POL00156685
POL00156685
Confidential and legally privileged
Briefing note for Counsel
Alan Bates & Others v Post Office Limited
1. Since 2009 Post Office Limited (“POL”) has faced complaints from sub-
postmasters (“SPMRs”) about their treatment by POL.
2. A small group of SPMRs have complained that cash shortfalls in their branches,
for which they were held responsible by POL were caused by POL’s computer
software, known as Horizon, and POL’s wider operational model. These
matters have been the subject of consideration and investigation by and on
behalf of POL on a number of occasions, as explained in greater detail below.
3. On 11 April 2016, a group of 91 SPMRs (former and current) represented by
Freeths LLP, issued a claim against Post Office Limited. This claim was issued
to protect against limitation issues and the Claim Form has been sent to, but not
served on, POL (attached hereto). On 28 April 2016, POL received a Letter of
Claim from Freeths (attached hereto).
4, This purpose of this briefing note is to summarise the legal and factual context
of this dispute by way of a high-level briefing ahead of a meeting between POL
and prospective Counsel. This note has been prepared from a compilation of
other documents and any views expressed below will need to be tested and
verified once Counsel is properly instructed and full documentation made
available.
4A_32907351_1 1
POL00156685
POL00156685
I. Post Office Limited, Sub-postmasters and the Horizon System
(A) The POL Business Model
5. POL is a limited company under the Companies Act 2006. As of 1 April 2012,
POL has been separately owned and managed from Royal Mail. The sole
shareholder of POL is the Secretary of State for Business, Innovation and Skills
but POL acts under the direction of its Chairman and Board of Directors, rather
than Ministerial control. However, because the sole owner of POL is the
Government, it is commonplace and appropriate to describe POL as expending
public funds.
6. There are approximately 11,500 Post Office branches around the United
Kingdom. They provide a range of mail, telephony, government and financial
products and services to the public. A Post Office branch is often a vital part of a
local community.
7. Some 350 of those branches are operated directly by POL, known as Crown
branches, in which the staff are employees of POL. These branches have not
been the focus of the complaints although it is alleged by Freeths that some
future Claimants may be employees from Crown branches.
8. The remainder of the branches are run by SPMRs on an agency basis, under
contracts with POL. SPMRs are, accordingly, independent business people.
Many operate additional businesses, and it is common that the Post Office
branch is found within a wider retail business, such as a newsagent or general
store. Every branch has a quantity - varying according to local demand and
branch size - of POL cash and stock (such as stamps) for which the SPMR must
account to POL.
4A_32907351_1 2
POL00156685
POL00156685
(B) The Legal Status of SPMRs
9. Although some SPMRs have argued the point that they are more akin to an
employee, there is no real dispute that SPMRs are agents of POL, under a
contract for services.' Clause 1 of the standard contract* between POL and
SPMRs states in terms that the SPMR is an agent of POL.
10. At common law an agent is obliged to keep an accurate account of all
transactions entered into within the scope of his agency and has to be ready to
produce that account at any time to his principal. The applicable contract
contains a clause to the same effect (clause 12.4).
11. Where an account is produced - such as automatically through an accounting
system - the burden of proof is on the agent to show that the account is wrong
and does not reflect the financial obligations he owes to his principal. In Camillo
Tank Steamship Company Limited v Alexandria Engineering Works (1921) 38 TLR
134, 143 Viscount Cave noted that:
“The expression “account stated” ... has more than one meaning. It sometimes means a
claim to payment made by one party and admitted by the other to be correct. An account
stated in this sense is no more than an admission of a debt out of court; and whilst it is
no doubt cogent evidence against the admitting party, and throws upon him the burden
of proving that the debt is not due, it may, like any other admission, be shown to have
been made in error.”
12. The general principle of the agent’s duty to account is contained in Shaw v Picton
(1825) 4 B & C715, 729 per Bayley J:
“It is quite clear, that if an agent (employed to receive money, and bound by his duty to
his principal from time to time to contmunicate to him whether the money is received or
not,) renders an account from time to time which contains a statement that the money is
Indeed, there is a judgment of the Employment Appeal Tribunal holding that SPMRs
are not employees (and not workers for the purposes of various pieces of legislation
either): Inland Revenue Commissioners v Post Office Ltd [2003] ICR 546.
Since 2011/2012 POL has been transitioning to a new suite of standard contracts and
some Claimants will be contracted under these new contracts.
4A_32907351_1 3
POL00156685
POL00156685
received, he is bound by that account unless he can shew that that statement was made
unintentionally and by mistake. If he cannot shew that, he is not at liberty afterwards to
say that the money had not been received, and never will be received, and to claim
reimbursement in respect of those sums for which he had previously given credit.”
The application of these standard agency principles to the SPMR context was
confirmed in Post Office Ltd v Castleton [2007] EWHC 5 (QB); [2007] All ER (D)
125 (Jan) in which POL sued to recover losses shown in the SPMR’s accounts.
(C) The Horizon System
13. Horizon is the name given to the computer system provided to POL under
contract by Fujitsu Services Limited (“Fujitsu”), formerly ICL. It is the system
used in all POL Crown branches, sub-Post Offices and outreach branches.
14. Fujitsu was awarded a contract with POL in 1996 to provide the Horizon
system. Horizon was rolled out to all branches between 1999 and 2002. Branches
migrated to an updated system known as Horizon Online (or HNG-X) over the
course of 2010. There is no significant difference between the practical operation
of the original Horizon system and Horizon Online. As the complaints raised
have spanned both systems, this note refers to both by the term Horizon.
