POL00022839
POL00022839
Message
From:
Sent:
To: Cooper, Tom - UKGI
cc: Rodric Williams
; Emanuel, Catherine
Subject: "
Attachments: Judgment No.6 FINAL.DOCX; Technical Appendix FINAL.DOC; Appendix 2 - Bugs, Errors, Defects.docx; Appendix 3 -
Glossary.docx
Dear all
Further to my email below, please now see attached an electronic version of the Horizon Issues
judgement.
Kind regards
Ben
Ben Foat
Group General Counsel
Ground Floor
20 Finsbury Street
LONDON
EC2Y 9AQ
This email and any attachments are confidential and intended for the addressee only. If you are not the named recipient, you must
not use, disclose, reproduce, copy or distribute the contents of this communication. If you have received this in error, please contact
the sender by reply email and then delete this email from your system. Any views or opinions expressed within this email are solely
those of the sender, unless otherwise specifically stated.
POST OFFICE LIMITED is registered in England and Wales no 2154540. Registered Office: Finsbury Dials, 20 Finsbury Street, London,
EC2Y 9AQ.
From: Ben Foat
Sent: 16 December 2019 1:
Tom.Aldre:
3
Watson, Richard - UKGI ¢
"}; Cooper, Tom - UKGI
1) Rodric Williams
Emanuel, Catherine
! .
ngela Van-Den-Bogerd +
; Patrick Bourke
andrew.parsons <é
; Alan Watts - Herb
} Jonathan Gribben <}___
Subject: GLO - HU
Good afternoon,
POL-0019318
POL00022839
POL00022839
Justice Fraser has handed down his judgment earlier this afternoon in relation to the Horizon Issues Trial.
These proceedings were settled between the parties last week however as advised at the time there are a
number of outstanding issues which will need to be further managed post settlement.
Below sets out a summary of the findings of Fraser J in the Horizon Issues Trial together with a brief
overview of next steps and the Judgement will follow separately.
Summary
e It has been found that the Horizon system in use today (HNG-A) is "relatively robust". This is a
helpful finding as it substantially mitigates the immediate operational risk to the network. The
judgment contains a number of helpful statements including: “It must be remembered that Horizon
as it is today, or at least in the last couple of years, since it became HNG-A, is a very different
system to earlier times... Modern Horizon Online as it is today is not the same as the system that
was introduced in 2010”. Moreover, “Findings in this judgment as to the performance and
robustness of Legacy Horizon from 2000 to 2010, and then of Horizon Online (in both its forms,
HNG-X and HNG-A) from 2010 to 2018 are not findings on the Horizon system as it exists at the
date of distribution of the draft of this judgment, in November 2019... It is agreed by the experts
that the Horizon System in its HNG-A form is now relatively robust. This judgment is a historical
analysis of the Horizon system as it relates to the period in question in the group litigation, not a
judgment upon HNG-A as it is today.
e However, the remainder of the Judgment is adverse to Post Office. The robustness of the previous
version of Horizon Online (HNG-X, 2010 to 2018) was "questionable, and did not justify the
confidence placed in it by Post Office in terms of its accuracy" and Legacy Horizon (2000 to 2010)
was "not robust".
e It appears that the tone of the Judgment is generally better that the Common Issues but there is
repeated and, in places stringent, criticism of Post Office and Fujitsu not properly and diligently
investigating possible IT problems and being too quick to assume that fault rested with the
SPM. This echoes the Judge's comments in the CIT about a lack of investigative support and
transparency from Post Office.
Next Steps
Post Office has stood up our contingency and comms plans to manage any reaction to the HIJ in the
network and media. Given the court’s finding in relation to pre-HNG-A horizon issues, there is a potential
risk:
1. The HIJ could undermine the integrity of criminal convictions of some or all postmasters who were
previously prosecuted by Post Office historically (which ceased in 2013). As part of the settlement,
Post Office agreed to take advice from leading criminal counsel on how it should proceed with
regard to the convicted claimants and to act upon and follow the legal advice it received in this
regard. If any convicted claimant has their conviction over turned because of Post Office’s actions
or omissions and due to the findings made in either the Common or Horizon Issues Judgment, Post
Office agreed to provide an apology which reflects the basis upon which the conviction was
overturned. Brian Altman QC has already been instructed to provide his review of the judgment
and to provide Post Office with his advice on how to best proceed.
2. Further claims may be brought against Post Office where other postmasters were required to make
good shortfalls and in some cases may have been subsequently suspended or terminated. Post
Office will be establishing a Historic Shortfall Group to deal with shortfall which arose between 2000
and 10 December 2019. It will adopt an alternative dispute resolution process to resolve these
issues (which ultimately ends in the small claims court for disputed compensation less than £10K
or at arbitration for those disputes totally more than £10k). The scheme will be notified to
postmasters. We are working with HSF to develop a framework (with resolution criteria) to process
these claims.
