABSProcess has produced a lock from 1900 to 1910 local time.”
So, again, quite narrow in the time period also that they’re looking, not just by date but also by time of event?
Peter Sewell: It might have been because that was when the process – the end-of-day process was run.
Mr Blake: Absolutely. So it was only looking at that end-of-day process, rather than any other triggers for that event –
Peter Sewell: Yes.
Mr Blake: – or potential triggers?
Peter Sewell: Looks like it, yes.
Mr Blake: “Penny to provide a list of 195 outlets with time frame.
“Alan to provide query.
“Gerald to run event check through the database.
“Steve Denham is to be advised the number of residual events and will custody with Mik Peach.
“Residual events to be reviewed.
“Penny (or cover) will check ARQ data retained in the audit room or retrieve message stores as required.
“Pete to update security incident register.”
Is that “Pete” a reference to you?
Peter Sewell: I think it is, yes.
Mr Blake: Can you help us with what the security incident register was?
Peter Sewell: Really a spreadsheet with a record of incidents, security incidents.
Mr Blake: Now, our final document is FUJ00155421. This is an email that we saw yesterday. It’s 4 February 2009 from Penny Thomas to Dave Posnett at the Post Office. You are sent a copy of the email shortly after – in fact, the same minute as it’s sent, forwarded for your information. I’m just going to read that, it says:
“We are pleased to advise that our analysis covering 1 May 2007 to 30 November 2008 has been completed.
“The events logs have been checked for all data provided to [the Post Office] as a result of the 195 ARQs which fall within the time frame.”
So it seems as though they checked 195 ARQs?
Peter Sewell: Yes.
Mr Blake: “A total of 27 instances of concern were identified. All instances have been fully analysed and we can confirm that the locking was caused by contention between the [end-of-day] process and a Riposte checkpoint being written. No transactions or balancing activities carried out at the branches were affected.
“A [change proposal] has been raised to automate the event checking process and is being progressed.
“The standard witness statement has been reviewed, and is attached. No reference has been made to the locking issue but minor revisions have been made.”
So, in essence, the part that the Post Office earlier rejected in that email chain we saw wasn’t ultimately included?
Peter Sewell: Yes, looks like it, yes.
Mr Blake: “The 4 (now 3) outstanding witness statements will be provided as soon as possible.
“Please respond or call me if you have any questions.”
That seems to be the end of the matter, drawing to a close the issue that we’ve been looking at.
Peter Sewell: Yes, it does.
Mr Blake: Do you think that the issue was adequately addressed, in the sense that we heard from the beginning of today possibility for silent errors occurring that may affect transactions, that weren’t known to subpostmasters. Do you think that, as at 4 February 2009, sufficient had been done within Fujitsu?
Peter Sewell: At the time, yes.
Mr Blake: And now?
Peter Sewell: Maybe not.
Mr Blake: Maybe not?
Peter Sewell: Maybe not.
Mr Blake: Do you have any reflections on that?
Peter Sewell: No, not really, it’s such a long time ago for me.
Mr Blake: Thank you.
I only have one very brief topic raised by a Core Participant and that relates to paragraph 14 of your witness statement. Perhaps we can go to that, WITN09710100. It’s paragraph 14, page 5. Thank you. There’s just a reference there. It says that:
“I had contact with Sue Lowther, the Post Office Security Manager. I had detailed knowledge of the Horizon project, including the relevant people, their roles and where to find information, and so would attend security meetings between managers Bill Mitchell (later, Brian Pinder) in the [Post Office Account] Security Team and [it says] POL Security Team on a monthly basis to provide support.”
Are you able to assist us, was that the Post Office Security Team or was it the Post Office Investigations Team?
Peter Sewell: It was the Post Office Security Team.
Mr Blake: Who do you recall attending those meetings?
Peter Sewell: Sue Lowther, she was the Post Office Manager – Security Manager. I can’t remember anyone else.
Mr Blake: Thank you very much, Mr Sewell.
Sir, there are questions from Ms Patrick and Ms Page. I believe that is all.
I think we’re going to hear from Ms Page first.
Sir Wyn Williams: Thank you.
Questioned by Ms Page
Ms Page: Mr Sewell, I understand from your evidence earlier – and correct me if I’m wrong – that you say you were not aware that subpostmasters were saying that Horizon was causing balancing problems?
Peter Sewell: I was not aware.
Ms Page: Can we go, please, to POL00118221, it’s a long document, and if we could go to page 220, please. This document is dated 4 July 2003, and we can see that it’s to someone called Kevin Parkin and it’s from someone called Reg Barton but it’s copied to you, do you see that, Peter Sewell?
Peter Sewell: Yes, I do.
Ms Page: This relates to the case of Cleveleys –
Peter Sewell: Mm-hm.
Ms Page: – which this Inquiry has heard a bit about, and it says:
“I understand from Denise that POL have been raising some questions about Cleveleys SPSO, where I understand that the postmaster is in possession of (2?) sets of Horizon equipment dating back since 2001, which she maintains were responsible for poor balancing.”
If we go down a little bit, it says in the paragraph, which begins “I have”, which is towards the bottom of the screen:
“I have copied this to Peter Sewell, our Security Manager, for his awareness …”
Now, that tells us that right from 2003 you were aware of subpostmasters saying that Horizon equipment was responsible for problems with balancing.
Peter Sewell: That was 2003.
Ms Page: Well, that was just at the start, wasn’t it, and it carried on from there, didn’t it?
Peter Sewell: I wasn’t Security Manager either, 2003.
Ms Page: Well, it’s being sent to you as Security Manager, whether or not that was your correct title at that time, you were being put on notice, were you not, that a subpostmaster was complaining that Horizon equipment was causing misbalancing?
Peter Sewell: I can read it and it says that, yes. But I wasn’t – I don’t remember it. It was too long ago.
Ms Page: Thank you. That document can come down.
The Castleton email that was put on screen just before lunch, let’s consider a different aspect of it, please. You’ve been at pains to tell us that you were not involved in the technical detail of what your team did and, instead, you wished us to focus on the fact that you were their manager.
Peter Sewell: Right.
Ms Page: Team meetings, appraisals, that kind of thing.
Peter Sewell: Yes.
Ms Page: Now, providing witness statements was part of their job, wasn’t it, and you knew that?
Peter Sewell: Yes.
Ms Page: Therefore, giving evidence in court proceedings would potentially be part of their job, would it not?
Peter Sewell: Yes, when necessary, yes.
Ms Page: So it might be more rare and a more difficult part of their job but still something anticipated, expected, something you knew you would have to be responsible for managing them to do?
Peter Sewell: I guess so. I’m not sure I was that committed to it but I knew what they were doing. I knew where they were going.
