POL00001643
POL00001643
Royal Mail Group
Witness Statement
(CJ Act 1967, s9; MC Act 1980, ss
5A(3)(a)
and 5B, MC Rules 1981, r 70)
Statement of Gareth Idris JENKINS
Age ifunder Over 18 (If over 18 insert ‘over 18')
18
This statement (consisting of [{) pageseach signed by me) is true to the
best of my knowledge and belief and I make it knowing that, if it is tendered
in evidence, I shall be liable to prosecution if I have wilfully stated in it
anything which I know to be false or do not believe true.
Dated 9th dayof March 2010
the
Signature
Further to my statements of 2nd February and 8th February 2010 I would
like to add the following.
I have examined the 5th Interim Technical expert’s report to the
Court prepared by Charles Alastair McLachlan, a Director of
Amsphere Consulting Ltd and have discussed some of the points
raised directly with Mr McLachlan in telephone conversations of
12th February 2010 and 5th March 2010.
At paragraph 1.1 of this report Mr McLachlan has produced a table of his
hypotheses and details of the conversation that we held. However, I have
now had time to further assess this report and would like to add the
Signatur I GRO i Signature witnessed
by
Gs0l1 (side
Royal mail
148 OL
il Group ple. Registered number 4138203. Regist es. Rogistered
offi
F/593/1
POL00001643
POL00001643
Witness Statement
(CJ Act 1967, s9; MC Act 1980, ss 5A(3)(a) and 5B, MC Rules 1981, r 70)
Continuation of statement of Gareth Idris JENKINS
following comments to some of Mr McLachlan’s “hypotheses” and
“implications of most recent information” which are reproduced in itallics;
Hypothesis -The User Interface gives rise to incorrect data
entry: poor user experience design can give rise to poor data
entry quality.
Implications of most recent information -Gareth Jenkins, ina
telephone interview on 12th February 2010 confirmed the evidence
in his witness statement dated 2nd February 2010 that use of
the Fast Cash button could result in rejected card payment being
treated as over the counter cash. Further, he said that there
was a possibility that when the touch screen needed
recalibrating a user could believe they had pressed one button
while the system recorded the pressing of a different button
(the call logs to Fujistu identify that recalibration was
necessary on more than one occasion).
I have now checked all cases of Rejected Card payments and they
don’t explain the discrepancies sO this hypothesis is
irrelevant.
Hypothesis - The User Interface gives rise to incorrect data
entry: inadequately user experience testing can give rise to
poor data entry quality.
Implications of most recent information - Gareth Jenkins, ina
telephone interview on 12th February 2010 confirmed the evidence
in his witness statement dated 2nd February 2010 that use of the
Fast Cash button could result in rejected ca
d.payment being
GRO
}Version 3.0 11/02
Signature : Signature witnessed by
cso1tA,
F/593/2
POL00001643
POL00001643
Witness Statement
(CJ Act 1967, s9; MC Act 1980, ss 5A(3)(a) and 5B, MC Rules 1981, r 70)
Continuation of statement of Gareth Idris JENKINS
treated as over the counter cash. In the absence of test
information it has not been possible to determine whether other
similar issues were identified during user experience testing.
I have now checked all cases of Rejected Card payments and they
don’t explain the discrepancies so this hypothesis is
irrelevant.
Hypothesis - The User Interface gives rise to incorrect data
entry: in cases that users are working under pressure the
problems of data entry can be exacerbated.
Implications of most recent information - Gareth Jenkins, ina
telephone interview on 12th February 2010 confirmed the evidence
in his witness statement dated 2nd February 2010 that use of the
Fast Cash button could result in rejected card payment being
treated as over the counter cash. The Post Office in the
Midlands reports that the level of discrepancies appears to have
increased as the level of card based transactions has increased.
I have now checked all cases of Rejected Card payments and they
don’t explain the discrepancies so this hypothesis is
irrelevant.
Hypothesis - The User Interface gives rise to incorrect data
entry: in cases that users are insufficiently trained the
problems of data entry can be exacerbated.
Implications of most recent information - We have been provided
with part of a guide that explains the process for manually
dealing with a card payment that fails to _be_ pf
Signature witnessed by I GRO :
‘vergion 3.0 11/02
yperly recorded
CSO11A
3
F/593/3
POL00001643
POL00001643
Witness Statement
(CJ Act 1967, s9; MC Act 1980, ss 5A(3)(a) and 5B, MC Rules 1981, r 70)
Continuation of statement of Gareth Idris JENKINS
due to a system problem. It has not been possible to establish
whether the training Seema Misra received ensured that she was
competent to deal with this kind of problem.
Unable to comment.
