POL00112955
POL00112955
Fe)
FUJITSU
Darten Jones MP
Chair, Business, Energy and Industrial Strategy Committee
House of Commons,
London
SWI1A OAA
Date
16 june 2020,
Dear Mr Jones
Thank you for your letter of 2 June 2020 setting out questions from the Committee as part of your inquiry into the Post
Office and Horizon. We are grateful for this opportunity to contribute to the inquiry and set out our answers to your
questions below.
We are committed to helping with all inquiries, including the Government Review announced on 10 June 2020, as well as
providing any assistance we can to the reviews being undertaken by the Criminal Cases Review Commission and the
Court of Appeal
The Judge in Bates v Post Office Ltd said that in giving evidence Fujitsu gave “a very one-sided picture which was to omit
any reference to important contemporaneous documents that criticise or demonstrate any deficiencies with Horizon”.
How do you respond to this criticism?
Fujitsu was not a party to the Bates v Post Office Ltd litigation. All decisions relating to the prosecution of sub-
postmasters and the conduct of the Bates litigation were made by the Post Office. Whilst Fujitsu employees gave
evidence, it was the Post Office who determined all aspects of its case including the choice of witnesses, the nature of
their evidence and the associated documents.
Nonetheless, we take Mr Justice Fraser's criticisms extremely seriously and we have now stopped the provision of any
new witness evidence to the Post Office.
Do you accept that there were some major issues with Horizon and, if so, when did you become aware of these issues and
how were they dealt with?
There were issues with the Horizon system; the process for identification and resolution of these has varied over the 20
year period of Horizon. Generally, issues were identified through sub-postmasters reporting issues they experienced to
either the Post Office or Fujitsu helpdesks, depending on the nature of the issue, or by regular performance monitoring
of the system. When an issue is identified, it is investigated and an attempt is made to resolve it. If the Fujitsu helpdesk
could not resolve an issue, it would be escalated to the service management team for further investigation. Any
unresolved matters relating to shortfalls in a sub-postmaster branch account would be referred to the Post Office.
Page 1 of 5
REGISTERED OFFICE
Fujitsu Services Linited
Registered in England no 96056
22 Baker Street, London, WIU 3BW
POL00112955
POL00112955
The Judge also drew attention to a letter from Ernst and Young in March 2011 which raised concerns about Horizon in
terms of “privileges and other critical matters’. What were these privileges and other critical matters, how did you address
them and how and when did you share this information with Post Office Ltd?
Ernst & Young (EY) were the Post Office's auditors and were engaged by the Post Office to carry out a review of their
internal controls systems. The March 2011 letter was written to the Post Office, however, extracts in which EY raised
issues relating to strengthening of privileged access rights were later provided to Fujitsu on 14 April 2011. The User
Access Procedure which deals with moving, transferring or changing access rights, as well as granting access rights to
Post Office staff, Fujitsu staff, contractors and third party staff, was updated in October 2011.
The Judge established that there were errors and bugs within Horizon and that remote access to Horizon terminals was
possible and transactions could be changed without a sub-postmaster knowing. He said that some of this only came to
light because of the Group Litigation.
Do you accept that local Horizon terminals could be accessed and altered centrally?
Yes, local Horizon terminals could be accessed and altered centrally.
Why did it take a highly expensive court case to establish these facts?
This is a matter for the Post Office; they determined the litigation strategy and their conduct towards the sub-
postmasters.
What role did Fujitsu play in investigations and prosecutions of sub-postmasters and postal workers who found shortfalls in
their Horizon accounts?
Fujitsu played no role in the decisions to investigate, prosecute, or otherwise seek to recover shortfalls from sub-
postmasters or postal workers. The Post Office devised and implemented the strategy for the recovery of shortfalls,
including conducting all investigations and prosecutions of its sub-postmasters and postal workers.
Fujitsu's involvement consisted of providing information and evidence to the Post Office upon request, and in accordance
with Fujitsu's contractual obligations. In most cases, this involved providing raw data drawn from the audit log of the
Horizon system (known as “ARQs"). In addition to the ARQs, when requested by the Post Office, Fujitsu employees
provided witness statements. The Post Office determined how, if and when these statements were used as part of its
own legal strategies.