Ms Page: All right. Well, let’s have a look at the email chain again, FUJ00154750. Your email to Mr Dunks:
“See you in Court then, Fetter Lane is where they used to have people out to dry. I don’t suppose that type of thing happens any more though.
“That Castleton is a nasty chap and will be out to rubbish the [FJ] name, it’s up to you to maintain absolutely strength and integrity no matter what the prosecution throw at you. WE will all be behind you hoping you come through unscathed. Bless You.”
Let’s just have a look at his reply as well, please:
“Thank you for those very kind and encouraging words, I had to pause halfway through reading it to wipe away a small tear …
“Bless you all …”
Thank you. That can come down. Was this your pep talk to your team member that you were managing before he had to go and give evidence?
Peter Sewell: No, it wasn’t a pep talk, no.
Ms Page: You’re saying, “Don’t worry, we’re all behind you”, aren’t you?
Peter Sewell: That’s what it says.
Ms Page: What you say to reassure him is “Don’t worry, he’s a nasty man”. How did you form that opinion, Mr Sewell?
Peter Sewell: I don’t know. I don’t know why I wrote it. I apologise.
Ms Page: What was being said within Fujitsu that allowed you to form the opinion that he was a nasty man?
Peter Sewell: Nothing, I don’t think.
Ms Page: Nothing?
Peter Sewell: Not aware of anything, no.
Ms Page: You made that up off the top of your head?
Peter Sewell: In a way, I think, yes.
Ms Page: Why would you do that, Mr Sewell?
Peter Sewell: I don’t know.
Ms Page: Is that the opinion that you formed of all subpostmasters who took issue with what Post Office said in the courts?
Peter Sewell: Absolutely not.
Ms Page: You were egging Mr Dunks on, weren’t you, urging him to go into battle with Mr Castleton, weren’t you?
Peter Sewell: I don’t know what it was written for now. I don’t know.
Ms Page: You will know by now that Mr Castleton was indeed hung out to dry.
Peter Sewell: I know a lot more about it now than I did. Yes.
Ms Page: Knowing what you know about him being hung out to dry, and the way that you urged Mr Dunks to go into battle with him, is that the right attitude for someone to take into court when they’re about to give evidence in a case with serious implications for someone?
Peter Sewell: No.
Ms Page: Yet that was the attitude that your management style and your email fostered and encouraged, isn’t it?
Peter Sewell: It suggests that way, yes. I didn’t – I don’t know why I wrote it.
Ms Page: Did you say similar things to Mr Dunks before he gave evidence against Seema Misra?
Peter Sewell: Absolutely not.
Ms Page: Why do you say “Absolutely not”?
Peter Sewell: I can’t even believe that that was written, so no.
Ms Page: Well, if you can’t believe you wrote that, and clearly you did, is it not entirely possible that you said similar things before he gave evidence against Mrs Misra?
Peter Sewell: No.
Ms Page: No?
Peter Sewell: I didn’t.
Ms Page: You didn’t?
Peter Sewell: I didn’t.
Ms Page: Why are we to believe that, Mr Sewell?
Peter Sewell: That’s what I’m saying to you.
Ms Page: The attitude towards subpostmasters that you encouraged in your team must have been one they carried into court whenever they gave evidence against subpostmasters; is that right?
Peter Sewell: I don’t believe so.
Ms Page: Thank you, Mr Sewell. Those are my questions.
Sir Wyn Williams: Thank you, Ms Page. Ms Patrick?
Questioned by Ms Patrick
Ms Patrick: Good afternoon, Mr Sewell.
Peter Sewell: Good afternoon.
Ms Patrick: My name is Ms Patrick, I ask questions for a number of subpostmasters who were convicted and have since had their convictions overturned.
Peter Sewell: Right.
Ms Patrick: I only want to ask you a few questions about one topic.
This morning you told the Inquiry that you’d had limited input into the substantive content of witness statements provided by Fujitsu employees, including those people you managed; is that right?
Peter Sewell: Yes.
Ms Patrick: Okay. I want to look at one document, FUJ00225644. If we could focus on the email at the bottom of the page on page 1, please. Can you see that there, Mr Sewell?
Peter Sewell: Yes.
Ms Patrick: We see that this is a message from Phil Budd, it’s dated 18 August 2009, and it concerns Porters Avenue Post Office. Now, Porters Avenue is a branch run that was run by Jerry Hosi, who is a subpostmaster that we represent. Mr Hosi was prosecuted and convicted and, in November 2010, he was sentenced to 21 months in prison. His conviction was overturned in October 2021, 11 years later. So that’s a little bit of context.
Now, if we read what Mr Budd is saying first, together:
“Morning Andy,
“That court case reared its head again a few weeks ago. You remember I analysed a couple of counters back in July ‘07 then you got me to sign a new witness statement in June ‘08, well they came back again and wanted me to sign another one – just a single paragraph to say that the counters were in ‘full working order and would not cause a discrepancy’. I was not happy with the implications of ‘full working order’ since I did not perform test transactions on the counters so I provided a new paragraph to reiterate my previous statement – that the files thereon were correct and that the counters should be expected to perform as required.
“The reason for my email, now the defence are hiring an expert to analyse the equipment I just wanted to make sure POA are not solely relying on my analysis – I assume we have supplied evidence of the transactions going through and the systems working correctly? I am just trying to reduce the stress I feel whenever this pops back into my head!”
So that’s what he is saying. Now, Phil Budd: do you recall who Phil Budd was?
Peter Sewell: No.
Ms Patrick: If we scroll back down on to page 2 of that document, we might be able to refresh your memory. If we look at the very top, we’ll see his email signature. There you go, Phil Budd, RMGA, Development Systems Engineer. Does that help?
Peter Sewell: No, don’t recall the name at all.
Ms Patrick: Okay, but in this message Mr Budd is expressing a reluctance about the evidence he’s given and will have to give in court, isn’t he?
Peter Sewell: Yes.
Ms Patrick: Right. Can we scroll back to the top of page 1, please. If we can highlight the top of page 1, I’d be grateful. We see here there’s a reply from you, isn’t there, Mr Sewell?
Peter Sewell: To Andy Dunks, yes.
Ms Patrick: It’s copied to Mr Budd, isn’t it?
Peter Sewell: Yes.
Ms Patrick: You say:
“Phil
“Your statement is fine and all you can actually say. If they stump up the cash the counter equipment can won’t [I think that might be ‘can’t’] be much use as the 42 days retainer of the message store is long gone, and will be endorsed by Gareth.
“Pete.”
You were signing off what Mr Budd had already said in evidence, weren’t you?
Peter Sewell: I was trying to reply to him.