15. Under the original Horizon system the data relating to each transaction was
processed and stored by a designated master terminal in each branch before
being transmitted in batches to a central POL data centre. Under Horizon
Online, each branch terminal now communicates directly with the data centre
on a transaction by transaction basis. In order to function, Horizon must be
online and each terminal connected to the POL data centre via a secure
communication line with a back-up system, provided by POL, usually
comprising a mobile telephone network.
16. Horizon is used by over 68,000 users in the 11,500 branches processing more
than six million transactions every working day.
4A_32907351_1 4
POL00156685
POL00156685
17. _ Transactions in Horizon can only be entered by someone with a user ID and an
associated password. Formal approval of a new user can only be carried out by
POL, but new users can be added to the system and allocated a user ID by an
SPMR when POL has given them ‘manager access’. The password is set by POL
or the SPMR and is subsequently managed and changed by the user.
18. Every record that is written to the transaction log has a unique incrementing
sequence number. This means it is possible to detect if any transaction records
have been lost. While a customer session is in progress, details of the
transactions for that session are normally held in the computer’s memory until
the customer session (often known as the ‘stack’) is settled (i.e. payment is
taken). At that point, all details of the transactions, including methods of
payment, are written to the hard disk and replicated. When the stack data is
successfully written the screen is updated (printing the relevant receipt means
the session is completed) to indicate a new customer session can be started.
19. _ Each stack, or basket, of a customer session consists of accounting lines. When a
session is settled, the payment process is also added as accounting lines. When
the value of the basket is zero it is sent to the data centre where the accounting
lines are recorded and committed. The effect of this is that either all of the data,
in the form of the accounting lines, is written to the local hard disk and the data
centre or none of it is written. The same approach applies to back office
transactions, such as inputting stock levels or reversing mistaken transactions.
20. All data that is written includes a ‘checksum’ value which is checked whenever
the data is read to ensure that it has not been corrupted. Any such corruptions
detected on reading will result in failures being recorded in the event logs
which are held on the local hard disk for a short period, and at the data centre
where they are held for seven years.
4A_32907351_1 5
POL00156685
POL00156685
21. I Where the data is not written or replicated, further attempts are made at regular
intervals. Once the data reaches the data centre, a further copy is taken and
written to the audit file which is placed into the audit trail where it is available
for retrieval for seven years. Data in the audit trail is digitally sealed with a
secure checksum that is held separately (in the form of a digital index) to ensure
it has not been tampered with or corrupted. Each audit record includes the
branch identifier, the counter identifier, the sequence number (i.e. the sequential
transaction identifier), and a counter timestamp.
22. Any failures to write to a hard disk, after the set number of retries, will result in
the counter failing and needing to be restarted. Such a failure will accordingly
be visible, even if it were not already evident because of, for example, a loss of
power. There is a specific recovery process which must be followed by the user
when the counter is restarted which involves various screen prompts.
23. Horizon adopts the principle of double-entry bookkeeping. As set out above,
this means that separate accounting lines are also generated for the tender items
(ie. the methods of payment), resulting in a total value of all of the accounting
lines in a basket adding up to zero. If, when being written, the net value is not
zero then an alert is raised and the basket is discarded.
24, The way in which the Horizon system is operated was described in accessible
terms in the Castleton judgment at [5]-[7]:
“Each computer terminal included a processor, a touch-sensitive screen, a keyboard, a
barcode scanner and a printer. The laid down practice, in outline, was and is as follows.
The clerk records on the computer all transactions that he makes. Transactions other
than on-line banking are recorded not only on the computer but also by a document,
such as a television licence counterfoil, savings bank deposit or withdrawal slip or a
cheque. Some transactions are known as APS (automated payment system) transactions.
Those are transactions where a customer either uses a card containing a magnetic strip
to pay a bill or pays a bill that is barcoded. There are corresponding APS slips recording
APS transactions. The subpostmaster is responsible for checking daily the computer
records of the transactions of the day against the documentation. He prints out the
computer records of the transactions, and when satisfied that they tally with the
4A_32907351_1 6
POL00156685
POL00156685
documentation he sends the documentation in sealed bags or envelopes by the last
collection of the day to the relevant centres. He receives cash, stamps and other cash-type
items from time to time in sealed bags and has to record daily the amount of cash held by
reference to the denominations of notes and coins. The subpostmaster is also responsible
for producing a weekly balance...
Every week, after close of business at 5.30 p.m. on Wednesday and before opening at 9
a.m. on Thursday [the stock is checked] as required by Post Office procedures.
It is obvious that the week's accounts of a post office balance if the difference represented
by the receipts minus the payments equals the difference represented by the value of the
stock at the end of the week minus the value of the stock at the end of the previous week.
If those two differences are not equal, there is a discrepancy. If the former difference is
greater than the latter, there is a loss, which is treated as a positive discrepancy. If the
former is less than the latter, there is a gain. That is treated as a negative discrepancy...”
25. As the judgment explains, the operation of Horizon as an accounting system is
effectively dependent upon the SPMR inputting the correct information into the
system.
26. I One issue which has occurred with some frequency is that an SPMR has falsely
declared onto the Horizon system the cash and/or stock position in order to
conceal a discrepancy. This is likely to constitute the criminal offence of false
accounting. When this has occurred it has rendered it more difficult, if not
impossible, for POL (and possibly the SPMR) after the event, to establish the last
point at which the accounts were correctly declared and locate the
circumstances in which the discrepancy occurred.
27. The Horizon system is the subject of three different industry standard
evaluations: ISAE3402 audits (carried out by Fujitsu and Ernst & Young);
Payment Card Industry Data Security Standards (carried out by Information
Risk Management plc, focussing on cardholder data); and Bureau Veritas
1SO27001 reports (over the Fujitsu networks).