Did Fujitsu work with sub-postmasters and postal staff to establish the nature of these shortfalls when they first arose?
If Fujitsu became aware of a shortfall, either by the sub-postmaster calling the Fujitsu helpdesk directly, or where the
sub-postmaster had called the Post Office helpdesk and the query had been referred to Fujitsu, we investigated the issue
and attempted to resolve it. Where the issue could not be resolved by the Fujitsu helpdesk, it was escalated to the
Fujitsu service management team for further investigation.
To the extent a shortfall had arisen, Fujitsu technical support would seek to determine the sequence of events that had
occurred, and then where appropriate would refer the matter back to the Post Office to handle directly with the sub-
postmaster for resolution.
Page 2 of 5
REGISTERED OFFICE
Fujitsu Services Limited
Registered in England no 96056
22. Baker Street, London, WIU 36W
POL00112955
POL00112955
How teliable is Horizon now and what steps are Fujitsu taking to ensure full disclosure of errors and bugs?
There has always been detailed processes, controls and mechanisms governing the exchange of information between
the Post Office and Fujitsu, which include the disclosure of any bugs and errors identified. Fujitsu produces a monthly
service review document, which contains a detailed view on Horizon system performance as well as details of any current
issues or incidents. Post Office and Fujitsu discuss and review this document at a monthly service review meeting. In
addition, relevant updates and details are shared bi-weekly between the Post Office and Fujitsu to ensure issues are
highlighted and there is appropriate coordination. There is also a weekly Knowledge Base Review to assess previous
incidents and contribute to the continuous improvement of the system.
Horizon operates to the service standards contractually required by the Post Office. However, in our view, no complex IT
system will ever be completely free of errors and bugs.
How many bugs, errors and discrepancies have been logged for each year since they began to be recorded?
The incident management system captures incidents logged, and includes matters raised by a sub-postmaster as well as
incidents raised by Fujitsu monitoring. The system has recorded thousands of incidents since the inception of Horizon,
as would be expected of a system of this complexity and size. However, in respect of material incidents, Mr Justice Fraser
highlights 29 bugs, errors and defects, some of which had the potential to impact a sub-postmaster local branch
account.
Can you provide a breakdown by error type and its implications for the integrity of a local Horizon terminal and for the
system as a whole?
In the Appendices to his judgment in Bates v Post Office Ltd, Mr Justice Fraser provides significant detail on the history of
Horizon and a summary of bugs, errors and defects since the inception of Horizon in 1999 including those that had the
potential to impact a sub-postmaster local branch account.
Do central Horizon terminals currently have access to local Horizon terminals in branches and, if so, how is this being used,
logged and documented?
Fujitsu is able to access local branch terminals, and is also able to access transactional data logs which are stored in a
central database. Remote access is needed in a number of different ways to manage the Horizon system, for example,
for retrieving log files from the branch device, administering servers and databases in the data centre and determining
foot causes of technical errors and taking remedial actions. Remote access is logged and centrally recorded.
The Judge in Bates v Post Office Ltd said that he had “grave concerns” about the evidence your employees gave and has
feferred it to the Director of Public Prosecutions.
How do you respond to this serious criticism of the evidence Fujitsu provided?
We take the comments from Mr Justice Fraser concerning the evidence provided by certain Fujitsu employees extremely
seriously. Given that this matter has been referred to the Director of Public Prosecutions, it is inappropriate to comment
further at this stage but we will fully cooperate with all judicial processes.
Page 3 of 5
REGISTERED OFFICE
Fujitsu Services Limited
Registered in England no 96056
22. Baker Street, London, WIU 36W
POL00112955
POL00112955
What lessons have you learnt from Horizon and how can you reassure my Committee that the type of issues detailed in
Bates v Post Office Ltd will not happen again?
The provision of witness evidence to support prosecutions under the direction of the Post Office should not have been
allowed to happen.
We have implemented the changes below, and will implement such further measures as may be appropriate following
any related judicial processes or inquiries.