Ms Patrick: You were giving him assurance that it was appropriate for him to go on and give evidence, weren’t you?
Peter Sewell: That’s all I knew, that the message store would run.
Ms Patrick: In fact, what you were doing was commenting on a line that was being taken by the defence in this case, weren’t you?
Peter Sewell: I don’t know about that.
Ms Patrick: Here, I think you were suggesting, in fact, that Mr Jenkins, if it was necessary, then he would be able to give evidence to provide a fuller picture; is that fair?
Peter Sewell: No, I think I was asking that Gareth would underline what I was saying, so I was correct.
Ms Patrick: That he would endorse –
Peter Sewell: What I was saying.
Ms Patrick: – what you were saying?
Peter Sewell: Yes.
Ms Patrick: Thank you. I don’t think I have any further questions for you, Mr Sewell.
Sir Wyn Williams: Is that it?
Mr Blake: That is, sir, yes.
Sir Wyn Williams: Well, thank you, Mr Sewell, for coming to give evidence today.
We’ve got one more witness, Mr Blake?
Mr Blake: We do, sir, yes, could we take our mid-afternoon break now, so 15 minutes, so that arrangements can be put in place for Ms Munro to take her place in the room.
So that will be 2.45.
Sir Wyn Williams: Certainly. All right. Thank you.
Mr Blake: Thank you very much.
(2.30 pm)
(A short break)
(2.45 pm)
Ms Price: Good afternoon, sir, can you see and hear us?
Sir Wyn Williams: Yes, thank you very much.
Ms Price: May we please call Ms Munro.
Sir Wyn Williams: Mm-hm.
Donna Munro
DONNA MARIA MUNRO (affirmed).
Questioned by Ms Price
Ms Price: Could you confirm your full name, please, Ms Munro?
Donna Munro: Yeah, Donna Maria Munro.
Ms Price: Thank you for coming to the Inquiry to assist it in its work. As you know, I will be asking you questions on behalf of the Inquiry.
You should have in front of you a hard copy of a witness statement in your name in a bundle at tab A1, and it is dated 29 December 2023; do you have that?
Donna Munro: I do.
Ms Price: If you could turn to page 12 of that, please. Do you have a copy with a visible signature?
Donna Munro: I do, yes.
Ms Price: Is that your signature?
Donna Munro: It is.
Ms Price: Are the contents of your statement true to the best of your knowledge and belief?
Donna Munro: They are.
Ms Price: For the purposes of the transcript, the reference for Ms Munro’s statement is WITN06850100. I will not be asking you about every aspect of the statement that you have provided, which will be published on the Inquiry’s website in due course, I will instead be asking about certain specific issues which are addressed in them?
Donna Munro: Okay.
Ms Price: Based on the documents you have seen, is it right that you think you must have started working for Fujitsu Services by at least December 2000?
Donna Munro: Yes, that’s correct.
Ms Price: Your first role with Fujitsu was as a technician in the Royal Mail Group Account Team at the Systems Management Centre; is that right?
Donna Munro: That’s correct.
Ms Price: You were part of the team that was responsible for monitoring the rollout of the Horizon system through the management of calls from Post Office branches in relation to the remote upgrades deployed to Horizon counters; is that right?
Donna Munro: That’s right.
Ms Price: That involved ensuring that Horizon counters in specific offices were deployed or rolled back on time?
Donna Munro: Yes.
Ms Price: You say at paragraph 6 of your statement that, if any issue arose, you would refer to a Known Error Log, the Software Support Centre or the Management Systems Support to resolve the issue?
Donna Munro: Yes.
Ms Price: Do you recall the kind of issues which were being reported to you at this time?
Donna Munro: I don’t recall the detail of the issues, no. Specifically, I remember when we were doing the rollouts that if we hadn’t got every counter in an office, with the software upgrade, it had to all be rolled back before their start of business day, the following morning, and then other – it was general event monitoring, so the events that are coming back from the counters, and things like that.
Ms Price: If you can just keep your voice up a little bit so the transcriber can hear you.
Donna Munro: Okay.
Ms Price: Is it right that you recall the architects of the Horizon system, Ian Bowen and Glenn Stephens, assisting with the team’s technical knowledge and understanding of the solutions used for issues raised?
Donna Munro: Yes. I’m not sure that they were specifically the architects of the Horizon system, but as part of it. So not the whole system.
Ms Price: I’m taking that wording from your statement: you mean that part of the system?
Donna Munro: That they were architects of the part of the system, not the whole system.
Ms Price: You became a Team Leader in the Systems Management Centre; is that right?
Donna Munro: That’s correct.
Ms Price: Then left the RMG Account Team to support different projects across the Fujitsu business?
Donna Munro: Yes.
Ms Price: In June 2009, you were offered the role of Security Operations Manager in Fujitsu’s Post Office Account Team; is that right?
Donna Munro: That’s correct.
Ms Price: You say at paragraph 9 of your statement that you did not have much experience within security at the start of your role, and you raised this with the Post Office Account Manager Peter Thompson; is that right?
Donna Munro: That’s correct.
Ms Price: He and the Chief Information Security Officer offered support throughout your role?
Donna Munro: They did, yes.
Ms Price: You say in your statement that the Chief Information Security Officer role was held by a number of individuals across the time you were with the Post Office Account, including Tom Lillywhite, Howard Pritchard and Brad Warren; is that right?
Donna Munro: Yes.
Ms Price: You say that on joining the Post Office Account your main focus was on gaining an understanding of how the teams worked?
Donna Munro: Yes, that’s correct.
Ms Price: You reviewed a number of services provided by the Security Team; is that right?
Donna Munro: I did.
Ms Price: That included reconciliation services; can you explain, please, what reconciliation services were?
Donna Munro: That’s where they take the reports from overnight where transactions haven’t settled correctly and they reconcile against the reports to – the different reports to which transactions were correct or incorrect and needed additional work.
Ms Price: Were you ever involved in the work of the reconciliation services team, as opposed to reviewing the service?
Donna Munro: No.
Ms Price: One aspect of the Security Team’s work was the Litigation Support Service, which was offered to the Post Office, wasn’t it?
Donna Munro: Correct.
Ms Price: You say at paragraph 13 of your statement that you were also responsible for the management of the Security Team, including sickness, leave, and performance monitoring and workload distributions?
Donna Munro: Correct.
Ms Price: You say at paragraph 14 of your statement that in your day-to-day work you reported directly to Peter Thompson; is that right?
Donna Munro: That’s correct.
Ms Price: You also maintained a working relationship with the CISO and would reach out to him with questions relating to the more technical and security matters of the work of the Security Team?
Donna Munro: Yes.