Hypothesis - The User Interface gives rise to incorrect data
entry: in cases that users are using a system presented in a
language different from their first language the problems of
data entry can be exacerbated.
Implications of most recent information - We have been provided
with part of a guide that explains the process for manually
dealing with a card payment that fails to be properly recorded
due to a system problem. It has not been possible to establish
whether the training Seema Misra received ensured that she was
competent to deal with this kind of problem.
Unable to comment.
Hypothesis - The Horizon System fails to properly process
transactions.
Implications of most recent information - Gareth Jenkins, in a
telephone interview on 12th February 2010 explained that the
Horizon system managed by Fujitsu is only part of a much larger
of integrated systems used by the Post Office to manage their
counters business. In particular, SAP, a data warehouse and
technology connecting to a merchant service provider for card
payment services is involved. The scope of any systems audit
will need to ensure that any issue relating to tiibse other
Signature GRO I Signature witnessed by i GRO 7
1 Version 3.0 11/02
cso1tA
FI593/4
POL00001643
POL00001643
Witness Statement
(CJ Act 1967, s9; MC Act 1980, ss 5A(3)(a) and 5B, MC Rules 1981, r 70)
Continuation of statement of Gareth Idris JENKINS
systems can be excluded.
I don’t see the relevance of such a statement to this
observation. What happens in the Branch is recorded in the local
branch logs and we now have these for the 13 moth period of Dec
06 to Dec 07. Clearly I cannot prove that nothing is missing
from the logs, but there is no evidence to indicate any system
faults that result in missing transactions. The back end
systems are relevant to Post Office Ltd’s overall accounting,
but not to what is recorded and reported in the Branch accounts
which is what is indicating the losses which the defendant is
being accused of. I am not clear exactly what test scenarios
are proposed. Given that the system has now moved on, there are
no longer any test facilities for the system as it operated in
2006/2007.
Hypothesis - The Horizon System fails to properly process
transactions.
Implications of most recent information - Gareth Jenkins, ina
telephone interview on 12th February 2010 explained that the
Horizon system managed by Fujitsu is only part of a much larger
of integrated systems used by the Post Office to manage their
counters business. In particular, SAP, a data warehouse and
technology connecting to a merchant service provider for card
Payment services is involved. The scope of the interviews will
need to engage managers and technical experts so that any
possible issues relating to these other systems can be
understood.
Signature!
CSO11A I Version 3.0 11/02
F/593/5
POL00001643
POL00001643
Witness Statement
(CJ Act 1967, s9; MC Act 1980, ss 5A(3)(a) and 5B, MC Rules 1981, r 70)
Continuation of statement of Gareth Idris JENKINS
I don’t see the relevance of such a statement to this
observation.
What happens in the Branch is recorded in the local branch logs
and we now have these for the 13 moth period of Dec 06 to Dec
07. Clearly I cannot prove that nothing is missing from the
logs, but there is no evidence to indicate any system faults
that result in missing transactions. The back end systems are
relevant to Post Office Ltd’s overall accounting, but not to
what is recorded and reported in the Branch accounts which is
what is indicating the losses which the defendant is being
accused of.
Hypothesis - The Horizon System fails to properly process
transactions
Implications of most recent information - Gareth Jenkins, in a
telephone interview on 12th February 2010 explained that the
Horizon system managed by Fujitsu is only part of a much larger
of integrated systems used by the Post Office to manage their
counters business. [In particular, SAP, a data warehouse and
technology connecting to a merchant service provider for card
payment services is involved. The scope of testing process will
need to ensure that end to end testing across these other
environments is possible if the problems cannot be reproduced in
the Fujitsu environment alone.
I don’t see the relevance of such a statement to this
observation. What happens in the Branch is recorded in the local
branch logs and we now have these for the 13 moth period of Dec
06 to Dec 07. Clearly we can’t prove that nothing is missing
GRO.
I Version 3.0 11/02
Signature ;
CSOTIA
F/593/6
POL00001643
POL00001643
Witness Statement
(CJ Act 1967, s9; MC Act 1980, ss 5A(3)(a) and 5B, MC Rules 1981, r 70)
Continuation of statement of Gareth Idris JENKINS
from the logs, but there is no evidence to indicate any system
faults that result in missing transactions.
The back end systems are relevant to Post Office Ltd’s overall
accounting, but not to what is recorded and reported in the
Branch accounts which is what is indicating the losses which the
defendant is being accused of. I am not clear exactly what test
scenarios are proposed. Given that the system has now moved on,
there are no longer any test facilities for the system as it
operated in 2006 2007.
Hypothesis - Incorrect data entry is not resolved by sub post
office reconciliation and relies on the consistent, accurate and
timely resolution of discrepancies by the Post Office and
operators of the Horizon system.