(D) Training
4A_32907351_1 7
POL00156685
POL00156685
28. There is good deal of dispute about the level and quality of training SPMRs
received in particular cases. The nature of the training provided has changed
over time. This section of the briefing note seeks to summarise the history of the
training provided to SPMRs since the introduction of the Horizon system in
2000.
29. In brief, when Horizon was first introduced in 2000-2002, SPMRs were given
classroom training and then 10-11 days of on-site training and support, followed
by one day of support on balancing at the end of a trading period. In 2003-2006
new SPMRs received between five and ten days of classroom training if they
chose it, or five to ten days of on-site training and support, followed by one day
of support on balancing at the end of a trading period. In 2007-2011 new SPMRs
received between five to ten days of classroom training on sales and products
and then six days of on-site training and support, followed by one day of
support on balancing at the end of a trading period. Telephone calls were made
at the interval of one and six months, with a one day site visit after three
months.
30. Training was voluntary and SPMRs who had experience of working in Post
Offices may have chosen not to receive additional training. Further training
could be requested from POL. SPMRs are responsible for the training of their
own staff.
(E) Support
31. POL provides various methods of support to SPMRs, in relation to Horizon and
the more general operation of the branch. There are two different telephone
helplines which can be called.
4A_32907351_1 8
POL00156685
POL00156685
32. I The Network Business Support Centre (“NBSC”) is operated by POL (although
prior to 2012 it was effectively operated by Royal Mail) to provide support for
all operational issues arising in branch, including queries on the operation of
Horizon and on balancing issues. It has been in place since 1999. Queries which
cannot be resolved by the call-handler, or are not resolved to the satisfaction of
the caller, can be transferred to a second tier of more experienced call-handlers
or to managers. Branch visits may result where a problem does not appear to be
fixed over the telephone.
33. I NBSC call-handlers receive a four week classroom training course which
includes a Horizon test terminal, and then two weeks of supervised call-
handling. Call-handlers will principally answer a query by reference to a
detailed computerised encyclopaedia of explanations known as the Knowledge
Base. The Knowledge Base is periodically updated to reflect changes in
products and processes.
34. I The NBSC produces a log of all calls. This records the date, the branch, the
caller, a brief description of the problem, the call-handler and the resolution.
Those logs are available back to 2000, but they are reliant on the notes made by
the call-handlers at the time. In many cases, the resolution notes only that the
caller was given an answer from the Knowledge Base. Calls to the NBSC were
not routinely recorded.
35. I The Horizon Service Desk (“HSD”) was, until 2014, operated by Fujitsu (now
by ATOS) and deals with technical issues arising out of Horizon which an
SPMR has not resolved through the online information available to them. An
engineer will be sent out where a problem is not resolved. The HSD and NBSC
transfer calls between each other when the SPMR has called the incorrect
helpline. HSD call logs are retained for seven years.
4A_32907351_1 9
POL00156685
POL00156685
36. Support is also provided through in-branch field visits by advisors. They visit
branches to provide training, additional training or support when requested
and to carry out audits or other checks. Branches also have managerial
relationships, which may involve on-site visits from time to time.
(F) Third Party Business Involvement
37. POL is a point of sale and contact for a variety of products and services
provided by third parties. For example, Government documents such as DVLA
forms can be purchased from Post Offices, and utility bills can be paid through
the Horizon system. Similarly, many customers will pay for products, or make
cash withdrawals, from their bank account at the Post Office counter.
38. Important examples of third party involvement are: ATMs, which are (now)
provided through Bank of Ireland and require the SPMR to account for the cash
held in and transacted through the ATM; lottery products, which involve
accounting for the stock of scratchcards and the cash purchases of all lottery
products (and which can require reconciliation where the sales are made
through the SPMR’s separate retail business); and Paystation, which is a
payment device used for certain utility payments and top-ups. All of these
separate products and equipment require manual inputting into the Horizon
system to ensure that the SPMR accounts for the cash and stock passing through
his branch. The third party (such as Bank of Ireland) will receive their own
records directly from the equipment, and discrepancies between those electronic
records and the Horizon records manually inputted by the SPMR may require
adjustment.
(G) Accounting Discrepancies
4A_32907351_1 10
POL00156685
POL00156685
39. I SPMRs are required to balance their accounts (including all cash and stock) at
the end of every monthly trading period. In order to roll over into the next
trading period, the account must balance, i.e. it must not show a positive or a
negative discrepancy. Good SPMR practice will involve the SPMR carrying out a
weekly balance (of cash and stock) to ensure any discrepancy is promptly
identified. SPMRs are also required to undertake a daily cash (but not stock)
declaration on Horizon to show how much cash is being held in the branch.
40. I Where there is a discrepancy which cannot be corrected by reversing figures to
reflect the true picture (such as to correct an overstatement of stock), the SPMR
may make good that discrepancy by physically putting in cash from their
personal funds. Where the discrepancy is small, and is likely to be because of
minor errors at the counter, this is often the approach adopted.
41. I Where the sum is larger and the SPMR cannot or does not wish to simply pay it
off, or the SPMR does not understand how it arose, there are two choices.
During the monthly trading periods, the discrepancy can be moved to a local
suspense account while it is investigated by the SPMR with the assistance of
POL. Where there is, or remains, a discrepancy at the end of a trading period
the discrepancy must be settled centrally, i.e. placed into a central POL suspense
account, for resolution. In order to settle centrally, an SPMR will be reminded
that he is liable for any negative discrepancy which is not resolved. This reflects
the position under the contract and at common law, as set out above.