Ms Price: From 2012, your focus moved to supporting the Payment Card Industry Data Security Standards compliance programme; is that right?
Donna Munro: That’s correct.
Ms Price: Although you say you still had oversight of the Security Team at that time?
Donna Munro: Yes.
Ms Price: Is it right that you left Fujitsu in 2015?
Donna Munro: That’s correct.
Ms Price: When you were Security Operations Manager, you line managed Penny Thomas; is that right?
Donna Munro: That’s correct.
Ms Price: You describe her at paragraph 17 of your statement as the subject matter expert responsible for the management and carrying out of the extraction of audit data?
Donna Munro: Yes.
Ms Price: She was responsible for the provision of the Litigation Support Service and supported the Reconciliation Service; is that right?
Donna Munro: She did.
Ms Price: Penny Thomas was supported in this role by Andy Dunks, when you joined the Post Office Account; is that right?
Donna Munro: That’s correct.
Ms Price: Rajbinder Bains joined the team a few months later?
Donna Munro: She did, yes.
Ms Price: You say in your statement she was supported as and when necessary, that is Penny Thomas, by the Software Support Centre, including Anne Chambers, as well as by Gareth Jenkins; is that right?
Donna Munro: Yes.
Ms Price: You say at paragraph 21 of your statement that you believe Gareth Jenkins was a Senior Solution Architect for the Horizon system and you say he assisted Penny Thomas in understanding the ARQ data she retrieved as part of the Litigation Support Service; is that right?
Donna Munro: Correct.
Ms Price: You say you had fairly limited dealings with Gareth Jenkins and that you saw him on rare occasion, briefly saying hello around the office; is that right?
Donna Munro: That’s correct.
Ms Price: But your understanding, from these limited dealings, was that he was, on occasion, called as an expert witness in prosecutions conducted by the Post Office?
Donna Munro: Yes.
Ms Price: You say at paragraph 20 of your statement that it was Penny Thomas who provided training to Andy Dunks and Rajbinder Bains with training in all areas of the Litigation Support Service and Reconciliation Service; is that right?
Donna Munro: Yes.
Ms Price: The aim of this was that the Litigation Support Service and Reconciliation Service would continue to function, even if a member of the team was absent?
Donna Munro: Yes.
Ms Price: Do you mean by this that, absent Penny Thomas passing on her knowledge to others, the Litigation Support Service and Reconciliation Service would struggle to function?
Donna Munro: Sorry, can you reword that for me?
Ms Price: If Penny Thomas was the one who was not there, without her passing on her knowledge, is what you’re saying that those services would have struggled to function?
Donna Munro: Yes.
Ms Price: In terms of the work of the term extracting ARQ data, you deal with this at paragraph 25 of your statement. Could we have that on screen, please. It is page 8 of WITN06850100. Of the ARQ extraction work, you say this:
“At a high level, I was aware of the process the team carried out to extract ARQ data. The team worked in a secure room to access the audit servers via the audit workstation and would extract the ARQ requested by POL. If required, the team would produce a corresponding witness statement in respect of how the ARQ data was gathered. The team were responsible for providing the ARQ data and witness statements to POL. If required, they could also be asked to present this evidence at court. I understood that the extraction of ARQ data was a contractual requirement of Fujitsu’s relationship with POL.”
Is it right that you yourself did not have any role in the extraction of ARQ data?
Donna Munro: That’s correct.
Ms Price: You deal with your line management relationship with Penny Thomas at paragraph 19 of your statement. Could we have that on screen, please. It’s page 6. You say this:
“In the day-to-day performance of her role, Penny Thomas reported to the PO Account Manager and the CISO, rather than to me. As her line manager, I was copied into some of Penny Thomas’ email correspondence so that I could understand and manage the resourcing levels and capacity of the team. Penny Thomas also liaised directly with POL in the performance of her role as their direct point of contact for the Litigation Support Service. From memory and review of the documentation, Penny Thomas would occasionally copy me into email correspondence with POL, so that I had visibility of her capacity. Penny Thomas would only reach out to me for assistance in relation to the Litigation Support Service for things like arranging covering when she was away, as I managed the team workloads. I do not recall Penny Thomas raising concerns relating to the service itself, as these would normally be raised with the PO Account Manager or CISO. I did not offer subject matter support to the Litigation Support Service.”
You also say at paragraph 26 of your statement that you had no role in the provision of witness statements or the legal proceedings which followed the extraction of ARQ data.
Donna Munro: Correct.
Ms Price: Is it right that your evidence is that where issues related to litigation support needed to be escalated they were escalated to the Post Office Account Manager and the Chief Information Security Officer?
Donna Munro: That is correct.
Ms Price: Could we have on screen, please, FUJ00172047. This is an email chain from June 2010. If we can go, please, to page 5 of this document, we can see the first email in the chain, which is dated 23 June 2010. We may have different page numbering, by the looks of things. Page 5.
Apologies, that’s entirely my fault.
The reference, if we can try that again, is FUJ00097047. That’s it. We’ve got there. Towards the bottom.
That’s the page we’re after, the email at the bottom there from Penny Thomas, 23 June 2010. This is an email from Penny Thomas to Graham Welsh and to you, as well as Peter Thompson. It is copied to Gareth Jenkins and Alan Holmes. Peter Thompson, who you say was the Post Office Account manager at the time; is that right?
Donna Munro: That’s correct.
Ms Price: The subject is “Duplication of Transaction Records on ARQ Returns”, and Ms Thomas attaches an initial report on the problem. You say in your statement at paragraph 34 that this is when you were first notified of the issue; is that right?
Donna Munro: That’s correct.
Ms Price: You are a recipient of the next email in the chain as well, which appears on the previous page, page 4. That is also from Penny Thomas and provides an update to her note sent the day before. It provides some analysis showing that there were 112 ARQs affected by the issue in question, and there is a breakdown of that figure. Ms Thomas goes on to say that:
“Audit Development are currently working on a fix which is expected to be available Tuesday, 29 June.”
She then sets out a proposed explanation for the Post Office, which had been provided by Gareth Jenkins, and his proposed explanation was this:
“With Horizon counters, the mechanism by which data is audited has always worked on the principle that it is acceptable to audit the same data more than once – in particular if in doubt as to whether or not it has been previously audited successfully.
“The mechanism used on Horizon to retrieve the data took this into account and only presented one instance of such duplicate data in the ARQ extracts.
“However it has recently been noticed that the HNG-X retrieval mechanism does not remove such duplicates and a quick scan of the ARQs provided to Post Office Limited since the change to the new system indicates that about 35% of the ARQs might contain some duplicate data. A PEAK has been raised to remove such duplicate data in the future. However until the fix is developed, tested and deployed, there is a possibility that data is duplicated.
