IAN
$SSLO000103
SSL0000103
Conf call with SB and IRH re Bracknell
HENDERSON: ... person nominally responsible for, you
know, the Bracknell function for the last sort of
couple of years, you know, that may have some, you
know, sort of consequences, and I think what we
wanted to do was to protect you from that, you know,
so that, you know, if there was, you know, an
investigation or any issues, you know, coming from
it, you were not contaminated, you know, with stuff
that -- that we've been dealing with.
Now, that, I understand, was the sort of
thinking that Susan had, and I mean, frankly nothing
has changed other than, you know, it looks like
there are legitimate sort of, you know, issues to --
to look at, which in my view reinforces the need to
keep you, sort of, protected from it.
But --
SIMON: Well, what do you -- it's your -- I mean, I'm --
IAN
I will take your judgment on this. I mean, I'm just
worried that it's not getting the focus it needs.
I feel like I should take ownership of it.
I guess Leslie, my boss's view, is that I'm kind
of compromised anyway, because I work in IT, and
this is essentially a -- the whole investigation
(unclear) has been about Horizon, which is an IT
thing.
HENDERSON: I think this a bit more, Simon. I mean,
you know, a potential criticism, you know, could be
lack of, sort of, supervision, lack of monitoring,
lack of control environment and so on, specifically
in relation to Bracknell. Now, that is much more
specific than, you know, general, sort of, you know,
defects in Horizon or -- or whatever, and that's
$SSLO000103
SSL0000103
why -- you know, maybe out of an excess of caution
I still think you should not be directly, sort of,
involved in it and you should not be, sort of, you
know, asking questions about it and you should not
be receiving information about it.
But, as I say, that might be an excess of
caution. At the end of the day it's a judgment call
that needs to be made not by you but by POL senior
management, including input from Susan or, frankly,
external legal advice. And if Susan's not
available, maybe you want to bounce it off, you
know, either one of the other lawyers or even an
external lawyer.
SIMON: Okay, I'll tell you then -- what I'm going to do
IAN
then -- also, if there's a -- I have to protect
myself as well, don't I, so --
HENDERSON: Yes.
SIMON: So I think what I'll do then is I'm quite happy
IAN
RON
to have an off-the-record conversation, because
I am, sort of, pursuing this just for my own agenda,
because I am a little bit concerned, from what I've
already heard, which I -- I'm sure I can do in sort
of unofficial capacity, and I will have
a conversation with Susan when she gets back about
what -- where she wants to take this. But -- so
what things, sort of, were you -- so --
HENDERSON: Sorry to interrupt, Simon, the other
thing you might want to do -- you know Rodric, who
did the drafting on the JFSA agreement, I mean,
I was very impressed by him. You might want to have
a quiet word with him and just give him the facts
and the thinking that I've outlined. If he wants to
talk to me I'm more than happy to do that but I --
you know, in terms of just getting some informal
advice quickly, I would have thought Rodric was as
good a person to talk to as anyone.
WARMINGTON: Yes, good suggestion. He came across
well, didn't he?
IAN
$SSLO000103
SSL0000103
HENDERSON: Yeah.
SIMON: In terms of this specific issue, I know you've
IAN
got an email. Is there anything else?
HENDERSON: The short answer is it's a bit early to
say. It's more than one email. I mean, we've got
one very specific email that refers to concerns by
PNBA. We've got, sort of, other emails that talk
about the Bracknell function, accessing live data,
making changes to the system, not in real time but
some -- and I don't know what the -- you know, the
method is, but it says something, from memory, along
the lines of "Oh, and this will be corrected
overnight" or "We'll make these adjustments in the
overnight run". So it again suggests some sort
of -- you know, it may well be sort of journal
capacity or some direct access to what is live data
but not in real time, in other words, some sort of
batch process that runs overnight.
SIMON: Okay.
IAN
HENDERSON: And we have got multiple emails sort of
relating to that. But that is based on a very
limited set of data. I don't know if you were aware
but the IT people had various sort of technical
issues getting the emails extracted. We got them
for some users, we didn't get them for others. The
ones that were extracted there were some technical
problems getting them to me and they had to
basically sort of redo the whole exercise and that
was a further delay, and I'm now processing the
second batch of emails. So we've only looked at
about 40 per cent of the stuff that is available.
SIMON: Okay.
So just to bring you up to speed where I am,
I did ask Fujitsu to (unclear) come clean, and
apparently there is a process where -- so there is a
technical avenue where you can technically do some
form of adjustment, you know, and -- but apparently
IAN
RON
$SSLO000103
SSL0000103
it's very carefully monitored, controlled, audited
stuff -- type stuff.