42. A discrepancy may be resolved through the issue of a Transaction Correction by
POL. These may occur in a variety of situations, but will reflect POL having
information that shows that figures inputted onto Horizon by a branch were
incorrect. This may be to the benefit or disbenefit of the branch. For example,
Horizon may have been told that more cash was sent back (or ‘remmed out’) to
POL in a pouch than the pouch actually contained. Alternatively, a cheque
thought to have been lost may have been discovered. Sometimes a Transaction
4A_32907351_1 1
POL00156685
POL00156685
Correction will be issued because of information from a third party, such as a
bank, that a transaction was cancelled. A Transaction Correction issued to a
branch must be acknowledged and accepted by the SPMR before it affects the
branch accounting position (however see below for an error that has occurred
with this proces).
(H) Investigation of Discrepancies
43, Where a significant shortfall is discovered at an audit, or is reported to POL,
POL will conduct an investigation into that shortfall and the responsibility of
the SPMR for it. That investigation could lead to a decision as to whether the
contract with the SPMR should be terminated and/or whether criminal charges
should be laid in respect of the SPMR’s conduct. Investigations are carried out
by POL’s own investigations and security department. POL’s records indicate
that between around 3,000-4,000 audits took place a year in 2011-2014. Only a
small proportion of these were random; most were either risk-based or on the
occasion of a change of SPMR.
44, In England and Wales, POL conducts private prosecutions of criminal offences
arising out of the misconduct of SPMRs. This is not in exercise of any special
statutory power; it is simply the choice of POL to adopt this course of action.
Thus decisions as to whether charges should be brought and what charges
should be brought are made by POL employees (taking account of appropriate
legal advice). Cases in Scotland are prosecuted by the Procurator Fiscal and in
Northern Ireland by the Public Prosecution Service (with the assistance of POL
investigators). The difference between the approach across the UK reflects the
different legal traditions.
4A_32907351_1 12
POL00156685
POL00156685
IL. The Horizon Complaints
(A) Initial Complaints
45. The complaints and allegations made publicly and to POL about the Horizon
system and associated issues commenced in earnest in 2009 with the
establishment of the Justice for Subpostmasters Alliance (“JFSA”). The core of
those complaints has always been that various SPMRs have been the subject of
criminal prosecution, civil recovery and/or contract termination in respect of
accounting discrepancies for which the SPMRs say they were not responsible.
Instead, it is said that Horizon is responsible. A wider element of the allegations
is that SPMRs received insufficient training and support in operating the
Horizon system.
46. During the course of 2010 the JFSA entered into correspondence with Ministers
and Members of Parliament about their concerns. The story obtained press
coverage from the BBC’s ‘Inside Out’ programme and articles in Private Eye.
47. In 2011, Shoosmiths threatened to bring a group action against Post Office in
relation to Horizon. They allegedly represented 150+ subpostmasters but, in the
end, claims were only advanced on behalf of five subpostmasters. Four of those
claims only resulted in pre-litigation correspondence between Shoosmiths and
Bond Dickinson. Shoosmiths issued one Claim Form (on behalf of an SPMR
called Lynn Prosser) in order to protect against a limitation deadline.
Shoosmiths did not serve the Claim Form on time and, after an interim hearing,
the Court struck out the Claim Form and found that the Claim was time barred.
Following this, no further action was taken by Shoosmiths.
4A_32907351_1 13
POL00156685
POL00156685
48. From late 2011 to May 2012 James Arbuthnot MP pursued the allegations made
by the JFSA and individual SPMRs with the Minister and POL. In May 2012, ata
meeting with James Arbuthnot MP and Oliver Letwin MP, POL agreed to
engage a firm of forensic accountants to review Horizon. During the course of
June and July 2012, following meetings with James Arbuthnot MP, other MPs
and the JFSA, Second Sight Support Services Limited (“Second Sight”) were
instructed by POL to conduct the inquiry. The remit of their inquiry was to
“consider and to advise on whether there are any systemic issues and/or concerns with
the ‘Horizon’ system, including training and support processes, giving evidence and
reasons for the conclusions reached” .*
49. The deadline for the submission of cases and issues for the consideration of
Second Sight was 28 February 2013. Some 29 cases were submitted through
James Arbuthnot MP and 18 cases through the JFSA. Second Sight issued an
Interim Report on 8 July 2013. Post Office assisted Second Sight with its
investigations of these cases, including providing general access to information
(including some privileged material) that it held.
(B) The Second Sight Interim Report
50. For the purposes of this briefing note, it is sufficient to note some of the core
statements made in the Second Sight Interim Report. Second Sight defined the
“Horizon system” to include not simply the software, but also all aspects of
using the system, the training and support provided to use the system and the
audit and investigation process into discrepancies shown by the system
(paragraphs 1.4-1.8). Second Sight noted that the limited number of complaints
it received “suggests that the vast majority of SPMRs and branches are at least
reasonably happy with the Horizon system” (paragraph 1.11).
‘The Second Sight Inquiry - the Detail’, Appendix to the Second Sight Interim Report.
4A_32907351_1 14
POL00156685
POL00156685
51. The Interim Report stated that Second Sight had carried out so-called “Spot
Reviews”. These were considerations of particular issues in certain of the cases
which referred to them. Four of these Spot Reviews were appended to the
Interim Report. Second Sight stated that differences between POL and the JFSA
had not been resolved, and POL had accepted only minor errors (paragraphs 5.6-
57).
52. Second Sight noted that POL had disclosed to it two defects in the Horizon
software which had impacted branches in 2010 and in 2011-2012, as well as a
further (unspecified) incident (paragraphs 6.4-6.10).