“The reliable way to identify a duplicate transaction is to use the NUM tribute that is used to generate the unique sequence numbers. Unfortunately, this attribute is not currently included in the Excel version of the ARQ data that has been passed to Post Office Limited in the past. This will be included in all future ARQs until the problem is fixed.
“Meanwhile all that can be done on existing ARQs is look for transactions that appear to be duplicates. Note that we have identified a scenario with Postal Services transactions where multiple identical mail items are accepted, ie the Quantity button is set to greater than 1, but postage labels are printed for each individual item. This results in separate transactions being generated for each item, which are identical in the ARQ extracts (there is another minor difference in the raw data apart from the NUM attribute, but this different attribute is not currently included in the ARQ extract).”
Do you recall this issue being raised with you now?
Donna Munro: Now I recall the issue, since I referred to the documentation, yes.
Ms Price: Could we have on screen, please, FUJ00097036. This is another email chain from June 2010. You are copied in to one email which forwards on to you two further emails. Could we go, please, to page 4 of the document. Here we have an email from Penny Thomas to Graham Welsh, which is copied to you. The email is dated 23 June 2010, and the subject is “Duplication of Transaction Records”.
In it, Ms Thomas asks whether Mr Welsh can spare a few minutes to discuss the issue. The first of the two emails forwarded to you is on page 5 of this document. Can we go over the page, please. It is an email from earlier in the day, on 23 June 2010, from Penny Thomas to Pat Lywood, who appears from the emails on the page before to have been a Service Implementation Manager; do you remember her now?
Donna Munro: Yes.
Ms Price: Ms Thomas says this:
“Hi Pat.
“We have a very significant problem which has been recorded in PEAK PC0200468. In a nutshell the HNG-X application is not removing duplicate transactions
(which may have been recorded twice on the audit server)
Ms Price: and they are appearing in the ARQ returns. For the old Horizon application Riposte automatically removed duplicate entries. An initial analysis shows that one third of all ARQ returns (since the new application has been in play) have duplicated transactions.
“Also we have a PEAK … which would highlight any duplication of records (this obviously isn’t happening now).”
The reply from Pat Lywood is on the previous page, page 4, please. Starting about halfway down that page:
“Penny,
“I will add to CS Prayers but your chances of getting it fixed before R2 is deployed is not good.
“Can I suggest that you explain the urgency to Graham and get him to raise it at management prayers?
“Can you also add a business impact to the PEAK using the Impact button?
“Adam.
“Please can you get your guys to take a look at this and let me know where the fix might be?
“Cheers
“Pat.”
So Ms Thomas – if we can scroll up, please, to the top of the page – was bringing you into the loop, copying you in here, in her email to Graham Welsh, sending on those two previous emails. This was potentially a very significant problem, wasn’t it?
Donna Munro: Yes.
Ms Price: On its face, there might be duplicate entries on ARQ spreadsheets which had been provided to the Post Office –
Donna Munro: Correct.
Ms Price: – and at least some of those ARQs were for use in court?
Donna Munro: I believe so.
Ms Price: Would you have discussed the substance of this issue with Ms Thomas?
Donna Munro: No.
Ms Price: Why not?
Donna Munro: Because she would have already taken it up to the relevant senior management.
Ms Price: Do you recall being concerned about this issue at the time?
Donna Munro: Yeah, I think we were all concerned about the issue, hence why Penny raised it as urgent. But I don’t recall any detail around the issue in depth.
Ms Price: Can we have on screen, please, FUJ00122903.
This is an email chain from July 2010. The top email is from Penny Thomas to you, among a number of other recipients, including Graham Welsh, Gareth Jenkins and Tom Lillywhite. Mr Lillywhite was, I think you have said, the Chief Information Security Officer.
Donna Munro: He was.
Ms Price: It is dated 7 July 2010. Ms Thomas says this, forwarding on the email chain below:
“Please see response from POL.
“The suggestion here is that Gareth completes all witness statements; this doesn’t fit into the current SLA; and really isn’t feasible, as far as I can see.”
Just pausing there, “SLA”, what does that stand for?
Donna Munro: Service Level Agreement.
Ms Price: “I attach a standard witness statement with modifications for duplicate transactions; which Gareth has already reviewed.
“Guy – I am not sure where you are working from today – could you fit in a conference call at any time today?
“Kind regards
“Penny.”
The email she was forwarding, scrolling down, please, was from Mark Dinsdale from the Post Office, 7 July 2010. It says this:
“Penny, as discussed our Legal Team in principle are happy with this and have agreed that if yourselves provide a witness statement covering your explanation below and additionally the following points then the workaround gets the green light.
“Juliet suggested the additional points to cover include, what are we doing about it, and over what period did this anomaly occur (ie upon migration to HNG-X). She also suggested that the witness statement be completed by Gareth Jenkins, your expert witness.”
Ms Thomas attached a standard witness statement, which had been modified for duplicate transactions, for the duplicate transactions issue. Do you recall there being a standard Fujitsu witness statement which was used by Litigation Support?
Donna Munro: I recall they had a template, yes.
Ms Price: Could we have on screen, please, the statement which was attached to Ms Thomas email, it is FUJ00122904. The statement is in the name of Penelope Anne Thomas. It is a standard statement, therefore undated. The introductory paragraph says this:
“I have been employed by Fujitsu Services, Post Office Account, formally ICL Pathway Limited since 20 January 2004 as an Information Technology Security Analyst responsible for audit data extractions and IT security. I have working knowledge of the computer system known as Horizon, which is a computerised accounting system used by Post Office Limited. I am authorised by Fujitsu Services to undertake extractions of audit archived data and to obtain information regarding system transactions recorded on the Horizon system.”
There then follows an overview of the Horizon system, scrolling down slowly, please, and going over two pages, to page 3., there is a paragraph dealing with audit information:
“An audit of all information handled by the TMS is taken daily by copying all new messages to archive media. This creates a record of all completed outlet transaction details including its origin – outlet and counter, when it happened, who caused it to happen and the outcome. The TMS journal is maintained at each of the Fujitsu Services Data Centre sites and is created by securely replicating all completed transaction records that occurred in every Outlet. They therefore provide the ability to compare the audit track record of the same transaction recorded in two places to verify that systems were operating correctly. Records of all transactions are written to audit archive media.”
We can see three new paragraphs, scrolling down a little, please, dealing with the duplicate transactions issue, which read as follows:
“With Horizon counters, the mechanism by which Data is audited has always worked on the principle that it is acceptable to audit the same data more than once – in particular if in doubt as to whether or not it has been previously audited successfully. The mechanism used on Horizon to retrieve the data took this into account and only presented one instance of such duplicate data in the ARQ extracts.