POL-0019318
POL00022839
POL00022839
Further summarised details of the 15 HIJ questions and answers are set out below:
The judgment is extensive and very detailed. Below is a further detailed summary of the judge's findings
in respect each of the Horizon questions which were before the Court for determination.
What extent was it possible or likely for bugs to have the potential (a) to cause shortfalls in
Subpostmasters’ branch accounts or transactions, or (b) undermine the reliability of Horizon
accurately to process and record transactions?
It was possible for bugs to have the potential both (a) to cause shortfalls in to Subpostmasters’ branch
accounts or transactions, and also (b) to undermine the reliability of Horizon accurately to process and
record transactions. There was a significant and material risk of branch accounts being affected by bugs
in Horizon.
The sheer scale of the number of TCs issued by the Post Office each year - which is over one hundred
thousand for many of the years the subject of the group litigation - supports the conclusion that there
was a significant and material risk of inaccuracy in branch accounts as a result of bugs in the Horizon
System (both Legacy Horizon and HNG-X).
Issue (2): Did the Horizon IT system itself alert Subpostmasters of such bugs, errors or defects
as described in (1) above and if so how?
The Horizon system did not alert SPMs to bugs. Although the experts were agreed that the extent to which
any IT system can automatically alert its users to bugs within the system itself is necessarily limited, and
although Horizon has automated checks which would detect certain bugs, they were also agreed that
there are types of bugs which would not be detected by such checks. Indeed, the evidence showed that
some bugs lay undiscovered in the Horizon system for years.
Issue (3): To what extent and in what respects is the Horizon System “robust” and extremely
unlikely to be the cause of shortfalls in branches?
Legacy Horizon was not remotely robust.
HNG-X, the first iteration of Horizon Online, was slightly more robust than Legacy Horizon.
HNG-A is far more robust than either of the previous two iterations of the system.
There was a material risk that a shortfall in a branch’s accounts was caused by the Horizon system during
the years when both Legacy Horizon and HNG-X were in use, which is 2000 to 2010 and 2010 to 2017
respectively.
Issue (4): To what extent has there been potential for errors in data recorded within Horizon to
arise in (a) data entry, (b) transfer or (c) processing of data in Horizon?
There was a material risk for errors in data recorded within Horizon to arise in (a) data entry, (b) transfer
or (c) processing of data in Horizon in both the Legacy Horizon and HNG-X forms.
Issue (5): How, if at all, does the Horizon system itself compare transaction data recorded by
Horizon against transaction data from sources outside of Horizon?
The comparison of data is largely automated. The Judge does not go into detail as to how this is done. The
evidence did not deal in a comprehensive way with each such method for every one of the Post Office’s
many hundreds of clients. Nor did the Judge consider that such evidence was required properly to answer
this issue.
Issue (6): To what extent did measures and/or controls existed in Horizon to prevent, detect,
identify, report or reduce to an extremely low level of risk of data and software errors?
POL-0019318
POL00022839
POL00022839
The measures and/or controls that existed on Legacy Horizon and HNG-X did not prevent, detect, identify,
report or reduce to an extremely low level the risk of data or software errors. The experts were agreed
that there were many measures and controls within Horizon that existed to prevent, detect, identify report
or reduce the risk of varying errors. However, the experts were also agreed that whilst Horizon contains
measures and controls for detecting system integrity concerns, these automatic mechanisms have been
shown to have failed in the past.
Issue (7): Were Post Office and/or Fujitsu able to access transaction data recorded by Horizon
remotely (i.e. not from within a branch)?
This answer was substantially agreed by the parties. Both Post Office and Fujitsu could read data
remotely. Fujitsu could access and edit all transaction data recorded by Horizon.
Issue (8): What transaction data and reporting functions were available through Horizon to Post
Office for identifying shortfalls, including whether they were caused by bugs, errors and/or
defects in the Horizon system?
This issue was substantially agreed by the parties. The Judgment lists out a series of systems and data
sources available to Post Office that are not controversial. The Judge also notes that Post Office had
access to data and systems that were not available to SPMs (again this is not controversial).
Issue (9): At all material times, what transaction data and reporting functions (if any) were
available through Horizon to Subpostmasters for (a) identifying shortfalls and their causes; and
(b) accessing and identifying transactions recorded on Horizon?
This issue was substantially agreed by the parties. The experts agreed that the causes of some types of
shortfalls may be identified from reports or transaction data available to SPMs. Other causes of shortfalls
may be more difficult, or impossible, to identify from reports or transaction data available to the SPMs,
because of their limited knowledge of the complex back-end systems.