53. Second Sight criticised POL for a lack of thoroughness in their investigations of
shortfalls, and a focus on asset recovery rather than establishing the underlying
root cause (paragraphs 7.3, 7.6). A list of issues of concern was set out
(paragraph 7.2).
54. The Interim Report reached various preliminary conclusions (paragraph 8.2).
Importantly, those included that “We have so far found no evidence of system wide
(systemic) problems with the Horizon software”. They also included conclusions that
unusual combinations of events could give rise to a situation where timely
information is not available to an SPMR; that POL’s attitude to problems could
appear unsympathetic or unhelpful; and that investigations did not identify root
causes.
(C) — The Criminal Cases Review Commission
55. The CCRC is a statutory body with the power to refer criminal cases to the
Court of Appeal where it considers that there is a real possibility a conviction
may be overturned. POL was first contacted by the Criminal Cases Review
Commission (“the CCRC”) in July 2013 on a general basis noting the media
attention around Horizon and past prosecutions by POL.
4A_32907351_1 15
POL00156685
POL00156685
56. — In March 2015, SPMRs began referring their own convictions to the CCRC. This
has included some cases in which conviction followed a guilty plea. None of the
convictions was itself the subject of an appeal.
57. At the present time the CCRC is considering 25 cases. 19 of those involve
individuals who have made a complaint under the scheme discussed below.
POL is co-operating with any and every request for assistance from the CCRC.
At present it is unknown when the CCRC is likely to reach decisions on whether
any case should be referred back to the Court of Appeal. It is POL’s current
understanding that this is unlikely to be before the autumn of 2016.
(D) The Mediation Scheme
58. In an announcement of 26 August 2013, POL established an independent
mediation scheme for SPMRs, overseen by a Working Group (“the Scheme”).
The membership of the Working Group comprised POL, the JFSA and Second
Sight. Sir Anthony Hooper was appointed the Chairman of the Working Group
on 29 October 2013. The Working Group sought applications from SPMRs who
had a complaint about the Horizon system or an associated issue. Applicants
would have their cases investigated by Second Sight, with a view to mediation
of the dispute between the SPMR and POL.
59. By the time the Scheme closed on 18 November 2013, it had received 150
applications, of which 136 entered the full Scheme (ten were resolved before
entry and four were ineligible). 37 applications were from SPMRs who had been
convicted of a criminal offence.
60. POL contributed £1,500 (ex-VAT) to each Scheme applicant for the purposes of
obtaining professional advice to articulate the complaint. Each applicant
submitted a case questionnaire review (“CQR”) to POL and Second Sight. In
some cases evidence was supplied. Each case was then the subject of a detailed
4A_32907351_1 16
POL00156685
POL00156685
investigation by Post Office which produced a Post Office Investigation Report (
“POIR”) for each case on the basis of the evidence which could be examined,
given the passage of time. This evidence - depending on the application of the
seven year data retention period - included Horizon transaction records, NBSC
call logs, HSD call logs, training records, audit records and other related
correspondence. The POIR and supporting evidence were provided to Second
Sight, who would examine the material and issue a case review report (“CRR”)
setting out the areas of agreement and disagreement, the conclusions Second
Sight could draw and whether mediation was appropriate.
61. The Scheme applicant was provided with the POIR and the CRR (having been
given the opportunity to comment on a draft of the CRR). The Working Group
considered the suitability of each case for mediation. Cases which were accepted
as suitable, and which POL agreed to mediate, were referred to the Centre for
Effective Dispute Resolution (“CEDR”) for mediation to take place. POL met the
costs of the mediation, and provided up to £1,250 (ex-VAT) and expenses to
applicants for professional advice in relation to the mediation.
62. During the course of 2014, real concern grew on the part of POL and the JFSA
about the slow progress which was being made concerning Scheme
investigations. The JFSA objected to POL’s approach to mediation. Public
criticism of POL, including of its approach to the Scheme, on the part of MPs
(particularly James Arbuthnot MP) grew during the year. On 9 December 2014,
James Arbuthnot MP appeared on the Today programme and contended that
POL was sabotaging the Scheme and refusing to mediate 90% of cases. This
figure was not accurate, but POL considered itself bound by confidentiality and
so has not published any different figure.
63. By early June 2014 POL was having internal discussions about the possibility of
closing down the Working Group and resolving the cases in another way. POL
was also considering the replacement of Second Sight.
4A_32907351_1 17
POL00156685
POL00156685
64. On 10 March 2015 POL announced it would mediate all Scheme cases, save for
those which had been the subject of a court ruling (whether or not to mediate
those cases was to be considered case-by-case). This decision effectively
removed the core purpose of the Working Group. POL announced the closure
of the Working Group the same day.
65. Second Sight were instructed to complete the outstanding CRRs, and did so in
July 2015. This brought to an end their engagement by POL.
66. The JFSA encouraged applicants to withdraw from any mediation process and a
number did so. However, by the time the Scheme was brought to an end, a total
of 44 cases were mediated, resulting in 22 agreed settlements.
(E) The Substantive Second Sight Reports
67. During the course of the Scheme, Second Sight issued their substantive report in
two parts. The Part One Report was issued on 25 July 2014. It was in essence a
narrative describing how a Post Office branch worked, the systems used, and
the types of products and issues dealt with by SPMRs on a regular basis. Part III
of this note covers similar ground, but in considerably less detail.
68. A first version of the Part Two Report was issued by Second Sight on 21 August
2014. POL produced a reply document in September. Following the closure of
the Working Group, POL also instructed Second Sight on 10 March 2015 to issue
a completed version of their Part Two Report.