“In January 2010 a new HNG-X application was introduced to filter transaction records for presentation to Post Office Limited. It has recently been noticed that this HNG-X retrieval mechanism does not remove such duplicates. An enhancement to the extraction tool set will be developed, tested and deployed and will remove such duplicate data in the future. However until this enhancement is deployed there is a possibility that data is duplicated. The reliable way to identify a duplicate transaction is to use the NUM attribute that is used to generate the unique sequence numbers. This will be included in all future transaction record returns until the retrieval mechanism is enhanced. A semi-automated process to copy the returned data, and then to identify and remove any duplicated records which may be present from this copy by using the NUM attribute, has been agreed with Post Office Limited for use in the interim period.
“It is emphasised that the duplication of audited records has not, in any way, affected any actual physical transactions recorded on any counter at any outlet. The duplication of records has occurred during the auditing process when records were in the process of being recorded purely for audit purposes from the correspondence servers to the audit servers.”
Then going, please, to page 7 of this document. The penultimate paragraph on this page says this:
“There is no reason to believe that the information in this statement is inaccurate because of the improper use of the system. To the best of my knowledge and belief at all material times the system was operating properly, or if not, in any respect in which it was not operating properly, or was out of operation was not such as to effect the information held within it.”
This draft standard witness statement was circulated on 7 July 2010, as we’ve just seen from the relevant emails. Could we have on screen, please, FUJ00225719. Before we look through this document here, do you remember receiving and reading the draft statement circulated by Ms Thomas with that proposed wording?
Donna Munro: No, I don’t recall receiving or reading it.
Ms Price: Would you, having seen that email chain, have read the statement that was attached to the email which you were copied in to?
Donna Munro: I would if I was – if it was sent to me direct, not as a copy.
Ms Price: Starting about halfway down the page here is an email from Penny Thomas, dated 8 September 2010, to Andy Dunks, copied to you. The subject line is “Kirkoswald – ARQ P048-P058”, and it reads as follows:
“Andy
“As you know, these returns are reruns of work you have already completed; 3 out of the 12 of your returns complained duplicate transactions, all (48-59) need to be re-presented on one disc. They are due in court on 20 September; we have to get them to Salford and they, in turn, have to relay to the Investigator, so we need to get them in the post today.
“In order to get these out as quickly as possible I asked Raj to rerun them for you. If you really are unhappy to take ownership of the work she has completed on your behalf please could you rerun them yourself; Raj can show you the fast ARQ process which really is not onerous at all. You will then need to update your witness statement. The disc and statement need to be in the post today, please.
“Kind regards.
“Penny.
Going back to the start of this email chain, which is on page 2 of the document, this is an email dated 6 September 2010, from Ms Bains to Mr Dunks, copied to Penny Thomas. So you’re not copied on this email but to forwarded on to you. It says this:
“Hi Andy,
“Just spoken to Maureen and the data for Kirkoswald needs to be resent as this had duplicated data. I have re-ran the reports for you, so please can you check and get these sent to POL, also I understand that these also require the Witness Statements as well so please can you get this done as we will need to get this out ASAP as this will be going to court on 20 September.
“Also do you know where the PGP files were for the set of reports that you produced originally as they need to be copied over to the NAS and we cannot locate them on the D drive, could these be on your desktop?
“Many thanks.
“Raj.”
So it appears that an ARQ return that contained duplicated data in September 2010 – and Ms Bains was asking Mr Dunks to check it; is that a fair reading of that email?
Donna Munro: Yeah, she was asking him to check what she had retrieved and prepare it ready to be sent off, yes.
Ms Price: Going to the top of the page, please, there is an email from Ms Bains, which says this:
“Penny,
“Andy has checked the information on the disk but with regards to the witness statement mentioned that I would need to compile this as I have ran the retrievals off, please advise whether I would need to do this.”
Just scrolling up a little, we can see this email was sent on 7 September 2010. Going up further, a page, to the email you were copied in to, in that email that you’re copied in to, Ms Thomas was effectively saying it seems that it should be Mr Dunks who provided the witness statement and not Ms Bains –
Donna Munro: Correct.
Ms Price: – is that right? Why do you think you were copied into this email?
Donna Munro: Because I was the line manager of Mr Dunks and Raj.
Ms Price: So you were copied in, in respect of the allocation of the work or –
Donna Munro: The work.
Ms Price: For what reason?
Donna Munro: So if I recall correctly, it’s in the allocation of work to make sure that the work be done in the timescales, and also in concerns around Mr Dunks not wanting to pull off the work – do the work that was requested.
Ms Price: In general terms, is it right that it was either Ms Thomas or Mr Dunks who provided witness statements when were needed for court?
Donna Munro: That’s correct.
Ms Price: Could we have on screen, please, FUJ00154918. This is an email from Penny Thomas to Tom Lillywhite and to you, dated 4 August 2010. It simply says, “We are back in business!” and forwards on the email from Penny Thomas to Mark Dinsdale below. That’s Mark Dinsdale of the Post Office.
That email of 4th August says:
“Mark
“I am pleased to report that following the deployment of R2 we have re-retrieved a selection of transaction records where duplicate transactions were previously identified. These records have been checked and we can confirm duplicates are not now present.
“We will start retrieving records for ARQ requests and will do so in accordance with your priorities”.
Can you help with what Ms Thomas meant by being back in business.
Donna Munro: We stopped retrieving the ARQ requests while we were waiting for the fix to go in, for the duplicate transactions.
Ms Price: Could we have on screen, please, FUJ00122961. This is an email chain from September 2010. Starting with the email about halfway down the page, this is from Penny Thomas to Andy Dunks, and is dated 10 September 2010. The subject is “[Crown] v Wendy Buffrey. It says this:
“Andy,
“I have prepared a witness statement for you – PLEASE READ IT THROUGH TO MAKE SURE IT’S CORRECT [all in capitals]. It’s saved in your [Witness Statement] WS drive.
“I will also load to the transaction records for you.”
You were not copied in to this email but you were brought into the loop on this case earlier in the chain by Ms Thomas. We can see this over the page, please, the second email down, Penny Thomas to Andy Dunks copied to you, 10 September, and it says:
“Hi Andy
“See mail string. Could you please re-present the ARQs and provide a covering statement today? If so, I’ll confirm to POL.
“I’ll let you have a copy of my statement.”
Again, can you help with why you were being copied in?
Donna Munro: Just from a management perspective to awareness of what work Andy needed to do, so he wasn’t taken off to do something else.
Ms Price: We have the draft statement which Ms Thomas sent to Mr Dunks. Could we have that on screen, please. It’s FUJ00122958. On the face of the first page, it appears similar to the standard statement we looked at earlier, doesn’t it?
