POL00042698
POL00042698
Message
From: Andrew Parsons [/O=EXCHANGE-ORG/OU=EXCHANGE ADMINISTRATIVE GROUP
(FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=AD9ED344815E47E4AAA3COE7E17409 19-ANDREW PARS]
Sent: 28/05/2019 10:41:11
To: Ben Foat [f “yj; Rodric Williams
cc: Jonathan Gribben [/o=Exchange-Org/ou=Exchange Administrative Group
(FYDIBOHF23SPDLT)/cn=Recipients/cn=ea64a893cedd463ea82d76a4b08032dd-Gribben, Jo}; Charlie Temperley
[/o=Exchange-Org/ou=Exchange Administrative Group
(FYDIBOHF 23SPDLT)/cn=Recipients/cn=93d204967 1dc4d7393ed4433a868da7c-Charlie Tem]
Subject: RE: Global User Access - SUBJECT TO LEGAL PRIVILEGE [WBDUK-AC.FID26896945]
Ben
Would you mind sending me your email to GE so that I can say how it was put?
Andy
Andrew Parsons
Partner
Wombie Bond Dickinson (UK) LLP
Manage your e-alert preferences
> WOMBLE womblebonddickinson.com
</ BOND
DICKINSON
From: Ben Foat <7
Sent: 28 May 2019 1.
To: Andrew Parsons < ; Rodric Williams £
Ce: Jonathan Gribben >; Charlie Temperley
Subject: RE: Global User Access - SUBJECT TO LEGAL PRIVILEGE [WBDUK-AC.
Andy
Can you please draft something so I can send to GE and the working group contradicting my email over the weekend
where I said that our view was not to disclose.
Kind regards
Ben
Ben Foat
Legal Director
Ground Floor
20 Finsbury
Street
LONDON
EC2Y 9AQ
Highly Commended for
‘Excellence In-house’ at Mobile
the Law Society Excellence
Awards 2018
POL-0039180
POL00042698
POL00042698
This email and any attachments are confidential and intended for the addressee only. If you are not the named recipient, you must
not use, disclose, reproduce, copy or distribute the contents of this communication. If you have received this in error, please contact
the sender by reply email and then delete this email from your system. Any views or opinions expressed within this email are solely
those of the sender, unless otherwise specifically stated.
POST OFFICE LIMITED is registered in England and Wales no 2154540. Registered Office: Finsbury Dials, 20 Finsbury Street, London,
EC2Y 9AQ.
From: Andrew Parsons.
Sent: 28 May 2019 10:
To: Ben Foat Rodric Williams <r¢.
Cc: Jonathan Gribben >; Charlie Temperley <¢
Subject: RE: Global User Access - SUBJECT TO LEGAL PRIVILEGE [WBDUK-AC.FID26896945]
Ben
I have spoken with Counsel (Simon Henderson).
Simon's view is that disclosure should be given now because it is likely that this information may be relevant in later
breach trials. If it is disclosed later, this could lead to criticism that Post Office was not transparent about this issue
sooner. We therefore intend to disclose the attached document, as this provides a fair overview of the issue. This
document was prepared by Kim Abbotts and sent to Julie Thomas and Kendra Dickinson and so it does not appear to
attract legal privilege (except for one sentence in relation to the GLO which will be redacted).
We have also seen the attached email, but as this was copied to lawyers and responds to a question from you, this email
appears to be subject to legal privilege. We do not intend to disclose this email.
if we give disclosure of the Abbotts document, this may iead to requests from the Cs for more disclosure. We recommend
addressing those requests if and when they are made.
Kind regards
Andy
Andrew Parsons
Partner
Womble Bond Dickinson (UK) LLP.
womblebonddickinson.com
WOMBLE
BOND (@)
)
DICKINSON wy)
From: Ben Foat <
Sent: 27 May 2019 1.
To: Andrew Parsons <g Rodric Williams ¢. GRO
POL-0039180
POL00042698
POL00042698
Ce: Jonathan Gribben < p
Subject: RE: Global User Access - SUBJECT TO LEGAL PRIVILEGE [WBDUK-AC.FID26896945]
I will put a holding response into the ARC paper but I will need to know on Tuesday what is Counsel’s position — do we
disclose or not. I understand that our preliminary view is that we won’t subject to Counsel.
Can you let me know asap on Tuesday Counsel’s recommendation.
Thanks
Ben
Sent from Mail for Windows 10
From: Andrew Parsons <} GRO
Sent: Sunday, May 26, 2019 11:18:04 AM
To: Rodric Williams; Ben Foat
Cc: Jonathan Gribben
Subject: RE: Global User Access - SUBJECT TO LEGAL PRIVILEGE [WBDUK-AC.FID26896945]
Rodric
Coyne accepts that Post Office Global Users have to be physically located in a branch to access a Horizon terminal
(Coyne 2, 4.12) and therefore this is not a form of “remote access" within the scope of the Horizon Issues. However,
there is a second type of Global User at Fujitsu who can logon to something called a Global Branch (which are counters
physically located on FJ's campuses), which FJ use for resetting user passwords in real branches. There is a dispute
between the experts (Worden 1, 1099) as to whether a FU Global User could, in theory, log on to a Global Branch and
from there inject a transaction in to a real branch's accounts.
