POL00029601
POL00029601
Message
From: Ron Warmington
on behalf of I Ron Warmington
Sent: 11/06/2013 23:40:
To: Steve Allchorn
cc: Lesley J Sewell
‘ I
Subject: RE: In Confidence - Spot Review 5 Response
Simon Baker
Pete Newsome
“} Susan Crichton
Sensitivity: I Company Confidential
Some more input for tomorrow's call:
I'm afraid only two of the seven documents that you enclosed seem to be relevant
to SROOS (and that's the 2-page Spot Review Response itself and the 8-page
“Horizon Data Integrity Document"). The other five, (in themselves excellent)
documents that were enclosed all relate to HNG-X (Horizon Online), which, as is
explained in Gareth Jenkins 5th October 2009 Affidavit, was rolled out between
January and September 2010. Those five documents are therefore irrelevant to
SROO5 which deals with a November 2008 event. Those documents may be useful
in dealing with some of the other Spot Reviews but I must disregard them in
dealing with SROOS.
The five irrelevant documents you have submitted to 2nd Sight in answer to
SROO5 include:
e Horizon Online Data Integrity for Post Office Ltd - 14 pages
¢ Gareth Jenkins 5th October 2009 Witness Statement - 11 pages
e HNG-X Technical Network Architecture - 144 pages
e Fujitsi Wide Area Network HLD document - 84 pages
e Network Security High Level Design - 68 pages
Luckily, we have picked up this basic error at this point and not while presenting
our Interim Report to a roomful of MPs. It would have been most unfortunate
were I to have paid heed to all those documents (which I have reviewed) and
accepted them as part of POL's response, only to have that gross error picked up
by one or more of the other interested parties in a high-profile meeting. Also,
does anyone at POL seriously think that a one-page Spot Review should be
answered by a 323 page response? What on earth are we to include as POL's
“Official Response" to that Spot Review in the Interim or Final Report? Do you
POL-0026083
POL00029601
POL00029601
intend to have Ian and I summarise your 323 pages (or even your 10 pages, which
anyway don't address the real issue) down to one?
I'm really looking forward to tomorrow's call. But we need to produce something
that is crisp, easy-to-understand, and that absolutely NAILS this really serious
allegation once and for all. What I've read here definitely doesn't do that.
Ron Warmington, CFE, FCA
Director
And. Siaht. Suonost Services Ltd
From: Ron Warmington [mailto:
Sent: Tuesday, June 11, 2013 6:45 PM
To: ‘Steve Allchorn'; ‘lan Henderson’; ‘Simon Baker’
Cc: 'Lesley J Sewell'; 'Alwen Lyons'; ‘Pete Newsome’
Subject: RE: In Confidence - Spot Review 5 Response
Sensitivity: Confidential
Steve/All:
I see the answers to SRO5 are in the PRESENT tense ("There IS no Physical or
Logical connection" and "The POL Bracknell Team have no access to the live
system ..." etc.). The questions were asked about the state of affairs on 19th
August 2008 so we are relatively disinterested in the CURRENT situation. We
need to know what the situation was back in 2008 please.
POL-0026083
POL00029601
POL00029601
Maybe it's me but I don't find the later statements, in POL's response to
Question 3, completely clear. First it says that:
“As both the original Horizon and replacement HNGx test systems were available
to the test teams in that period"... and then later in the same paragraph, it says:
"As stated in response to question 1, the teams in the area of Bracknell concerned
would have no access to the live system." Do I take it that the first statement
(i.e. the reference to the Horizon and HGNx (and what does that mean by the
way?) test systems) mean that both were TEST systems, not that the HNGx
system was test data and live data from the old Horizon system was available?
In any event, the response needs to be re-worded to answer the questions about
the state of affairs at the time in question rather than addressing the current
situation. Also, wasn't there some sort of central inputting of TCs? If so, were
any of those executed from Bracknell?
Also, the answer to Question 5 says: "On the old Horizon System (which was Live
in 2008) and Data introduced to the system in the Data Centre would not be
marked with any user ID." That sentence doesn't really make sense to me but in
any event doesn't it infer that data COULD be introduced into the live Horizon
system in the Data Centre? Could it? And if it could, what User IDs were
attached to such data?