Donna Munro: It does.
Ms Price: But, looking through this statement – and if we can just scroll down page 1, and page 2 and to page 3, stopping there, please – we see the paragraph on archive media there and we don’t see the draft paragraphs which were in the July 2010 proposed statement that Penny Thomas was circulating; do you remember, the three paragraphs which were underlined in her July draft, relating to the duplicate transactions issue?
Obviously, events had moved on by this point but there doesn’t appear, does there, to be a reference here to that duplicate transactions issue having occurred; is that right?
Donna Munro: That’s correct.
Ms Price: Just scrolling down, if you need to, to look. Then, at the bottom of page 3, we have:
“When information relating to individual transactions is requested, the data is extracted from the audit archive media via the audit workstations. Information is presented in exactly the same way as the data held in the archive although it can be filtered depending on the type of information requested. The integrity of data retrieved for audit purposes is guaranteed at all times from the point of gathering, storage and retrieval, to subsequent dispatch to the requester. Controls have been established that provide assurances to Post Office Internal Audit that this integrity is maintained.”
Going over the page, please. Then:
“During audit data extractions the following controls apply …”
Then there are number of controls that are listed there. There is no mention in that paragraph, either, of any past issues with duplication of transactions in the ARQ data, is there?
Donna Munro: No.
Ms Price: Going over to page 5, the ARQs in the specific case are addressed, scrolling down. Then over the page to page 6, please. Going down to the bottom, please, the penultimate paragraph, we have the paragraph:
“There is no reason to believe that the system in this statement is inaccurate because of the improper use of the system. To the best of my knowledge and belief at all material times the system was operating properly, or if not, any respect in which it was not operating properly, or was out of operation was not such as to effect the information held within it.”
Were you aware at the time that the form of words addressing duplicate transactions had not been included in any form in the standard statement in September 2010?
Donna Munro: No, I wasn’t.
Ms Price: Had you been aware, do you think you might have queried it?
Donna Munro: I think I’d have queried why we’d removed it, yes.
Ms Price: Were you aware that a paragraph had been, and continued to be, included in the standard form statement saying there was no reason to believe that the information in the statement was inaccurate because of the improper use of the system and that, at all material times, the system was operating properly, or the rest of that sentence?
Donna Munro: My understanding was that that statement is in regards to the audit workstations where they retrieved the data from, rather than the integrity of the Horizon system itself.
Ms Price: I see. Given what you knew at the time about the duplicate transactions issue, would you have had any concern with the paragraph that we’ve just read out at all, or not, for the reason you’ve just said?
Donna Munro: I wouldn’t, for the reason I’ve just said. Because I believe that was related to the workstations that they – how they pulled the data off rather than the Horizon system itself.
Ms Price: That can come down, thank you. There is one further topic I would like to ask you about could we have on screen, please, POL00028838. These are notes from a meeting in 2010, which was held to discuss a bug called the receipts and payments mismatch bug. Gareth Jenkins and John Simpkins are listed as being in attendance. First of all, were you ever told about this issue: the receipts and payments matters match issue?
Donna Munro: No.
Ms Price: The issue is addressed under the heading “What is the issue?”:
“Discrepancies showing at the Horizon counter disappear when the branch follows certain process steps, but will still show within the back end branch account. This is currently impacting circa 40 branches since migration on to Horizon Online, with an overall cash value of circa £20,000 loss. This issue will only occur if a branch cancels the completion of the trading period but within the same session continues to roll into a new balance period.
“At this time we have not communicated with branches affected and we do not believe they are exploiting this bug intentionally.
“The problem occurs as part of the process when moving discrepancies on the Horizon system into local suspense.”
Having looked at that description again, do you recall any knowledge of that issue arising?
Donna Munro: I have no knowledge of that issue whatsoever.
Ms Price: You have seen an example of the pro forma statement being submitted in support of the criminal cases in court in September 2010, the one we’ve just looked at. Does it concern you at all that, in the same year, this bug was known about by Fujitsu and yet statements were being submitted to the court saying that at all material times the system was operating properly?
Donna Munro: Yes, it does.
Ms Price: When you looked at that paragraph before, you said you took that to be referring to the audit workstations?
Donna Munro: Yes.
Ms Price: So just revisiting that, do you think that paragraph could have been read more widely as referring to the Horizon system operating properly?
Donna Munro: I think it could have been worded better, yes, to what the – that paragraph is actually in relation to.
Ms Price: Because, on its face, it was saying the system was operating properly –
Donna Munro: Yes.
Ms Price: – and, looking at this, does this cause you concern, knowing that was in the witness statement?
Donna Munro: Yes.
Ms Price: Going, please, to page 3 of this document, the solutions being considered were set out. Looking at solution 1, please:
“… Alter the Horizon branch figure at the counter to show the discrepancy. Fujitsu would have to manually write an entry value to the local branch account.
“Impact – When the branch comes to complete next trading period they would have a discrepancy, which they would have to bring to account.
“Risk – This has significant data integrity concerns and could lead to questions of ‘tampering’ with the branch system and could generate questions around how the discrepancy was caused. This solution could have moral implications of Post Office changing branch data without informing the branch.”
When you were Security Operations Manager, were you aware that the Software Support Centre had remote access to the Horizon system, that they could remotely access the counter in a branch and alter the values?
Donna Munro: I was aware they had remote access. I wasn’t aware that they had the ability to amend any data in there.
Ms Price: Had you been aware, would this have been a cause for concern for you?
Donna Munro: Yes, because you shouldn’t be able to manipulate data.
Ms Price: Sir, those are all the questions I have for Ms Munro. Shall I turn to Core Participants or was there anything you wished to ask at this stage?
Sir Wyn Williams: No, let any Core Participant’s representative ask any questions.
Ms Price: Mr Jacobs has a question.
Questioned by Mr Jacobs
Mr Jacobs: Thank you.
I have a very brief follow-up question. You were asked about the receipts and payments mismatch issue notes, there was a meeting and present at that meeting was Gareth Jenkins; is that right, do you recall?
Donna Munro: I don’t recall.
Mr Jacobs: Okay do you need to see the document?
Donna Munro: Yes, please.
Mr Jacobs: It is POL00028838. Right at the top, do you see his name there?
Donna Munro: Yes.
Mr Jacobs: At paragraph 21 of your statement – you’ve already confirmed in your statement and your evidence that you were Penny Thomas’ line manager?
Donna Munro: That’s correct.
Mr Jacobs: At paragraph 21 of your statement, you say:
“I believe Gareth Jenkins was the Senior Solution Architect for the Horizon system. He assisted Penny Thomas in understanding the ARQ data she retrieved as part of the Litigation Support Service”, and you say you believe he was, on occasion, called as expert witness.