« — Fujitsu has not provided any new witness evidence since the judgement.
« — Fujitsu will not provide any witness evidence in the future to support Post Office led prosecutions of sub-
postmasters.
« We will provide information if requested by the Police or an appropriate judicial authority but only after such
request has been fully considered, and with the approval of a UK board director.
Have any Fujitsu staff been disciplined or dismissed as a result of the issues associated with Horizon and/or regarding the
evidence they gave in Bates v Post Office Ltd?
In many cases key employees and decision-makers are no longer working at Fujitsu. If it emerges that any current
employee intentionally misled the court or otherwise failed to meet the standards expected from Fujitsu, then they will
be dismissed.
With regard to Mr Justice Fraser's referral of the individuals to the DPP, we understand that the DPP is conducting an
investigation; therefore, it would not be appropriate for us to comment. We will, of course, cooperate fully with this
investigation.
What has been the frequency and nature of the information and advice you provided regarding Horizon to:
Post Office Limited
Since the inception of Horizon in 1999, a huge amount of data and information has been provided to the Post Office
through extensive reporting processes, as is normal for a system of this size and materiality. Currently, these include:
«Business Continuity Planning Review: Monthly meeting to address continuity and contingency planning
* Business Impact Forum: To seek approval from the Post Office to fix or close open incidents.
«Capacity Management Review: Monthly meeting to discuss programme capacity topics
«Change Process Working Group: Monthly meeting discuss changes
¢ Commercial and Relationship Meeting: Monthly meeting to address commercial issues
« — Cross Supplier Problem Review: To resolve issues that affect multiple Post Office suppliers
© Customer Risk Review: Monthly meeting to identify and discuss programme tisk
«Digital Demand Forecasting Board: Quarterly meeting for demand forecasting
e — Enterprise Architecture Group: To review and approve High Level Designs and Key Design Decisions
¢ — Information Security Management Forum: Monthly meeting to discuss security related topics
— Joint Programme Board: Programme reviews aligned with Joint Release Acceptance Board
* Knowledge Base Review: Weekly meeting to review recent knowledge articles
Page 4 of 5
REGISTERED OFFICE
Fujitsu Services Limited
Registered in England no 96056
22. Baker Street, London, WIU 36W
POL00112955
POL00112955
«Patch Approval Board: To review and agree all patches and upgrades
¢ Problem Review: Fortnightly meeting
« Programme Review and Steering Board: Meeting of senior staff to review activities
« Service Management Review: Monthly service review
Government departments and/or UK Government Investments
The Post Office holds the relationship with the Government and UK Government Investments, as these are two of the
Post Office's key stakeholders. Naturally, if Government departments do reach out to us, then we will cooperate.
Did Fujitsu contribute to the Complaints Review and Mediation Scheme, and, if so, how?
The scheme was run and administered solely by the Post Office. Fujitsu's involvement was limited to providing system
and audit information to the Post Office upon request and in accordance with our contractual obligations.
Is Fujitsu playing a role in the current new scheme to assess applications from sub-postmasters who believe they had
experienced shortfalls related to previous versions of the Horizon system?
Iso, what is the nature of that role?
Fujitsu is not involved in the scheme. We are cooperating with the Post Office and providing information to support its
assessment of the sub-postmaster applications.
Do the issues surrounding Horizon raise questions about your ability to carry on providing IT to the Post Office but also to
other public bodies?
Fujitsu has been a trusted partner of the UK Government for over 50 years and we remain confident in our ability to
deliver high quality services across the UK public sector. We are committed to the role that we play in supporting critical
national infrastructure and essential services, whether that is supporting the Armed Forces at home and abroad, or
helping to secure the UK border.
We employ 7,000 people in the UK and continue to invest and innovate so that we can contribute to the UK's future. We
have a strong record in delivering for our public sector customers and supporting them through the challenges that they
face both now and in the future
Rob Putland
Senior Vice President
Page 5 of 5
REGISTERED OFFICE
Fujitsu Services Limited
Registered in England no 96056
22. Baker Street, London, WIU 36W