POL00126338
POL00126338
WY
Ally HERBERT
=> = SMT
UY SS FREEHILLS
“A
Solicitor to the Inquiry Herbert Smith Freehills LLP
Post Office Horizon IT Inquiry Exchange House
PO Box: Post Office Horizon Inquiry Primrose Street
5th Floor, Aldwych House rpaden, EC2A2EG. ;
71-91 Aldwych ~e
London, WC2B 4HN
www.herbertsmithfreehills.com
Our ref
9100/31048180
POLR930/LAS/20221118
Date
31 August 2023
By email
Dear Solicitor to the Inquiry
Post Office Horizon IT Inquiry - Hard Copy Document Update
1.
We refer to our letter of 22 August 2023 which provided an update on work arising from hard
copy documents. The purpose of this letter is to provide further updates in respect of those
workstreams.
2. At the outset we note that POL's outstanding workstreams arising from hard copy documents
predominantly relate to POL's efforts to conduct further re-assurance on materials that are
not obviously relevant to the Inquiry. However, POL continues to progress these
workstreams out of an abundance of caution.
Backup tapes
3. Our 22 August letter referred to 42 backup tapes having been originally identified at
Chesterfield. This was a typographical error. The correct number is 37 backup tapes (as set
out in our 29 June 2023 letter).
Origins of the backup tapes
4. These tapes were found at POL's Chesterfield site in a box and were unlabelled. POL was
unable to identify the contents of the tapes from a physical review. As such, POL started its
investigations into these backup tapes to assess whether they contained anything
obviously relevant to the Inquiry. POL attempted to do so, and continues to do so, ina
reasonable and proportionate manner given (i) that backup tapes are not usually
considered a repository to search for documents, given that they would usually contain
copies of data held elsewhere and (ii) the time and cost implications of processing such a
large and unknown amount of data onto a review platform and conducting any review. In
respect of (i), it is POL's understanding that in the past POL used backup tapes to backup
POL's various hardware (such as servers, computers etc.) in the event of their failure.
Herbert Smith Freehils LLP and its subsidiaries and Herbert Smith Freehills, an Australian Partnership, are separate member firms ofthe international legal practice
known as Herbert Smith Freehils
Herbert Smith Freehills LLP isa limited labilty partnership registered in England and Wales with registered number OC310989, It is authorised and regulated by the
Solicitors’ Regulation Authority of England and Wales. A list of the members and their professional qualifications is open to inspection atthe registered office,
Exchange House, Primrose Street, London EC2A 2EG. We use the word partner of Herbert Smith Freehills LLP to refer to a member of Herbert Smith Freehills LLP,
for an employee or consultant with equivalent standing and qualifications.
11182409965_7 1
%
M/
By
s
10.
11.
ZS
Z
POL00126338
POL00126338
Date
HERBERT
PREEHILLS 34 August 2023
Solicitor to the Inquiry
Given 4(i) and (ii) above, POL is taking a two-pronged approach to the backup tapes: first
using technical, policy-based and other means to identify whether the backup tapes contain
meaningful "new" information and second, concurrently taking steps to allow POL to review
the actual data on the tapes to identify whether the tapes contain new information. Clearly,
the first approach is designed to be quicker and more efficient than the second. These are
discussed further below.
Date ranges and parent comparison
A date range analysis of 19 datasets processed into the separate dedicated Relativity
workspace has been conducted, and the majority of the files continue to be from the period
2001-2008. A date range analysis has been conducted on the two smaller datasets in POL's
Inquiry Relativity platform and the majority of files are from 2007-2008.
KPMG is in the process of conducting a sample manual comparison of parent level emails
from the 21 datasets against the parent level emails on POL's Inquiry Relativity platform.
This process involves extracting a list of the parent level emails from both workspaces and
manually comparing those lists (at high-level) to check for duplicates. This sample exercise
will provide a quicker indication as to whether the material on the 21 datasets is duplicative
of data already harvested by POL. Machine time is required to extract the parent email lists
(approximately 1.8 million parent emails from the 21 datasets, and approximately 20.3 million
parent emails on POL's Inquiry Relativity platform), with further time required to manually
compare the lists; it is anticipated that this initial exercise will complete by 5 September 2023
(subject to machine time). As POL uses various Relativity platforms for Inquiry purposes, this
exercise may also be conducted over those review spaces.
Identification of user generated files.
Our letter set out that approximately 19 million files were ingested from the 21 datasets,
which reduced to approximately 4.8 million files after deduplication against the 19 processed
datasets in the dedicated workspace. For the avoidance of doubt, this totals approximately
5 million files when also accounting for the two smaller datasets ingested into POL's Inquiry
Relativity platform, which have not been deduplicated against themselves or the other 19
datasets.