What we then need to do is get to an explanation of POL's side of the story of
what really happened when Rudkin went to that basement. The current
response sort of tells us what could not have happened... but it offers no
explanation at all as to what really DID happen. Rudkin was quite specific about
adjustments to branch foreign currency balances. We need to nail this. What
WAS he hold (POL's side of the story please?). Absent that, I see virtually no
chance of getting to closure (with Rudkin; with the JFSA; with the MPs; and
ultimately with the media) on this weird situation.
Thanks and let's see if we can progress this tomorrow. Are we going to also go
through the longer (26 item) list of questions in tomorrow's call?
Ron
POL-0026083
POL00029601
POL00029601
From: Steve Allchorn [mailto
Sent: Thursday, June 06, 2013 11:49 PM
To: Ian Henderson; ‘Ron Warmington’
Cc: Simon Baker; Lesley J Sewell; Alwen Lyons; Pete Newsome
Subject: In Confidence - Spot Review 5 Response
Importance: High
Sensitivity: Confidential
lan/Ron
Please see attached formal responses to Horizon Spot Review 5 and a series of attachments supporting the response
document.
If you have any further lines of enquiry then please contact me.
Many thanks to Pete Newsome for co-ordinating the Fujitsu response in good time.
Steve Allchorn LIT & Change Lead CPMO Manager
1V 9HQ
From: Ian Henderson [mai
Sent: 03 June 2013 17:36
To: Steve Allchorn
Cc: Simon Baker; 'Ron Warmington’
Subject: RE: Follow up from call
Sensitivity: Confidential
Steve
’'m sorry for the delay in replying. There’s a lot going on at the moment...
l attach a copy of Spot Review 5 which describes the allegations that have been made.
The emails that have been forwarded to you appear to describe matters that may be relevant to the allegation, Please
note that we are primarily interested in finding out the following:
POL-0026083
POL00029601
POL00029601
1. What capabilities did the POL Bracknell team have? (As far as TC or Rem Out type transactions or Journal
adjustments are concerned}
2. What were the PHYSICAL or LOGICAL controls over their use of the systems available to them?
3. What audit trail is available to show the extent that they posted TC or Rem Out type transactions, or Journal
adjustments?
4. Can we reply of the COMPLETENESS of the audit trail? i.e. does it record all transactions or just transactions
meeting certain criteria? Is it protected from user manipulation?
5. What USER ID was used if TC type transactions or journal adjustments were posted?
6. Could the POL Bracknell team fog on with either super user or SMPR credentials?
7. How would TC, Rem Out or Journal Adjustment type transactions executed by the POL Bracknell team be seen
by SPMR of Branches affected by those actions?
There are probably other questions / issues that will arise after you have had a preliminary look at this.
Please note that we’re not really interested in what the procedures manual says about any of this. We need to look at
whether it would be possible for a rogue employee to do what is alleged and what log files would be generated to
record that activity. Please note that I have now been provided with a second batch of employee email and { may find
other emails that are potentially relevant to this matter.
Thank you for your help with this
With best wishes
Tan R Henderson CCE CISA FCA
Advanced Forensics - London, UK
Forensic computing expert witness and electronic disclosure specialist
UK Mobile:
Email: i. me
Website: http://advancedforensics.com
Linkedin: http://linkedin.com/in/forensicgod
Twitter: http://twitter.com/forensicgod
CONFIDENTIALITY. This email and any attachments are confidential and may also be privileged.
If you are not the intended recipient, please notify me at and
delete the email and any attachments.
From: Steve Allchorn [mailtof GRO }
Sent: 30 May 2013 12:
To: Ian Hendersor!
lve been forwarded the email stream below however having not been party to prior conversations or spoken to Susan
as she is formally off-work I just need to understand the context of the enquiry as the email pdf’s attached are a
collection of individual instances rather than a clear line.
