FU,
FUJITSU — COMMERCIALLY SENSITIVE
DO NOT FORWARD OR SHARE WITH ANYONE ELSE WITHOUT EXPRESS PERMISSION OF AUTHOR
UPDATE ON ISSUES IMPACTING ON THE HORIZON SYSTEM
ARISING FROM SECOND SIGHT AUDIT
Executive Summary
The attached note summarises the details surrounding (and discussed during) a meeting between
Fujitsu (James Davidson, Pete Newsome and myself) and Post Office (led by Rodric Williams and
Andy Holt).
The points discussed relate to:
¢ Expert view on the Horizon system for criminal prosecutions— Fujitsu successfully reduced
scope to audit trail system rather than wider Horizon system (as per previously suggested
scope put forward pre Second Sight);
¢ Audit Storage Project — Post Office legal remain concerned but Pete N has successfully
managed Post Office to agree to technical solution. Acknowledged that Expert may need to
be involved;
¢ Mediation Process (output from Second Sight) — presently Post Office only requires Fujitsu to
provide data from the audit trail. However, this may ultimately require some form of expert
engagement;
e IPR licence and Al Tower — both matters are still progressing. Post Office’s strategy
regarding the Al Tower will be formally disclosed to market on 9 December.
My conclusions are that the current focus on Horizon system resultant from the Second Sight audit
(which found no systematic issues with the Horizon software) provides an ideal opportunity (and
“open door” from Post Office) to re-brand Horizon in a more positive light. It remains key that we
ensure that all challenges to the robustness of Horizon are appropriately challenged by a project
team focused on this goal (arguably chargeable to Post Office). However, I recommend a team with
a wider remit is put in alongside this project team with the sole task to improve the perception of the
Horizon system. As the Under-Secretary of State for BIS has stated, Horizon is about as good as an IT
system gets but neither the Post Office, the sub-postmasters nor the wider IT market seem to fully
appreciate this. My recommendation is that we actively seek to redress this misconception.
FUJ00156931
}J00156931
FUJ00156931
FUJ00156931
FUJITSU — COMMERCIALLY SENSITIVE
DO NOT FORWARD OR SHARE WITH ANYONE ELSE WITHOUT EXPRESS PERMISSION OF AUTHOR
On Friday 29° November, James Davidson, Pete Newsome and I met with a Post Office team (Andy
Holt, Jarnail Singh, Rodric Williams, Simon Clarke and [_] (latter two from Cartwright King)), at their
instigation, to discuss the Horizon prosecutions assistance we provide and the changes / additions
they are looking for in light of the Second Sight audit report. The Fujitsu team also expanded the
conversation to cover the associated Mediation Process and conversation also touched on the Audit
Storage Project.
The sections below attempt to link all the current issues surrounding the Horizon system and the
conclusions provide a proposal as to how I think we should best manage them moving forward.
1- Horizon prosecutions
The Post Office criminal team (led by Jarnail Singh) believe they have an issue regarding the
legitimacy of future evidence provided about the Horizon system by “the family” (defined as
Post Office and Fujitsu in this case) for future prosecutions regarding alleged fraud by sub-
postmasters.
Post Office approached the 29/11 meeting with the goal that they required an expert to look
at the “end to end” Horizon solution, including all its links to third party systems etc. and
provide an independent experts “definitive” view that could be shared with the court as part
of a court case. It then may require a second expert for case specific issues.
Fujitsu’s position was that such an “end to end” review would be impossible and would not
achieve the desired outcome. Our position was that the core audit trail Horizon system was
the area that an expert should focus on in deriving the expert view as to the robustness of
the Horizon system and the capability of using the audit trail data in a prosecution of a sub-
postmaster for fraud. This aligns with the expert opinion we were discussing with KPMG
prior to the Second Sight audit taking priority.
In the meeting James Davidson provided an excellent overview as to Fujitsu’s position and
explained how the core audit trail system works. After some discussion, Post Office agreed
with Fujitsu’s position that any expert opinion should focus on the counter — data centre —
audit file process and not the wider elements. James took the action to draft a paper
defining this element of Horizon for Post Office’s review ahead of the parties progressing
how and when an expert may be instructed to review this element of the Horizon system. It
was also flagged that the two known “bugs” occurred outside of this core audit trail system.
The parties agreed that a second expert may be required on a case by case basis for specific
issues. Furthermore, a review of any changes to the core audit trail system may be required
by the expert on an annual (or other agreed period) basis.
It was also noted that Pete Newsome is working with the Post Office team to create an
addition to the Horizon system called HORACE which will enable the Post Office security
team to view audit trail data on a “near real time” basis. This should facilitate the rapid
review of issues (fraud or otherwise) though the audit file would remain the definitive data
source.
a. Actions from 29/11/13 meeting
i. James Davidson to provide a first draft defining the core audit trail system to
the Fujitsu team for review and subsequent sharing with Post Office
FUJ00156931
FUJ00156931
FUJITSU — COMMERCIALLY SENSITIVE
DO NOT FORWARD OR SHARE WITH ANYONE ELSE WITHOUT EXPRESS PERMISSION OF AUTHOR
2-
ii. Post Office to review the types of expert it wishes to have “audit” this sub-
set of the wider system
iii. The parties to meet again once a scope of terms of reference for an
expert and the nominated expert.