69. The final Part Two Report was issued on 9 April 2015. Where the Part Two
Report is referred to in this note, the reference is to the final version of the
report. POL also produced a reply to the Part Two Report.
4A_32907351_1 18
POL00156685
POL00156685
70. Second Sight report that their work was limited by POL’s refusal, with which
they did not agree, to provide three categories of information. Those were: (a)
the complete legal files; (b) the complete email records of POL employees
working at Fujitsu’s Bracknell office for 2008; and (c) detailed transactional
records relating to POL’s suspense account (paragraphs 2.1-2.19). As a result of
this failure, Second Sight concluded that POL “did have, and may still have, the
ability to directly alter branch records without the knowledge of the relevant” SPMR
(paragraph 2.12).
71. Second Sight also alleged that:
(1) The contract between POL and SPMRs was not always provided to
SPMRs and the contractual terms, placing responsibility for losses on
SPMRs, is “unfair” (paragraphs 3.6-3.8, 6.1-6.16).
(2) I Horizon was insufficiently error repellent, in that “the majority of branch
losses were caused by ‘errors made at the counter”, which could have
been avoided if the systems had been improved. Second Sight took the
view that POL had little incentive to do so (paragraphs 3.11-3.14).
72. The Report addressed 19 thematic issues drawn from the Scheme cases
(paragraph 1.10). (Only the more significant ones are addressed here.)
(3) I The ATMs introduced a vulnerability to error and fraud, had on two
occasions printed corrupted data and were likely at some point to have
been the subject of malware and/or criminal theft/fraud (paragraphs 7.1-
7.38).
(4) Accounting for foreign currency transactions was fundamentally flawed
because Horizon is a single currency system and individual transactions
could not be seen by POL (paragraphs 9.1-9.12).
4A_32907351_1 19
POL00156685
POL00156685
(5) The sale of lottery scratch cards prior to 2012 had too easily allowed for
errors in stock scanning, coupled with inconsistent NBSC advice and
delays in the issue of Transaction Corrections (paragraphs 10.1-10.15).
(6) Training was “probably adequate for people who had reasonable levels of IT
skills, numeracy and accuracy”, but it was not sufficiently clearly monitored
that the training was properly delivered and the ability to request
training did not help those who did not realise what they were doing
wrong (paragraphs 11.1-11.9).
(7) Errors were less attributable to inadequate training than adequate
support from the NBSC, which would have benefitted from sending
written instructions. Second Sight recorded the complaint that SPMRs
would be told that “it will sort itself out” but did not uphold or reject that
complaint. They accepted that the NBSC could not be expected to
determine how discrepancies arose and expectations of that facility were
unreasonable (paragraphs 12.1-12.9).
(8) I The periods of delay in issuing Transaction Corrections, often of high
value, posed real difficulties for SPMRs and might cause a temptation to
falsify the accounts in the hope that a subsequent Correction would
resolve the problem (paragraphs 13.9-13.14.)
(9) Second Sight addresses the POL denial that it is possible to amend branch
data remotely, referring to a number of documents disclosed to it from
2008 and 2010 which refer to correcting live data without the knowledge
of the SPMR, altering balances at the branch, although there was no detail
as to whether such amendments had been made (paragraphs 14.1-14.19).
They also recommended that where Horizon has reversed a transaction
(because a terminal is timed out before transaction is settled and
completed), the records should clearly show that it was the system which
4A_32907351_1 20
POL00156685
POL00156685
carried out the reversal rather than the user. There was no dispute that
this would not have caused a loss (paragraphs 15.1-15.7).
(10) Cash errors at the counter would be hard to detect, particularly following
the removal by POL of paying-in paper slips in 2008 (paragraphs 20.1-
20.20).
(11) It was possible for losses to occur in a branch as a result of power and
telecommunications failures, where it has not been possible for the SPMR
to follow the correct recovery procedures, particularly where the power
to a screen does not return and so messages are not displayed to the user
(paragraphs 21.5-21.15). It was possible, but unclear, that hardware
equipment failures could have caused losses (paragraphs 23.1-23.4).
(12) Some of the people appointed to an SPMR role “may have been unsuited” to
that role (paragraph 21.25). POL’s selection processes failed to reject
candidates who showed signs of inadequacy at interview and “proved
themselves to be wholly unsuitable” (paragraph 21.26).
(13) In the “specific and limited circumstances” of a person who was “unsuitable,
inexperienced or inadequately trained” who encountered problems
(particularly relating to the recovery process) Horizon was not “fit for
purpose” (paragraph 21.27).
(14) POL is responsible for detecting and acknowledging system or
procedural flaws that have allowed errors to repeatedly occur and not
providing the improvements to reduce or remove those errors
(paragraphs 21.30-21.31).
(15) POL investigators were focussed on seeking evidence of false accounting
to aid asset recovery rather than identifying the root cause of losses. In
some cases, a charge of theft did not seem to have been supported by the
evidence and was dropped as part of a plea bargain. Some of those
4A_32907351_1 24
POL00156685
POL00156685
decisions may have been contrary to the prosecutor’s code (paragraphs
25.1-25.24).
(16) In some circumstances Horizon “can be systemically flawed from a user's
perspective and Post Office has not necessarily provided an appropriate level of
support” (paragraph 26.8).
(PF) Parliamentary Debates
73. I There have been a number of Parliamentary discussions of the impact of the
Horizon system on SPMRs. These discussions include:
(1) I House of Commons debate of 9 July 2013;
(2) Westminster Hall debate of 17 December 2014;
(3) I The hearing before and evidence given to the Business, Innovation and
Skills Select Committee on ‘The Post Office Mediation Scheme and the
Horizon IT System’ on 3 February 2015;
(4) I House of Commons debate of 29 June 2015; and
(5) Prime Minister’s Questions on 1 July 2015.