Now, I don't -- what -- the impression I've got
was it would -- it would have records, it wouldn't
change records. So I'm going to challenge Rob this
afternoon on that. Because I would have thought the
only person that would be aware of it from a --
sorry, the person who would have to sign it off
I would have thought, would be our finance centre.
HENDERSON: Well, but the impression I get from
looking at the emails is, whilst if -- you know, in
theory, there might be those, sort of, you know,
controls and so on, that, you know, they're the sort
of controls that are in a procedures manual.
There's actually -- there's no electronic block, if
I can put it that way. In other words, you know, if
somebody in Bracknell had a brainstorm and wanted to
do something, they could just do it. What the
control environment says is you need to be approved
by, you know, XYZ, but, as I say, there's not an
electronic block and there's nothing to stop them,
as I understand it, doing whatever the capabilities
are without that approval.
WARMINGTON: Yeah, we sometimes refer to them as
controls for those who wish to obey them.
MR MOLONEY: Yeah, so if you're a superuser, then you've
RON
IAN
got access to everything and I imagine there must be
a superuser account somewhere, because every system
would have one.
WARMINGTON: Well, not just that. Not -- I mean --
and superuser is always an issue everywhere, but if
you've got an authorised user of that functionality
who then somehow either abuses that under his own
allocated ID or is able -- this infers a superuser
power -- to create a new ID, then the user manual
might as well be thrown out the window.
HENDERSON: Yeah, but then again, Ron, I think that's
all speculation. I think we ought to stick to
facts. But, you know, what I'm seeing in the emails
is they seem to have either the capability that was
alleged or something pretty bloody close to it. It
seems to have been used on multiple occasions. It
seems to be used, on some occasions, following
a request from the Helpdesk to do some correction or
to make some adjustment that they've been unable to
do using what I might call "normal processes". You
know, what we have not got any understanding of is
the actual let's call it physical control
environment rather than the -- sort of, the
procedures manual.
SIMON: So I've been reassured there is an audit table
of -- of this, a specific audit table (unclear) and
I've been told it's a very -- it's used very rarely.
Would it be appropriate for me to ask for that audit
table?
IAN HENDERSON: Yeah, I think so. I mean, one thing that
I was planning to do when I've finished going
through all the emails, we have identified some very
specific dates and times and, indeed, branches where
this capability is -- you know, is alleged to have
been used -- and, sorry, this has come from emails,
not the JFSA -- and what I was going to do was to
request Horizon data for those branches for those
very specific time periods and use that to drill
into that to see how the Bracknell changes manifest
themselves, whether they are shown as, you know,
a system adjustment, a journal, you know, adjustment
or whatever, or whether they are linked -- and this
would be the nightmare scenario -- whether they are
linked to an SPMR's ID.
SIMON: Yes, that would be a nightmare. The other
factor for me is, was the subpostmaster informed?
RON WARMINGTON: Yes.
IAN HENDERSON: Sorry, Ron, when you say yes, is that the
yes, the postmaster was informed?
RON WARMINGTON: No, it isn't. It is: yes, I concur that
$SSLO000103
SSL0000103
that is a valid question to ask.
IAN HENDERSON: Yeah. And based on the email traffic
that I've seen, there's nothing to indicate that he
or she was informed, other than perhaps a call to
the Helpdesk or something like that.
RON WARMINGTON: They may be referring to this as the
fast track process, Ian. You've seen that in one of
the emails. I've got one up on the screen that
moment.
IAN HENDERSON: Again, I'm interpreting that as meaning
this needs to be resolved, sort of, urgently. We're
going to Bracknell because you guys can do it more
quickly than maybe going through the official route,
if I can put it that way.
RON WARMINGTON: Yes, yes, true.
SIMON: (unclear). Okay.
Okay, so I'm going to take your advice. I'm not
going to pick up SRO5. I am going to, sort of,
continue to dig around, I think, just for my own
(unclear) and for my own benefit, and also I think I
want to keep Alwyn and Susan informed of what I've
come up with, because for them before (unclear) you
know, of what's going on. Because they are not
aware of any of this by the way.
IAN HENDERSON: Okay.
SIMON: Because I've told them I've just found out from
Fujitsu there is a mechanism, and their faces
dropped.
IAN HENDERSON: And by the way, I mean, one of the key
emails, you know, has Gareth Jenkins' name all over
it. So it was absolutely clear that this was
a widely understood capability within the system.
SIMON: Well, Gareth did -- Gareth is the one that told
me yesterday, and he didn't make any effort to hide
$SSLO000103
SSL0000103
$SSLO000103
SSL0000103
it.