The Judge also found that because the reports and data available to SPMs were so limited, their ability to
investigate was itself similarly limited. He went on to find that SPMs simply could not identify discrepancies
and shortfalls, nor their causes, nor access or properly identify transactions recorded on Horizon, without
cooperation from Post Office. This finding was not however required as there was no question to this effect
asked by any of the Horizon Issues and the Judge has gone out of scope here.
Issue (10): Whether the Defendant and/or Fujitsu have had the ability to remotely access and
change branch data without the knowledge or consent of SPMs.
Fujitsu had many facilities for doing this and some of these could have been done without the knowledge
or consent of SPMs (as accepted by Post Office before trial, but only following Fujitsu initially giving
incorrect evidence on this point).
Post Office could only change branch data utilising its Global User role. This permitted Post Office to inject
transactions without the knowledge or consent of the SPM. However, it could only be done by someone
who was physically present in a branch, as that is the only way Global User could be used by the Post
Office. This would therefore be likely to mean that a SPM or their assistant would at least know someone
was in their branch doing something in terms of access to their branch accounts.
Issue (11): Did the Horizon system have any permission controls around remote access and did
the system maintain a log of such actions and such permission controls?
There were permission controls, but the remote access facilities were very wide and they were not effectively
controlled. The permission controls and logs were "inadequate" and "deficient.
Issue (12): If the Defendant and/or Fujitsu did have such ability, how often was that used, if at
all?
POL-0019318
POL00022839
POL00022839
Due to Fujitsu’s poor record keeping, the experts could not provide any confident evidence on this subject
of frequency. On the evidence from the two experts, the answer should be in approximate terms only and
would be about once a day over the whole life of the system.
Issue (13): To what extent did use of any such facility have the potential to affect the reliability
of the Branches’ accounting positions?
The remote access facilities were very wide. These facilities therefore had the potential to affect the
reliability of a SPM’s branch accounts to a material extent.
Further, the evidence shows clearly that there were instances when this in fact occurred, which goes wider
than the issue posed (which asks about potential) but which the Judge held was also relevant to the Horizon
Issues as a whole.
Issue (14): How (if at all) does the Horizon system allow a SPM to render accounts and dispute
shortfalls?
This was substantially agreed by the experts. The Horizon system can compare cash and stock figures, but
it has no facility to record a dispute. The comparison is done by the system comparing its electronic records
of what cash and stock is held in a branch, with the corresponding figures inputted by the SPM at the end
of a trading period.
Note: Without naming Post Office but clearly aiming the comment at Post Office, the Judge criticises the
parties for raising this as point of dispute when the answer was clear from the Common Issues. However,
Post Office has never claimed that Horizon had the ability to record a dispute. Post Office's case was that
disputes are raised through the helpline. This dispute method is acknowledged by the Judge at the end of
his answer
Issue (15): How did Horizon process and/or record Transaction Corrections?
This was substantially agreed by the parties. TCs are largely created and processed outside of Horizon
through manual actions, save for when a SPM accepts the TC in branch on the Horizon terminal. Disputes
to TCs are done by the SPM contacting the Helpline and again this is outside the Horizon system, which does
not record that dispute. If the dispute is upheld (as in, the original TC is accepted by the Post Office as
having been wrongly issued) then another TC will be issued to correct it. That subsequent TC will correct
the effect of the first TC in the branch accounts when it is accepted by the SPM. The issuing of the subsequent
TC is also done outside the Horizon system.
Do let me know if you have any further queries. Happy to arrange a call if that would be helpful.
Kind regards
Ben
Ben Foat
Group General Counsel
Ground Floor
20 Finsbury Street
LONDON
EC2Y 9AQ
Mobile :£
2A ACR RR Rf A RRR RA 1 RR RR RR RR A A RR RRR
This email and any attachments are confidential and intended for the addressee only. If you are not the named
POL-0019318
POL00022839
POL00022839
recipient, you must not use, disclose, reproduce, copy or distribute the contents of this communication. If you
have received this in error, please contact the sender by reply email and then delete this email from your system.
Any views or opinions expressed within this email are solely those of the sender, unless otherwise specifically
stated.
POST OFFICE LIMITED is registered in England and Wales no 2154540. Registered Office: Finsbury Dials,
20 Finsbury Street, London EC2Y 9AQ.
2A 2 4 RR Rf A RR Rf 12 RR FA 28 2 2 1328 28 2 fk 8 2 aaa
“Post Office Limited is committed to protecting your privacy. Information about how we do this can be found
on our website at www.postoffice.co.uk/privacy”
POL-0019318