At the date of our letter, 3.4 million files had been identified from 13 of the ingested datasets
as being ‘user-generated’. Following the completion of all 21 datasets being processed,
KPMG has identified approximately 3.7 million 'user generated! files (from the c. 5 million
files on the same - accounting for deduplication on the 19 datasets ingested into the
dedicated workspace).
Quality control checks of the 21 ingested datasets
Our letter set out that the 21 datasets ingested into Relativity were undergoing quality control
checks. Those quality checks remain on-going and KPMG envisages that it will take two
weeks to complete these. In order to progress this quickly, POL intends to run search terms
(discussed below) on the 21 datasets as they are now. The responsive documents will then
be migrated to POL's Inquiry platform. Following the completion of the quality control checks,
POL will run its search terms again and carry out a second migration of any responsive
documents.
Indicative timing to get to review
There are several steps that need to be completed before POL is in the position to consider
whether and how to review the significant volume of material currently identified on the
11182409965_7 2
ee
M/
By
12.
13.
14,
15.
ZS
Z
POL00126338
POL00126338
Date
HERBERT
PREEHILLS 34 August 2023
Solicitor to the Inquiry
backup tapes. Whilst POL is not yet able to confirm with certainty how long these steps will
take, POL currently estimates it may take between one and two months before POL has
identified a potential review pool. This will be subject to required machine time, which will be
dependent on the eventual data sizes that need to be migrated and deduplicated.
Once the search terms that will be applied over the 'user generated files from the 21 datasets
are finalised (expected to be completed shortly), it will take approximately 2 days to run the
search terms over the ‘user-generated files to identify the responsive documents that require
migrating. We understand from KPMG that it will take approximately two weeks for the
responsive documents to be migrated to the Inquiry Relativity platform, albeit this will be
subject to the final data size requiring migration.
The migrated documents will then need to be deduplicated. This will be a staged approach:
first the 19 datasets will need to be deduplicated against the documents within the two
smaller datasets already on POL's Inquiry Relativity platform. The remaining documents will
then need to be deduplicated against all other documents previously harvested by POL.
KPMG is not yet in a position to confirm how long this deduplication process will take.
Subsequent to this deduplication, POL will assess the data that is left (ie. documents which
are non-duplicative) and consider (i) further targeted searches and (ii) how any review might
be structured.
Subject to the deduplication results, given the large amount of data from these 21 datasets,
further consideration will have to be made to ensure any review is proportionate, with such
review only being done if it is considered likely to lead to the identification of appropriately
relevant information. POL will continue to keep the Inquiry informed and would welcome
Inquiry's thoughts on the appropriate approach to adopt.
POL's hard copy assurance exercise
16.
17.
18.
19.
In our letter we noted that POL was (i) awaiting a response from two teams regarding areas
which were not accessible during the assurance exercise, and (ii) that POL was trying to
obtain access to three locked rooms at three sites.
In respect of (i), POL has obtained a response from one team which has confirmed the area
has already been reviewed for materials relevant to the Inquiry. POL is awaiting a response
from the remaining team.
In respect of (ii), POL is continuing to try and obtain access to these locked rooms and is
arranging for a locksmith to access the same. In the interim, we note that two of the three
sites returned a nil response in the paper-based assurance exercise, with four documents,
following a review of 1,025 documents, being identified as responsive to Rule 9 Requests
from the third site. As such, POL does not anticipate that gaining access to these rooms will
give rise to the identification of a high volume, or any, relevant materials. However, out of an
abundance of caution, POL is continuing its efforts to gain access to these rooms for the time
being.
Further assurance on franchise sites
POL understands that there were certain franchise sites who, during the paper-based
assurance exercise, also did not have access to certain areas of their sites and/or there were
areas which were unsafe to enter. Given the low volume of relevant material that has been
identified during the paper-assurance exercise (only 82 documents have been produced to
the Inquiry) and the logistical challenges faced by POL in searching its franchise sites (as
set out in our 3 March 2023 letter), POL does not propose to conduct further assurance
11182409965_7 3
%
M/
By
>
ZS
Z
POL00126338
POL00126338
Date
HERBERT
PREEHILLS 34 August 2023
Solicitor to the Inquiry
checks on these franchise sites. POL will of course be happy to address any questions the
Inquiry may have in this respect.
POL vacating Finsbury Dials
20.
21.
22.
23.
In our letter we noted that POL was continuing certain investigations into electronic materials
that had been identified following POL relocating its Head Office from Finsbury Dials.