IAN HENDERSON: No, I'm not surprised. Gareth has always
struck me as, you know, straight as a die.
RON WARMINGTON: Yeah.
IAN HENDERSON: And, you know, I'm very happy to sort of
deal with him. So what you've identified is pretty
much what we found going through the emails, or
certainly one aspect of them.
SIMON: Okay. So I'm going to ask for that audit log
because I'm really getting bored of this, and I need
to find out what that process is.
So I'm seeing Rod Ismay --
RON WARMINGTON: What is relevant is if we have, as we
understand, got a call with Paula and others today,
it would not be wise, I think, for us to be the ones
that -- the one that informs her of this.
You know, I think she's got to be -- I would say
you've got to decide whether you want her to know
about this before the Arbuthnot meeting, and if she
does know about it before the Arbuthnot meeting
you've got to make the decision whether she tells
him about it. And he'd probably completely hold
back on the grounds that it's still being
researched.
IAN HENDERSON: No, Ron, I don't think you can. This is
so close to -- it's one of the issues at the heart
of the complaint.
RON WARMINGTON: Yeah.
IAN HENDERSON: You know, and I think we pretty well have
confirmed that -- you know, that the capability that
was alleged in some shape or form does appear to
exist. What we don't know is how it was used, when
it was used, what the impact of it -- so that's the
research element. But there is -- there seems to
$SSLO000103
SSL0000103
be, in my mind anyway, no doubt about the existence
of that capability.
RON WARMINGTON: Yeah. By the way, I've also come across
the phrase "TC outbound". That may be the generic
terminology they're using to describe these, it may
not be.
IAN HENDERSON: Well, that, I think, is the mechanism of
the corrections or the adjustments that were being
done by this unit in Bracknell.
RON WARMINGTON: Yeah.
SIMON: Well, TC is a known thing, isn't it? Fast track
TC.
RON WARMINGTON: Yeah.
IAN HENDERSON: And, again, not acting in real time. In
other words, not directly changing sort of live data
but some sort of, let's call it, a journal process
that is then posted to the live data on an overnight
basis. That's -- that's where we are. And, I mean,
I've shared with you pretty much everything we know
about it at the moment. But, as I say, it's early
days.
SIMON: Okay. Right, okay, that's been very helpful.
So I'll let you know.
So, on the Paula issue --
RON WARMINGTON: Mmm.
SIMON: I mean, I told Alwyn about this and I've said,
look, there's a chance you may raise it, so I've
left it to her to make that call.
RON WARMINGTON: We'll be in a very awkward position if
we're trying to defend why we are concerned -- you
know, the whole issue about, sort of, Arbuthnot's
main concern, you know, how he would react, you
know. We can't keep this stuff from him.
IAN HENDERSON: If we're asked a straight question and --
you know, by frankly anybody, we've got to give
a straight answer, and I think in relation to
Arbuthnot, someone needs to brief Paula before we
have that call this afternoon.
SIMON: What time is the call?
IAN HENDERSON: Don't know.
RON WARMINGTON: We don't know. We don't know. The only
other thing I know about it is when you said to me
the reason we're not going to have the call with
Alwyn is did you say because because I understand
you guys are going to have a call with Alwyn and
Paula this afternoon?
IAN HENDERSON: We haven't had the invite yet.
RON WARMINGTON: Correct.
SIMON: Okay, I'm going to leave that to Alwyn to brief
Paula on the Bracknell issue.
RON WARMINGTON: By the way, another slight clue, I'm
seeing references to the acronyms TPZ and TPQ, so --
IAN HENDERSON: Ron, let's not get into any detail.
Things like that are still under investigation,
and --
RON WARMINGTON: Yeah.
IAN HENDERSON: -- I think it's going to confuse the
issue if we tell Simon any more.
RON WARMINGTON: All right, okay.
SIMON: So my next chat, I'm going to talk to Rod.
There may be an innocent explanation to all this,
let's hope. So -- and then I'm going to talk to
Gareth to see what he has to say about this whole
scenario.
$SSLO000103
SSL0000103
$SSLO000103
SSL0000103
IAN HENDERSON: But Simon, just to emphasise one point,
you need to distinguish between process controls and
what I might call physical sort of controls and,
frankly, what's not going to, using Ron's term, cut
the mustard is having a procedures manual saying:
you're meant to do X, Y and Z. The only thing that
would actually have any effect is if there was, you
know, say, two-factor authentication and you
actually had to have a separate user execute, you
know, a command in order to sort of authorise
something, and you -- as far as I'm aware, you
haven't got that.
SIMON: I would doubt it, because that's not how it's
been designed.