Implications of most recent information - Gareth Jenkins, ina
telephone interview on 12th February 2010 explained that branch
transaction logs are extremely detailed records of all branch
actions as well as any branch system exceptions (e.g. network
failure). They are routinely archived for 7 years and a Fujitsu
employee is engaged full-time to provide recovery of logs from
the archive in a routine batch process which, he said, has been
forensically examined to demonstrate a full chain of evidence
necessary for the logs to be used in court. In addition, he
explained that software is provided by Fujitsu for converting
the logs into a readily accessible spreadsheet format for system
and accounting audit purposes.
The logs are now available and I have started looking at them.
od.
Signature:
CSottA Version 3.0 11/02
F/593/7
POL00001643
POL00001643
Witness Statement
(CJ Act 1967, s9; MC Act 1980, ss 5A(3)(a) and 5B, MC Rules 1981, r 70)
Continuation of statement of Gareth Idris JENKINS
Hypothesis - The Horizon system does not appear to be a single
monolithic mainframe based system with computer terminals with
no independent processing capability: each of these components
could give rise to faults that result in discrepancies.
Implications of most recent information - Gareth Jenkins, ina
telephone interview on 12th February 2010 explained that the
Horizon system managed by Fujitsu is only part of a much larger
set of integrated systems used by the Post Office to manage
their counters business. In particular, SAP, a data warehouse
and technology connecting to a merchant service provider for
card payment services is involved. The scope of systems audit
process will need to ensure that end to end audit of transaction
records is conducted if the issue cannot be identified in the
Fujitsu systems alone.
The back end systems are irrelevant for problems in the branch
accounts. The logs are now available
Hypothesis - The end to end dialogue between the counter terminal,
the card authorisation terminal, the network, the core Horizon
system, the electronic funds transfer component, the authorising
merchant service and the central post office branch accounting
system is a long running transaction with multiple points of
possible failure.
Implications of most recent information - Gareth Jenkins, in a
telephone interview on 12th February 2010 explained that the
Horizon system managed by Fujitsu is only part of much larger
set of integrated systems used by the Post Offi b
Signature Signature witnessed by
csonaA
F/593/8
POL00001643
POL00001643
Witness Statement
(CJ Act 1967, s9; MC Act 1980, ss 5A(3)(a) and 5B, MC Rules 1981, r 70)
Continuation of statement of Gareth Idris JENKINS
their counters business. In particular, SAP, a data warehouse
and technology connecting to a merchant service provider for
card payment services is involved. The scope of systems audit
process will need to ensure that end to end audit of transaction
records is conducted if the issue cannot be identified in the
Fujitsu systems alone.
This is not relevant. The Branch accounts are based purely on
whether the Branch thinks the Debit Card was authorized or not.
Any subsequent failures are irrelevant to the branch accounts.
Hypothesis - Complex systems rarely have sufficient capability
built in to deal with all possible failure points and
discrepancies are very likely to arise which require manual
intervention based on the reconciliation of paper and electronic
logs at different points in the system.
Implications of most recent information - Gareth Jenkins, ina
telephone interview on 12th February 2010 explained that the
Horizon system managed by Fujitsu is only part of a much larger
set of integrated systems used by the Post Office to manage
their counters business. In particular, SAP, a data warehouse
and technology connecting to a merchant service provider for
card payment services is involved. The scope of the technical
documentation will need to cover all of these systems.
This is not relevant. The Branch accounts are based purely on
whether the Branch thinks the Debit Card was authorized or not.
Any subsequent failures are irrelevant to the branch accounts.
Signature witnessed by { G RO
Version 3.0 11/02
F/593/9
POL00001643
POL00001643
Witness Statement
(CJ Act 1967, s9; MC Act 1980, ss 5A(3)(a) and 5B, MC Rules 1981, r 70)
Continuation of statement of Gareth Idris JENKINS
In addition to responding to this report I have also obtained
the transaction logs from 1st December 2006 to 3lst December
2007 which amount to nearly half a million transactions (431,490
to be precise).
I have searched through the logs looking for all examples of
Debit Card transactions which have not been successful, since
this seems to be one of the defence’s main attacks on the
system.
There are 92 such failed transactions for a total value of
£117,149.98. I’ve analysed all those with an individual value
of more than £1,000 (leaving £6,113.55 worth that I’ve not
analysed).
In all the cases I’ve analysed one of 3 things has happened:
1. The Customer session was then settled by a Cheque (and
so the failure must have been noticed by the clerk)
2. The Customer session was abandoned (ie any goods were
returned and the transactions cancelled and the only item from
the session is the failed Debit Card payment).
3. The Customer session was settled to Cash (which could
have been accidental). However, in all such cases the
transaction was subsequently reversed resulting in the cash also
being reversed.