74. This note does not further summarise or discuss these publicly available records
but suffice to say there has been an on-going and high level of Parliamentary
interest in the issue.
(G) — BBC Panorama Programme
75. On 17 August 2015 the BBC broadcast a Panorama programme ‘Trouble at the
Post Office’. It featured a number of SPMRs (who have been the subject of
criminal convictions, including some who had pleaded guilty to criminal
4A_32907351_1 22
POL00156685
POL00156685
charges), James Arbuthnot MP, Professor Charles McLachlan (who had
appeared as an expert witness in defence of Seema Misra when she was
convicted by a jury of theft, having pleaded guilty to false accounting) and a
former Fujitsu employee named Richard Roll.
76. Mr Roll said that he and his fellow Fujitsu employees saw a “Jot of errors, a lot of
glitches” on the Horizon system and that they “went in the backdoor and made
changes. Sometimes you would be putting in several lines of code in at a time. If we
hadn't done that then the counters would have stopped working” .
77. Following the broadcast, there was correspondence between POL and the BBC
in which POL complained about the reporting of the BBC.
4A_32907351_1 23
POL00156685
POL00156685
Il. Criminal Prosecutions
78. A total of 43 of the Scheme applicants’ cases involved criminal convictions, 37 of
them of the SPMR directly. The vast majority of these were for the offence of
false accounting (contrary to section 17 of the Theft Act 1968). In at least some
cases, SPMRs were also the subject of a charge of theft (contrary to section 7 of
the Theft Act 1968). Both offences require the prosecution to prove dishonesty,
but the offences are directed at different conduct and an SPMR may be guilty of
false accounting without being guilty of theft, in large part because the false
accounting offence is committed where the SPMR falsely declares he has more
cash than he actually does, even where this suggested gain is only intended to
be a temporary accounting gain in the hope that the money will turn up (R v
Eden (1971) 55 Cr App R 193).
79. Those subject to criminal convictions, or those on their behalf, have raised broad
areas of concern:
(a) whether their convictions were consequent on flaws in the Horizon
system and/or because of a failure properly to disclose such flaws during the
criminal proceedings, and for such reasons are not safe;
(b) whether POL acted appropriately in cases where it pursued charges both of
false accounting and of theft (or whether POL pursued theft charges in cases
where there was no proper basis in evidence to do so simply to encourage a
guilty plea to the false accounting charge); and
(c) whether it is appropriate for POL to conduct private investigations and
prosecutions (rather than leaving matters to the police and the CPS).
4A_32907351_1 24
POL00156685
POL00156685
(A) — Safety of Convictions and Disclosure of Information
80. None of the Second Sight reports identify systemic flaws in the Horizon system
likely to have caused the losses incurred at the Scheme branches. Rather,
operator errors at the counter is the usual cause identified by Second Sight (with
the likelihood of those errors being exacerbated by a problems in training and
support). At this point in time that there is no evidence that the Horizon system
- i.e. the computer system - is responsible for the losses which have resulted in
convictions.
81. So far as it concerns disclosure, POL has undertaken a considerable exercise
reviewing its compliance with its disclosure obligations (past and present). In
2013 it instructed Cartwright King Solicitors to review all criminal prosecutions
POL commenced since 1 January 2010 with a particular focus on identifying
those cases in which disclosure should now be made of the Second Sight Interim
Report and/or the Helen Rose Report (which is addressed in the next part of
this note). Cartwright King is the firm which conducts criminal law work on
behalf of POL. The scope and scale of that review was the subject of oversight
and advice from Brian Altman QC, who delivered interim advice on 2 August
2013 and a general review on 15 October 2013. Mr Altman QC considered both
the process adopted by Cartwright King, and their actual decisions in a sample
of cases, to be reasonable and appropriate.
(B) Sufficiency of Evidence
82. The allegation is that POL has too readily brought a charge of theft, which is
said to be more serious than false accounting, with the aim or effect that the
SPMR is pressurised into pleading guilty to false accounting in the hope that the
theft charge is dropped, and because a theft charge would more readily enable
4A_32907351_1 25
POL00156685
POL00156685
POL to recover its losses. There are approximately 19 Scheme cases in which
this, or something similar, occurred.
83. Whether POL had sufficient evidence to bring a charge of theft alongside
charges of false accounting is an accusation raised by a number of Scheme
applicants, as well as by Lord Arbuthnot and Panorama. It has also been a
matter raised by Second Sight in their Part Two Report.
84. This suggestion gained particular traction in Scheme case M035, Josephine
Hamilton (a case in which there was guilty plea to false accounting, in return for
which the theft charge was not pursued). In this case certain documents in the
prosecution file indicated that initial POL investigators could not find evidence
of theft (although there was clear evidence of false accounting), but theft was
nonetheless charged. In these documents there is an absence of clear
documented rationale for charging theft. That is not to say that no rationale
existed or could have existed, or can now be divined, but the lack of clear
reasons inevitably gives rise to cause for doubt.
85. POL’s position is that its prosecutorial decisions are always taken in accordance
with the Code for Crown Prosecutors, which requires that there be sufficient
evidence to provide a realistic prospect of conviction, and the prosecution must
be in the public interest. The decision to plead guilty is a matter for the
defendant alone. Any concerns they have about the legal advice they received at
the time is a matter only the defendant can pursue and is not the responsibility
of POL. Similarly, it is always open to the defendant to challenge the sufficiency
of the evidence disclosed to him or her and seek to have that charge dismissed.