Okay, so, yeah, I'll do that. And as Ron always
said, process controls are there for people whose
want to pay for them.
IAN HENDERSON: Yes.
SIMON: If I haven't learnt anything else from this
whole investigation, I will always remember that.
RON WARMINGTON: Well, thank you.
Okay, all right, well, look, thanks for the call
and the frankness of this. That's great. We are on
stand by then for any call with the others as we're
instructed.
SIMON: Okay.
IAN HENDERSON: I will want to know at least what time
that is going to be so I can sort of clear my diary
and so on.
SIMON: Yeah, I'm surprised it's not in your diary.
I don't know. Okay, I'll -- if I hear anything,
I'll let you know.
IAN HENDERSON: Are you going to talk to Rodric?
SIMON: No, I'm not going to do -- I'm not going to do
anything on SRO5,
IAN
SIMON:
RON
IAN
HENDERSON:
WARMINGTON:
HENDERSON:
SIMON: Yeah.
IAN
HENDERSON:
No, I
Yeah.
I'm going to wait to see --
mean Rod the lawyer.
About when I pick this up?
Or just, you know, how you need to
protect yourself and what you need to do.
Okay.
I will, yeah, have a chat with him.
SIMON: Okay, thank you very much.
RON
IAN
RON
RON
IAN
RON
IAN
RON
IAN
WARMINGTON:
HENDERSON:
WARMINGTON:
WARMINGTON:
HENDERSON:
the emails.
WARMINGTON:
HENDERSON:
WARMINGTON:
Thank you, Simon.
Thank
you, Simon.
Bye now.
(Simon leaves the call)
Hello, Ian. Whoa, interesting. So
I would have thought they would have twigged this
already but if he said their faces dropped, it does
sound like it's a real issue, doesn't it?
Well,
Yeah.
Yeah.
Well,
that's what I said as soon as I saw
and they'd better not hold this from
the two top ladies very much longer.
HENDERSON:
No, I
agree.
$SSLO000103
SSL0000103
RON
IAN
RON
IAN
RON
IAN
RON
IAN
RON
IAN
RON
IAN
RON
WARMINGTON: Because they're going to be pissed off
as hell. If they give more assurances in tomorrow's
call, she does, only to find two hours later that
she shouldn't have given them that will be bloody
embarrassing. All right. Well, well done. I feel
like somebody who's kayaking in a home-made kayak
through the fucking Grand Canyon rapids.
HENDERSON: Yeah. It's a bit bumpy, isn't it?
WARMINGTON: It is a bit. It's all good fun, isn't
it, really.
HENDERSON: Well
WARMINGTON: Yeah, I had read all -- reading this
stuff, you know, it's kind of like -- it's circular.
It's like we've always said; you've got to read
stuff, then you read it again and then the third
time through it you kind of -- you've learnt from
the end of the queue --
HENDERSON: It's definitely sort of --
WARMINGTON: It means more.
HENDERSON: You've got of sort of, you know, get it
on the course a few times.
WARMINGTON: Yeah.
HENDERSON: And -- but, you know, just standing back
and looking at all of this, almost everything that's
been alleged is turning out to be either true or
bloody close to the truth.
WARMINGTON: Yeah, yeah.
HENDERSON: I don't think there's anything that we
can categorically reject.
WARMINGTON: No, that's right. Yeah. Yeah. Yeah,
interesting. Yeah, I'm just reading some of the
other ones. He sent me about 20 of them and even
$SSLO000103
SSL0000103
IAN
RON
IAN
RON
IAN
RON
IAN
RON
IAN
RON
IAN
RON
IAN
RON
IAN
that lot is -- every one's interesting, you know.
HENDERSON: Oh yeah.
WARMINGTON: And one of them is speculating on
certainly the TCs about bounced cheques.
HENDERSON: Ah, don't get misled by that because
I looked at that. That was some test cheques or
something, if we're talking about the same thing, that
they had for processing for testing.
WARMINGTON: Okay.
HENDERSON: They had some let's call them dummy
cheques or something.
WARMINGTON: Okay.
HENDERSON: And some of them went missing.
WARMINGTON: Oh, okay. Yeah, right. Okay. Well,
that's -- as you say, that's why it's an iterative
process. You kind of learn that and then it becomes
less important.
HENDERSON: Yeah.
WARMINGTON: All right. Okay. Great stuff. Time
for a cup of tea, I think.
HENDERSON: Yeah but I wish we could get a rough time
for Paula.
WARMINGTON: Well, let me have a look at email
traffic.
HENDERSON: There's nothing come in.