There are business rules that control whether transactions can
be cancelled or if they have to be committed and then reversed
(which is the main difference between cases 2 ang}3 above). I
GRO
Signature witnessed by
Signature }
cSO11A Lae am] Version 3.0 11/02
10
F/593/10
POL00001643
POL00001643
Witness Statement
(CJ Act 1967, s9; MC Act 1980, ss 5A(3)(a) and 5B, MC Rules 1981, r 70)
Continuation of statement of Gareth Idris JENKINS
suspect (but cannot necessarily prove) that in case 2 the
sessions were for purchase of Foreign Currency. In case 3 the
sessions were all for purchase of Premium Bonds.
I think this refutes the assertion that failed Debit Card
Payments are the cause of the losses.
Without a clear directive from the defence as to what specific
transactions they say have caused errors on Horizon, I am unsure
what further analysis to carry out. However, I have identified
some possible areas to pursue:
I have looked at Pouch Reversals (where cash or currency is
packed for despatch to Post Office® Ltd’s Cash Centre) and the
Pouch is subsequently Cancelled. This is a method. by which cash
losses can be partially hidden and was mentioned in the
defendant's interviews. For December 2006 there were no such
examples.
Each night there should be a Cash Declaration made for each
Stock Unit in the Branch indicating the current cash in the
till. It is also possible to look at all the cash movements for
each Stock Unit by looking at the Cash transactions. I’ve tried
to compare the Cash movements in terms of the Transactions and
also in terms of differences in Declarations and there seems to
be very little correlation indicating that the cash declarations
are probably inaccurate
As part of the monthly Balancing process, special transactions
are recorded to reflect Stock Adjustments and Discrepancies
detected by the system as part of this process. ,These all
result in the system assuming that Cash it put to (or removed)
I —
Signature witnessed by I G RO i
{Version 3.0 11/02
CSO11A
11
F/593/11
POL00001643
POL00001643
Witness Statement
(CJ Act 1967, s9; MC Act 1980, ss 5A(3)(a) and 5B, MC Rules 1981, r 70)
Continuation of statement of Gareth Idris JENKINS.
from the Till to reflect these Adjustments / Discrepancies.
I have been requested to comment on the issue raised by the
defence in relation to a Post Office® called Callender Square,
Falkirk that was mentioned at the Castleton Trial. I have
examined our records and can confirm the following;
The problem occurred when transferring Cash or Stock between
Stock Units. Note that West Byfleet Post Office® does operate
multiple Stock Units so the issue could have occurred. It
manifests itself by the Receiving Stock Unit not being able to
“see” the Transfer made by the “sending” Stock Unit and is
compounded by attempting to make a further transfer. Please
note that such transactions usually reappear the next day. It is
clearly visible to the User as a “Receipts and Payments
mismatch” at the time that one of the Stock Units is Balanced.
This usually results in the Branch raising a call. There are no
such calls in Andy Dunks’ Witness Statement of 29th January 2010
which summarises the calls raised by West Byfleet. Also this
can be checked on any Balance Reports / or Branch Trading
Statements that are available from the Branch which should show
that Receipts and Payments do match and that the Trading
Position is zero. The problem is also visible when looking at
system events associated with the Branch. The System events
from 30/06/2005 to 31/12/2009 for West Byfleet have been checked
and no such events have been found. The problem was fixed in the
S90 Release which went live in March 2006 and so would not have
been relevant at the time of the detailed Transaction Logs
obtained for West Byfleet between December 2006
2007. wth cmnnnnn
GRO Signature witnessed by I G RO
Version 3.0 11/02
Signature
CSOT1A
F/593/12
POL00001643
POL00001643
Witness Statement
(CJ Act 1967, s9; MC Act 1980, ss 5A(3)(a) and 5B, MC Rules 1981, r 70)
Continuation of statement of Gareth Idris JENKINS
Therefore I can conclude that the problems identified in
Calendar Square, Falkirk are not relevant to West Byfleet Post
Office.
On 2nd October 2009 I produced a report about Horizon Data
integrity. Within this report are details about transactions
(sometimes known as EPOSS transactions) and various scenarios
that could occur following system failures. In rare
circumstances it is possible for transactions to not be recorded
on the local system but in all such cases the user would be
aware of this. I produce this report as exhibit GJ/01.
As with any large system there will be occasional faults such as
the one found in Callender Square, Falkirk. Any such faults,
whether found during testing or from live user feedback would be
investigated and resolved appropriately. I am not aware of any
such faults that have been raised by West Byfleet Post Office®.
If specific transactions can:be identified where the user feels
s caused losses then further investigation can be
Signature:
cCSOttA Version 3.0 11/02
F/593/13