Donna Munro: That’s correct.
Mr Jacobs: You’ve been taken to statements that Mr Dunks gave in relation to that standard paragraph, and –
Donna Munro: Correct.
Mr Jacobs: – you’re aware that Penny Thomas gave similar statements as well, are you?
Donna Munro: Yes.
Mr Jacobs: So you said in your evidence today that you weren’t aware of this receipts and payments mismatch issue?
Donna Munro: No.
Mr Jacobs: We can see from the document that it affected, I think, up to 40 branches. Was Mr Jenkins part of the wider team then? He was assisting Penny Thomas, who you line managed; that’s right, isn’t it?
Donna Munro: Yes.
Mr Jacobs: So – and you may not be able to answer this – it’s likely, isn’t it, do you think, that if Gareth Jenkins was present at this meeting, that when Ms Thomas gave witness statements using that standard paragraph in 2010, that she would have known about this, because Mr Jenkins was assisting her?
Donna Munro: I can’t answer that because I wouldn’t know what Gareth and Penny discussed. He assisted her with the different witness statements and the data, whether they discussed these issues, I wouldn’t know. Sorry.
Mr Jacobs: Do you accept that Ms Thomas in 2010 gave statements using those generic words about the Fujitsu system operating properly?
Donna Munro: Yes, they’re the standard template.
Mr Jacobs: Do you think, as her line manager, you ought to have known about these potential difficulties when Ms Thomas was using that paragraph, effectively giving Horizon a clean bill of health in criminal prosecutions of subpostmasters?
Donna Munro: I think because we’d got – Penny discussed most of her issues or concerns or questions around the systems and that service with the CISO and the Account Manager, then it was already at an escalated level. So I couldn’t actually add any value in that way, so I think it was taken to that higher level rather – because of the service that it’s providing.
Mr Jacobs: Okay, we’re just trying to understand the structure. So you were her line manager?
Donna Munro: Yes.
Mr Jacobs: But, in relation to the evidence that she gave and perhaps the veracity of the evidence that she gave, there was someone else who she was reporting to; is that right?
Donna Munro: Yes, so she liaised closely with both the Account Manager and the CISO.
Mr Jacobs: A general question – and you may or may not be able to answer this – but, having seen this and having been taken to the documents that you’ve been taken to today, do you consider that subpostmasters were being prosecuted in circumstances where the Post Office, with Fujitsu’s assistance, was misrepresenting the robustness and integrity of the Horizon system?
Donna Munro: Based on what I’ve seen and read today, I would say yes.
Mr Jacobs: Well, I don’t have any more questions for you. Thank you very much.
Ms Price: Sir, there’s a question from Ms Patrick.
Sir Wyn Williams: Yes.
Questioned by Ms Patrick
Ms Patrick: Good afternoon, Ms Munro. My name is Ms Patrick. I represent, with Mr Moloney, a number of subpostmasters who were prosecuted and convicted and who since have had their convictions overturned.
I have one set of questions about one document, so I hope we’ll be quite quick.
The document is FUJ00156518. If we can go to the bottom of page 1, we can see – ah, can you see that? That’s been highlighted there, I think. There’s an email there which starts – it’s in January 2012, from Graham Brander to Penny Thomas and Andy Dunks. It says, “Penny/Andy”, and there’s a little back and forth but, essentially, it’s a message about attending trial.
If we can scroll up a little, you see that:
“Andy; can you confirm that if required, you are able to covering Penny’s evidence in case she is unable to attend.”
If we can scroll up a little please, we see the second message and we see:
“Hi Graham
“Thanks for the update.
“As far as standing in for Penny, I do not think my knowledge is good enough to be able to do this to the level that Penny could answer [the] questions. I would not be comfortable to do it.”
If we scroll up again, we see the next message. We see this is where you’re copied in. Can you see that, Ms Munro?
Donna Munro: Mm-hm.
Ms Patrick: Ms Thomas copies the message to you and says:
“Donna
“It would appear you have a gaping hole as far as prosecution support is concerned; Andy being uncomfortable to support a basic statement and Raj not being prepared to submit one.”
Now, looking at this, Ms Thomas is writing to you for your input, isn’t she?
Donna Munro: Yes.
Ms Patrick: It appears your input is needed, not just for matters of cover but she’s raising a substantive issue about what evidence the members of your team are qualified to give; is that fair?
Donna Munro: It’s not right in what they’re qualified to give; it’s what they’re comfortable to give.
Ms Patrick: Indeed, and that there appears to be a hole in your team, in terms of the prosecution support you’re able to provide; is that fair?
Donna Munro: From what we read in here, that could be assumed, yes.
Ms Patrick: So she’s raising a gaping hole and is that not an important gaping hole in prosecution support?
Donna Munro: Yes.
Ms Patrick: What did you consider her intent to be when she was raising that with you?
Donna Munro: She’s bringing to light that individuals aren’t happy to do the role that they’ve been employed to do.
Ms Patrick: Why would she be raising that with you? What did she want you to do?
Donna Munro: Discuss with the individuals.
Ms Patrick: Okay. Now, I’m going to – I won’t bring the document up, I’ve got a piece taken here from what Ms Sangha says in her witness statement. She said to the Inquiry:
“I can see that in around September 2010 I was asked to provide a witness statement in relation to an ARQ request that I actioned.”
So separate occasion, but she’s asked to provide evidence. She says:
“Although I cannot recall if it was in relation to this ARQ request, I can recall speaking with Ms Munro and agreeing that all witness statement requests would be actioned by Ms Thomas and Mr Dunks as they had more experience and knowledge of Horizon.”
Now, if we can look at this, if, as she suggests, you agreed that all witness statements should be actioned by Ms Thomas and Mr Dunks, does that not suggest that you had a more active management role in Litigation Support than your statement perhaps would have suggested?
Donna Munro: No, I managed the team and their workloads.
Ms Patrick: Okay.
I have no further questions for you, Ms Munro.
Sir Wyn Williams: Is that it, Ms Price?
Ms Price: Yes, sir, it is.
Sir Wyn Williams: All right.
Well, thank you very much, Mrs Munro, for providing a witness statement and coming to give evidence.
That concludes today’s proceedings, I believe, Ms Price?
Ms Price: Yes, sir.
Sir Wyn Williams: I hope that those Core Participants who were present have found at least some of the evidence informative.
I think we have Mr Patterson tomorrow, do we not?
Ms Price: That is correct, sir.
Sir Wyn Williams: All right, 10.00 tomorrow morning.
Ms Price: Thank you.
(3.46 pm)
(The hearing adjourned until 10.00 am the following day)