It should be noted that we did not discuss the “tone” of the previously drafted terms of
reference by Post Office for the expert and this will need to be reviewed carefully in the
future.
In addition we noted that need to scope this via a project and highlighted the need to agree
“commercials” but did not discuss further (save to assure Jarnail that the need for
“commercials” would not delay the provision of the definition of the core audit trail system
document).
Audit Storage Project
The Post Office criminal prosecutions team highlighted their nervousness as to this project.
Pete Newsome explained the necessity for the project and fact that it did not change the
“flow” merely the repository for the data. He explained the project was in three parts:
a. The new storage facility is built and the “switch” flicked so that all new transactions
are stored on the new storage facility;
b. The data housed on the old storage facility is transferred, via the same process as
new data is transferred, on the new storage facility;
c. The old storage facility is switched off and decommissioned.
At all stages an independent expert (we proposed IRM) will check the veracity of the data
stored and its consistency with the current stored data.
Pete also explained the the stage one “switch” will be “flicked” in April 2014 (subject to
confirmation as he said he was working from memory). He also informed the group that this
approach had been signed off by the Post Office technical function.
Post Office’s merely commented that the expert for the Horizon prosecutions will need to be
informed of this.
The Fujitsu team deliberately avoided discussing the requirement for a legal opinion and
Post Office did not raise this.
a. Actions from 29/11/13 meeting
i. Pete Newsome to confirm the date for “switch” over.
Mediation Process
The Mediation Process was agreed to by Post Office as a result of the outcomes from the
Second Sight audit report. Any sub-postmaster (past or current) could raise a grievance
about the system (which includes training etc) and would be provided with some paid
assistance to structure and scope their claim and then it would be, where appropriate,
subject to the Mediation Process. The closing date for such claims was 18" November 2013,
though we believe that Post Office may not have formally closed the “window” yet.
FUJ00156931
FUJ00156931
FUJITSU — COMMERCIALLY SENSITIVE
DO NOT FORWARD OR SHARE WITH ANYONE ELSE WITHOUT EXPRESS PERMISSION OF AUTHOR
To date, the Post Office has received 148 “cases”, and this includes at least two that have
already been adjudicated upon in either the criminal or civil courts. Second Sight (as part of
the initial assessment process) is reviewing the claims with Post Office ahead of deciding
which can be put forward to the process. The 148 “cases” will not all be about the Horizon IT
system but by way of context there are currently 11,800 branches, 68,000 users and the IT
system processes 6 million transactions a day.
I had already raised with Rodric Williams that Fujitsu saw the criminal prosecutions and
Mediation Process as very similar to the extent to which it made challenges of a robustness
or veracity of the Horizon IT system. Therefore, it may be prudent to ensure that the
expert’s opinion is in such a form as it can be used in this forum too.
Currently Post Office believes that they will only require Fujitsu to provide data to this forum
and not be part of the process itself. We did discuss that a layman’s friendly version of
James’ scoping document may be useful for this process and further assistance may be
required in the future.
Pete Newsome is managing the data collection process for Fujitsu (Andy Holt is his counter-
part in Post Office). However, Post Office has acknowledged that Fujitsu’s involvement will
need to be scoped and managed via a project and Pete has already begun scoping it. Asa
long term solution, Pete’s direct management involvement is not, in my opinion, sustainable
as this is not a change management issue and so as part of this project (and the wider
implications, see below) a management nominee is required. Please note, this is not to
detract from the great work Pete is doing but such a project is outside his remit (though his
expertise will be required moving forward).
In the email to Rodric we have highlighted that any engagement by Fujitsu with an expert
will be on a “without prejudice” basis and as such Fujitsu shall reserve its rights, including its
right to challenge the outcome of any expert determination.
a. Actions from 29/11/13 meeting
i. Andy Holt (Post Office) to set up fortnightly update calls for him, James, Pete
and myself to ensure we are kept informed of all updates
ii. Fujitsu to prepare a project scoping document for our engagement with the
Mediation Process — initially this will simply be with respect to providing
access to data in the audit trail.
It should be noted that James also raised the need that any inquiry about the validity of a
transaction through to a systemic claim for fraud etc. must be subjected to a business
process to ensure that legitimacy is given to the assessment process. Whilst this was noted
by Post Office, my view was that the importance was not understood or that it was seen as
too difficult a task for Post Office at this stage.
4- Other points from meeting
We briefly discussed the Mr & Mrs Wall claim (which seems to revolve primarily around
poor network connectivity). Whilst it will probably not directly involve the Horizon system
(the case is being heard on Wednesday this week), I did use it to flag to Rodric the need that
FUJ00156931
FUJ00156931
FUJITSU — COMMERCIALLY SENSITIVE
DO NOT FORWARD OR SHARE WITH ANYONE ELSE WITHOUT EXPRESS PERMISSION OF AUTHOR
5-
communications between Post Office and Fujitsu regarding such claims are comprehensive
so as to ensure that any such claims are notified and appropriately managed to ensure that
all questions about the robustness or otherwise of the Horizon system are suitably
challenged and rebutted.