WARMINGTON: You're right; there's nothing come in,
yeah. Okay. Well, we'll wait and see. I suppose
they're chewing horn(?) themselves, aren't they?
HENDERSON: Well, and also, I mean, she's presumably
$SSLO000103
SSL0000103
RON
IAN
RON
IAN
RON
IAN
RON
IAN
RON
IAN
got, you know, some other things --
WARMINGTON: Some other things to do. Yeah, you
would think so.
HENDERSON: Yeah.
WARMINGTON: Anyway, the sun's come out. It's rather
nice. I might go --
HENDERSON: I mean, how are we going to play it with,
sort of -- sort of, Paula? Are we going to sort of
pin our ears back? I suppose it would be polite to
do that to start with.
WARMINGTON: Yeah. Yeah. And, I mean, her issue's
going to be: why is it taking so long? And I've
said to Simon this morning, look, it goes massively
against my personal and professional grain to get
people in trouble when they're my clients. So in
the same way that, you know, when I was really hard
put under cross -- you know, when we were in the
March 25th meeting and there were serious questions
coming out, you know, we're not about to say, "Well,
we haven't got anywhere because Post Office have
been farting about". So, you know, we don't want to
dump Simon in it with his boss's boss but we're
going to have to be fair, reasonable and accurate on
what's caused the delays.
HENDERSON: Yeah.
WARMINGTON: You know, and -- well, a massive
increase in the number of cases and in the
complexity encountered.
HENDERSON: But also the bloody timing. You know, we
didn't have cut-off until the end of February.
WARMINGTON: February. Yeah exactly. Yeah.
HENDERSON: But -- all right. Well, we'll just have
to wait and see. Just I've got a few other things
that I need to do but -
$SSLO000103
SSL0000103
RON
IAN
RON
IAN
RON
IAN
RON
IAN
RON
IAN
IAN
RON
IAN
$SSLO000103
SSL0000103
WARMINGTON: Yeah.
HENDERSON: -- I obviously don't want to miss the
call.
WARMINGTON: Well, no, I can't afford to have you
miss the call because this is -- you know, you're
much better at this stuff than I am and it's
bleeding dangerous for any one of us to be -- you
know, we just -- it's just going to split us apart
if we have meetings like this with only one of us
present. It's just not on.
HENDERSON: Yeah.
WARMINGTON: So it's not good.
HENDERSON: Okay. Well, as soon as I hear anything,
I'll call you and if you can do the same, give me
a shout.
WARMINGTON: Of course I will. All right.
HENDERSON: All right.
WARMINGTON: Oh, okay. I think I'm ready for bed.
HENDERSON: Yeah. Oh, and -- sorry, I mean, one
thing we didn't challenge Simon on was his bloody
stupid four questions. Have you raised that with
him at all?
WARMINGTON: Yeah, I had a long conversation with him
this morning, not least about the reduction to two
to three cases.
HENDERSON: Yeah.
WARMINGTON: And the fact that, you know, we would
never, ever put ourselves up as qualified to judge
whether there's been a miscarriage of justice.
HENDERSON: Yeah.
RON
IAN
RON
IAN
RON
IAN
RON
IAN
RON
IAN
$SSLO000103
SSL0000103
WARMINGTON: If we find anything which might be
germane to that consideration, that sort of thought
process, we are committed to report it to them and
we have done.
HENDERSON: And I understand that point.
WARMINGTON: Yeah, but I said that for you to
restrict our input to just those issues relating to
the software is itself, I think, very misleading and
inappropriate and therefore I would have to reject
that, although I'm, you know, probably more prepared
than Ian is to answer the direct question and, to
the best of my ability, that doesn't make the
question a fair, correct and reasonable one. So
I told him that the questions he's asked are just
un-- are just inappropriate.
HENDERSON: There's a note just come in from Susan:
"Can we do a call at 4.30?"
WARMINGTON: Okay, that's arrived more quicker than
mine has. Okay. In the meantime, I have made
arrangements to come up to London for the 2.00
meeting which is not going to be held now, so
I shall probably arrive later then.
HENDERSON: Okay. So I'll say we can do this call at
4.30.
WARMINGTON: Yeah, but I haven't got it yet. Yeah,
yeah.
HENDERSON: I'11 reply on behalf of both of us.
WARMINGTON: We can. Oh, there we go. Got it. Got
it, got it, got it. "Had a good conversation with
Paula. Some issues (unclear) views on. Can we do
a call at 4.30." Yeah, okay.
HENDERSON: Yeah. Okay.
$SSLO000103
SSL0000103
RON WARMINGTON: Yeah?
IAN HENDERSON: Thanks.
RON WARMINGTON: Fine. (Pause)
(Recording ends)