Namely, that (i) Peters & Peters was continuing investigations into certain CDs and (ii) that
KPMG was conducting some further assurance checks in relation to files which HSF could
not access on a hard drive.
In respect of (i), following further discussions with Peters & Peters, we understand that these
investigations are not Inquiry related and, as such, POL does not propose to keep the Inquiry
informed of the investigations going forward. However, should any Inquiry relevant materials
come to light during Peters & Peters investigations, POL will of course inform the Inquiry of
the same.
In respect of (ii), KPMG has accessed the files that HSF were not able to access. KPMG's
investigations confirm that the files contain programming/operating files and are not likely to
be relevant to the Inquiry. As a result, POL does not propose to further investigate the hard
drive.
Unless the Inquiry has any questions in relation to the above, POL considers this workstream
complete.
POL's indexing/reindexing exercise
24,
25.
26.
27.
POL is continuing its efforts to ensure the review of stage Ill and stage IV indexing is
completed as quickly as possible, whilst also maintaining the quality of the indexing being
completed.
In this respect, we note that HSF has reviewed the updated indexing that has been
completed to date for the stage Ill ‘neat’ indexing. This resulted in approximately 1,300
updates being considered and the identification of three boxes being potentially relevant to
Phase 3 of the Inquiry, albeit it is not considered likely that the material within the boxes will
be Rule 9 Responsive. These materials will be reviewed and any Rule 9 responsive material
will be produced.
POL is continuing its efforts to identify resource to assist it in the review of the ‘complex’
items for stage III indexing and will keep the Inquiry informed of its progress.
POL notes that as the quality assurance of stage IV indexing did not identify any ‘major’
inaccuracies — i.e. errors in the descriptions which would impact retrievability of the item, it
is less likely that items will have been missed for Inquiry purposes. As such, unless the
Inquiry requests otherwise, POL does not propose to continue to provide updates on the re-
review of stage IV indexing to the Inquiry. Of course, if any Rule 9 responsive material is
identified during this exercise, POL will produce the same to the Inquiry.
Electronic documents identified from POL's Chesterfield site - CDs
28.
In our letter, we noted that POL had conducted a review of 21 ARQ CDs identified from its
sample review of 42 encrypted CDs. 'ARQ' data here is Horizon audit data, containing a
record of transactions recorded on Horizon. Following this review, Peters & Peters had
identified the 21 ARQ CDs as unlikely to contain materials of relevance to the Inquiry based
on their metadata, because the documents post-date 2015 and therefore would not relate to
11182409965_7 4
%
\S
M/
DG
30.
31.
>
ZN
Z
POL00126338
POL00126338
HERBERT ome
PREEHILLS 34 August 2023
Solicitor to the Inquiry
the Rule 9 case studies. For the avoidance of doubt, POL does not propose to take any
further steps with these 21 ARQ CDs.
Our letter also noted that of the remaining 417 encrypted CDs, KPMG had catalogued all
417 CDs. Of these, 381 appeared to concern ARQ data and 33 appeared to concern
passphrase CDs, with three CDs labelled with miscellaneous names. We also noted that
KPMG had been able to extract data from a total of 408 CDs (with the remaining 9 CDs either
containing no data or data that cannot be copied).
KPMG has since identified that seven of the 408 encrypted CDs are not encrypted. KPMG
is further investigating the content of these seven CDs. Of the remaining 401 encrypted CDs,
KPMG has run the 60 passwords over the CDs and ‘decrypted’ 198 CDs, with 189 appearing
to concern ARQ data, eight appearing to concern passphrase data and one CD's content
presently unknown. KPMG has since confirmed that ‘decrypted’ in this sense means that a
password has been found to match the CD. The actual decryption will involve the relevant
passwords being manually applied by KPMG to the 'matched up' CD to access the data on
the same. KPMG envisage this process taking one day.
KPMG anticipates being in a position to circulate the decrypted ARQ CDs to Peters &
Peters for further review against Rule 9 Requests 6, 14, 17 and 22 shortly. We do not know
whether the Inquiry considers that it would be assisted by receiving ARQ data. If this is a
point on which the Inquiry has formed a view, we should be grateful for the Inquiry's
guidance. In the meantime, POL will consider the appropriate next steps in relation to the
non-ARQ/passphrase CDs identified by KPMG.
Electronic documents identified during the hard copy assurance exercise
32.
POL is continuing to engage with Burges Salmon and Fieldfisher in respect of next steps
for these electronic materials and will provide an update to the Inquiry in due course.
If the Inquiry would be assisted by receiving further information in relation to the above, please do
not hesitate to contact us.
Yours faithfully
Yferes Coun fascias LLP
Herbert Smith Freehills LLP
11182409965_7 5