In addition, Rodric indicated that Post Office were open to discussions regarding how we
may best “go on the offensive” regarding the facts about the Horizon system and the service
provided by Post Office to the sub-postmasters. I believe this is a key opportunity for the
Post Office Account team and will deal with it in my recommendations below.
Points not discussed at the meeting but relevant to the wider Horizon issues
IPR licence
Mark Philips continues to negotiate with Post Office (Brian Deveney and Richard
Boyce) regarding the financial elements of this licence. Mark’s latest email to me
stated that the revised deal was:
“Reducing the license option fee to £13m if:
© POL commit to £17-22m of incremental work this FY;
* POL commit to a 7 year deal on DC this FY — worth another £10m compared
to5
@ =POL commit to £2m of additional margin this FY
This would need to come as a contractually committed package for us to agree the
lower license fee”
The latest version of the IPR licence received from Slaughter & May (Post Office’s
lawyers on this matter) did not reflect this (and raised a few additional points that
were also rejected). The strategy here is for Mark to confirm agreement of these
points with Post Office and have Post Office re-issue a draft licence on the agreed
terms.
Al Tower
We have formally been told that the previous OJEU notice has been withdrawn and
will be reissued in due course.
We are currently waiting for the revised PQQ to be issued and meanwhile are
preparing 3 background workflows:
i. To investigate the current mode of operation with a view to reducing the
cost of delivery by a higher utilization of off shore where appropriate
ii. We are also conducting a capabilities review to understand where our core
strength lay and where we might potentially collaborate with 3” parties
iii. We are also investigating what our Evolve strategy may look like in
terms of Rebuild, Transition, transform.
On the Sth of Dec there is a Post Office IT Transformation Programme - market
engagement session in London.
FUJ00156931
FUJ00156931
FUJITSU — COMMERCIALLY SENSITIVE
DO NOT FORWARD OR SHARE WITH ANYONE ELSE WITHOUT EXPRESS PERMISSION OF AUTHOR
Post Office Ltd will soon be commencing competitions for the three remaining
service towers, Front Office Applications maintenance, support and development
(AMS&D), Back Office Applications maintenance, support and development
(AMS&D), and Networks services.
Post Office’s current front office applications include website services, Post and Go
and the core transactional system (Horizon), which provides the Point of Service
functionality within the branch network. This is supported by circa 150+ back office
applications and application components. Post Office will need to maintain and
support existing applications where necessary, and develop new applications to
support the delivery of current and future counter and multi-channel products and
services.
Current plan is to respond to both elements of the AMS&D, but we have not yet
decided our strategy in regard to Network Services.
6- Conclusions and Recommendations
I see the current issues surrounding the Horizon system are structured as follows (with the Horizon
re-banding as a, in my opinion, required additional element to address these matters):
ale
\ Horizon re-branding
initiative
My recommendations to address the issues highlighted in this paper are:
e Project engagement team
FUJ00156931
FUJ00156931
FUJITSU — COMMERCIALLY SENSITIVE
DO NOT FORWARD OR SHARE WITH ANYONE ELSE WITHOUT EXPRESS PERMISSION OF AUTHOR
A project team is set up to manage Fujitsu’s engagement with Post Office regarding
the Horizon prosecutions expert opinion, engagement with the Mediation Process
and any other civil court actions.
To the extent to which such costs are not covered by the Service Management
function in the Horizon contract such costs are recoverable from the Post Office.
This project team should be headed by someone like James Davidson (such costs
may not be entirely recoverable, see recommendation b) below), together with one
or more project managers to ensure that data requests are managed in a structured
manner and the scope of Fujitsu’s involvement is managed.
A representative from Legal (current proposal is Chris Jay) is engaged in any
“interpretative” analysis to ensure legal privilege on communications, where
appropriate;
* Horizon re-brand team
°
The Project engagement team should feed into a wider Horizon re-brand team
(limited rights to charge Post Office) which looks at the wider implications to the
Horizon system.
The key role of this team is to determine strategies as to how best to improve the
perception of the Horizon system, both within Post Office and the wider market.
I suggest this team involve James D, Haydn J, Gavin B, Pete T, Andrea Clatworthy (or
nominee from marketing), Mark P (or Danny M) and maybe Pete or myself.
The primary goal of this team is to put in place and implement a strategy to improve
the perception of the Horizon system, both within Post Office and wider.
I believe, that we may be able to use the “open door” offered by Rodric Williams (in
the 29/11 meeting) to commence this at a lowish level within Post Office with the
intention to grow the “positive noise” to the Post Office and market more widely
thereafter. This, I believe, is key to ensuring a successful Al Tower sale (or it makes
our sales teams job that bit harder without it); and
«Exec briefings
°
Key personnel with Post Office (i.e. Lesley, Paula, Chris) are identified and a strategy
agreed between the re-brand team and the Exec Board as to how to communicate
the “positive noise” generate by the Horizon re-brand team.
This should be managed by Haydn J and Gavin B.
Michael Harvey
2” December 2013