My understanding of the issue below is that when certain members of staff left Post Office, their access credentials were
not revoked creating a risk that they could have returned to a branch and conducted transactions. Given the above
analysis, it appears that the experts agree that Global User access by Post Office is not a form of "remote access” and
therefore does not fall within the scope of the Horizon Issues. Accordingly, the issue below is of fringe relevance to the
litigation.
We will speak to Counsel to determine whether this matter needs to be disclosed in the litigation. At present I don’t
believe that Post Office is strictly required to disclose this information, but given the Cs attacks on our disclosure, we may
wish to disclose it for transparency.
Kind regards
Andy
Andrew Parsons
Partner
Wombie Bond Dickinson (UK) LLP.
Manage your e-alert preferences
POL-0039180
POL00042698
POL00042698
\ WOMBLE womblebonddickinson.com
BOND —
DICKINSON W) fin)
From: Rodric Williams <.
Subject: Global User Access - SUBJECT TO LEGAL PRIVILEGE
Ben,
Following discussions I had today with WBD (Andy Parsons and Jonny Gribben, both cc’ed), I set out below my draft
summary of the impact the “Global User / JML” issue may have on the Group Litigation. This has been drafted for you to
use, subject to any comment from WBD, in briefing the ARC and/or Board next week.
Jonny is sitting in for me at Finsbury Dials on Tuesday and can provide further assistance as required around the ARC and
Board meetings.
The main impact of this issue to the Group Litigation is whether it needs to be disclosed to the Claimants:
- Global User access was raised at an early stage by the Claimants’ IT expert Jason Coyne as a type of “remote
access”, i.e. Post Office personnel access to Horizon which could affect an individual postmaster’s branch
accounts, for which the postmaster should not be held responsible.
- We challenged this because the access is undertaken physically in the branch (and would therefore be known to
the postmaster and/or branch staff) under their own individual user login details (which are recorded and visible
in the branch transaction records).
- WBD are checking urgently whether this point, which was only ever peripheral, was then abandoned by Mr
Coyne. This involves tracing it back through Mr Coyne’s two reports and the four joint reports prepared by the
experts.
- Whether this issue has generated documents which are adverse to our case on Horizon’s “robustness” is more
nuanced, and there is no clear guidance on what constitutes an “adverse” document as it arises under the new
disclosure protocols which were only implemented last year.
- Onone hand Post Office changed a process which left open the possibility that a former employee would
continue to use their Global User ID after they had left Post Office. That might suggest a weakness in the
Horizon control environment, and therefore a less robust system.
- On the other hand the control environment can be said to have worked properly, as it identified through audit a
process gap, which was relatively confined and appears to have been rectified without any impact to a branch
(see Kendra Dickinsons’s email of 0643 on 24.05.19; copy attached).
- Myview is that disclosure is not necessary. However, I would like the external legal team to advise on this given
the challenges raised by the Claimants about the fullness of our disclosure.
Andy/Jonny — please comment on the above and below as appropriate, and confirm receipt of the instruction to advise
(with input from counsel as necessary — I understand Katie from your team was going to discuss this with Owain Draper
for counsel’s view).
DRAFT BEGINS
Global User rights have existed since Horizon Online was introduced in c.2010. Their existence and the access
they provide to Horizon is therefore known and has been disclosed as part of the Group Litigation.
Post Office may need to give to the Group Litigation Claimants further disclosure of the current, JML-related
issue concerning the controls around Global User rights. This is because Global User rights was considered by
the Claimants’ IT expert at an early stage of the litigation to be a form of “remote access” to Horizon, and the
POL-0039180
POL00042698
POL00042698
operation of effective controls around Horizon goes to its robustness, both of which are issues being considered
in the Horizon Issues trial. Whether (and if so to what extent) such disclosure should be given is being addressed
urgently by Post Office’s lawyers in the Group Litigation. It is considered that any such disclosure (if made) is
unlikely to have a material impact on the Group Litigation, given the recent and confined nature of the JML-
related issue.
DRAFT ENDS
Please let me know if you need anything further.
Rod
a Rodric Williams
Head of Legal - Dispute Resolution & Brand
20 Finsbury Street
London EC2Y 94Q
JESS SEIS IS IOKIORIORI ORI ISI GIGI OKIE ORIG HOR IOKIOKAGKIORAC IACI IG AG ACACIA ICA I OK AOR A
This email and any attachments are confidential and intended for the addressee only. If you are not the named
recipient, you must not use, disclose, reproduce, copy or distribute the contents of this communication. If you
have received this in error, please contact the sender by reply email and then delete this email from your system.
Any views or opinions expressed within this email are solely those of the sender, unless otherwise specifically
stated.
POST OFFICE LIMITED is registered in England and Wales no 2154540. Registered Office: Finsbury Dials,
20 Finsbury Street, London EC2Y 9AQ.
FICO ICICI IOI CI I OR I OR CK I 2 3 2k 2k i 2k fe 2k fe 2k ek af 2 ake a ake ak af af fea aR ake a ae a 2k a 2k a 2k a a a ake ae af ae 2k ae 2k fe ak afc ak ae ake ae ake oe ake
“Post Office Limited is committed to protecting your privacy. Information about how we do this can be found
on our website at www.postoffice.co.uk/privacy”
POL-0039180