My perception of what I think you need is;
POL-0026083
POL00029601
POL00029601
1) Aclear documentation/articulation of the end-to-end Transaction Corrections process, how it is applied and the
sign-off authorities that are in place (e.g. subpostmaster acceptance etc.}.
2) An understanding of how the attached email instances relate to that process and authorities.
Let me know if I’m on the right lines or not.
Thanks
Steve Allchorn LIT & Change Lead CPMO Manager
ntral Wing, 148 Old Street, LONDON, E
@ HQ
©
©
©
©
©
From: Susan Crichton
Sent: 28 May 2013 15:00
To: Steve Allchorn
Cc: Alwen Lyons
Subject: FW: Follow up from call
Sensitivity: Confidential
Steve ~ copy of some of the emails as extracted by lan Henderson, please can you forward to FJ as appropriate.
Susan
Sent: 28 May 2013 09:35
To: Si Crichton; Alwen Lyons
Sensitivity: Confidential
Susan
attach 11 emails from our preliminary review of the Bracknell data. Please note that I only received the second batch of
Bracknell data on Friday and it will take 3 or 4 days to process.
With best wishes
Ian R Henderson CCE CISA FCA
Advanced Forensics - London, UK
Forensic computing expert witness and electronic disclosure specialist
POL-0026083
POL00029601
POL00029601
UK Mobile: [
Website: 3 .com
LinkedIn: http://linkedin.com/in/forensicgod
Twitter: http://twitter.com/forensicgod
CONFIDENTIALITY. This email and any attachments are confid
If you are not the intended recipient, please notify me at
delete the email and any attachments.
ivileged.
and
From: Susan Crichton [mailt¢_
Sent: 24 May 2013 17:54
Subject: Re: Follow up from call
Sensi : Confidential
lan - thanks could you also send the details of the relevant emails to help us move forward this work next week.
Thanks
Susan
From: Ian Henderson [mailt
Sent: Friday, May 24, 2013 09:35 AM
To: Alwen Lyons; Susan Crichton
Cc: 'Ron Warmington’
Subject: Follow up from Call
As requested, please find attached the letter from JA to JFSA received by us on 19 April
lalso attach the Rudkin Spot Review sent to POL on 10 May
With best wishes
Ian R Henderson CCE CISA FCA
Advanced Forensics - London, UK
Forensic computing expert witness and electronic disclosure specialist
p: ¢s.com
Linkedin: http://linkedin.com/in/forensicgod
Twitter: http://twitter.com/forensicgod
CONFIDENTIALITY. This email and any attachments are confidenti a 04
If you are not the intended recipient, please notify me at I E
delete the email and any attachments.
POL-0026083
POL00029601
POL00029601
This email and any attachments are confidential and intended for the addressee only. If you are not the named recipient,
you must not use, disclose, reproduce, copy or distribute the contents of this communication. If you have received this in
error, please contact the sender by reply email and then delete this email from your system. Any views or opinions
expressed within this email are solely those of the sender, unless otherwise specifically stated.
POST OFFICE LIMITED is registered in England and Wales no 2154540. Registered Office: 148 OLD STREET,
LONDON EC1V 9HQ.
This email and any attachments are confidential and intended for the addressee only. If you are not the named recipient,
you must not use, disclose, reproduce, copy or distribute the contents of this communication. If you have received this in
error, please contact the sender by reply email and then delete this email from your system. Any views or opinions
expressed within this email are solely those of the sender, unless otherwise specifically stated.
POST OFFICE LIMITED is registered in England and Wales no 2154540. Registered Office: 148 OLD STREET,
LONDON EC1V 9HQ.
errrerrrereerrrrr rarer rrr trrersererrrrerer re rererr err erer errr
This email and any attachments are confidential and intended for the addressee only. If you are not the named recipient,
you must not use, disclose, reproduce, copy or distribute the contents of this communication. If you have received this in
error, please contact the sender by reply email and then delete this email from your system. Any views or opinions
expressed within this email are solely those of the sender, unless otherwise specifically stated.
POST OFFICE LIMITED is registered in England and Wales no 2154540. Registered Office: 148 OLD STREET,
LONDON EC1V 9HQ.
POL-0026083