86. POL has instructed Brian Altman QC to review the prosecution files of the
relevant Scheme cases to establish, on the basis of the facts and law at the
relevant time, whether there was sufficient evidence in accordance with the
Code to bring the charges which were brought. This review is ongoing.
4A_32907351_1 26
POL00156685
POL00156685
(C) POLas Prosecutor
87. Criticism has been levelled at POL for conducting private prosecutions, in
reliance on its own investigations. It is said (a) that POL does not have the
benefit of the specialist criminal expertise of the police; and (b) that prosecution
decisions lack the independent view that is applied by the CPS.
88. However, POL is as entitled to bring private prosecutions as any other legal
person (although few major commercial entities do so for internal matters) and
their investigations and prosecution decisions are designed to be carried out to
the equivalent police and CPS standards. Ensuring the police investigate
complicated financial records and transaction logs may also not always be easy
to ensure.
89. POL has also taken advice from Brian Altman QC who has advised that, if
prosecutions are to be conducted, then POL is better placed than the CPS to
conduct those prosecutions.
4A_32907351_1 27
POL00156685
POL00156685
IV. The Horizon System
90. As elsewhere in this note, references to the Horizon system, are references to the
computer programme and software developed and supplied to POL by Fujitsu,
and which POL requires to be used across all of its branches. This is this how an
ordinary person would interpret a reference to the Horizon system. It also
reflects the roots of the concerns of the SPMRs, although the reach of those
concerns has expanded over time. In essence, the allegation since 2009 has been
that Horizon is a flawed system which causes, through software errors and
possible third party action, branch balances to be altered to the disadvantage of
the SPMR. SPMRs are, it is said, being held responsible for losses which are
incorrectly generated by Horizon such that they do not reflect real losses to
POL. POL has always denied that there is any evidence that Horizon, as
opposed to user error on the part of SPMRs and their staff, has caused the
shortfalls for which the SPMRs are accountable.
91. There are three broad areas of concern which are addressed in turn below:
(a) Horizon system bugs;
(b) The thematic issues identified by Second Sight; and
(c) Whether branch balances can be affected by third party alterations
without SPMR knowledge.
(A) — Bugs in the Horizon System
92. It seems entirely unremarkable that the Horizon system, which is enormous in
terms of the range of matters it deals with and the number of users it has, will
occasionally discover bugs, errors or glitches in the way that it works. (For ease
such issues are referred to in this note as bugs.) Some of those bugs may impact
4A_32907351_1 28
POL00156685
POL00156685
on the financial position of a branch, either positively or negatively. Neither
POL nor Fujitsu suggest anything otherwise. The important point is the ease
with which such bugs are noticed and corrected, with remedial action to any
financial position taken where necessary.
93. There are a number of bugs which have been detected by Fujitsu through their
own work or the reporting of problems to them by SPMRs via POL. These
instances appear to be as follows.
(1) The Calendar Square, Falkirk problem discovered in 2005 (fixed in
2006). This issue was described in some detail in the evidence and cross-
examination of Mr Jenkins of Fujitsu in the criminal trial of R v Seema
Misra. It involved a failure by Horizon to recognise transfers between
different stock units and was visible as a receipts and payments
mismatch. Due to the antiquity of the issue, Fujitsu cannot confirm
whether any other branches had been affected by this problem.
(2) The receipts and payments mismatch problem, discovered in 2010 (see
the Interim Report, paragraph 6.5). This impacted 62 branches.
(3) The local suspense account problem, which occurred in 2011 and 2012
(and fixed in 2013) (see the Interim Report, paragraphs 6.6-6.9). This
impacted 14 branches. Fujitsu have explained that it reoccurred because
a particular balance reappeared each year in the annual accounts
between 2011-2013 until it was drawn to their attention and fixed.
(4) The Second Sight Interim Report refers at paragraph 6.10 to another bug
which was disclosed in witness evidence in court proceedings. It is not
clear whether that was the Calendar Square incident, or the unusual non-
polling event for 12 days at Winford Post Office referred to by Mr
Jenkins in his statement in R v Grant Allen.
4A_32907351_1 29
POL00156685
POL00156685
(5) There were also references in articles in Computer Weekly in November
2015 to a further bug which led to a branch being recorded as having
remmed out cash to an outreach branch four times instead of once.
Fujitsu’s analysis of this bug to POL dated 10 December 2015 explains
that the problem arises where a certain succession of actions concerning
cash pouches are entered, and then the system is left to time out, rather
than being logged out on completion. Fujitsu describe the issue as
having occurred 112 times since 2010 but that 108 of those were
corrected at the time either by a transaction reversal by the SPMR
spotting the duplication, or by a Transaction Correction issued by POL.
Four occasions appear not have been corrected at the time. None of the
uncorrected instances relate to Scheme cases.
(6) Between 29 June 2015 and 13 September 2015, there was a bug which
caused all Transaction Corrections to be accepted (even if the SPMR
pressed ‘cancel’). Again, this could have affected any branch, although
Fujitsu have confirmed that the problem was only raised by seven
branches.
94. Fujitsu have also confirmed that all of these bugs were generic ones; i.e. they
could have affected any branch. The reasons they affected only certain branches
were accidents of processing, as the particular chain of actions and steps
required for the bug to apply happened to occur only on those occasions in
those branches. (Or, in the November 2015 bug, because the situation could only
arise where there were outreach branches.) It is on this basis that POL holds the
view that the Horizon system works effectively and accurately for the
overwhelming majority of the time for the overwhelming majority of its users.
There are also back office checks and balances to make sure that SPMRs are not
held wrongly accountable for losses.
4A_32907351_1 30
POL00156685
POL00156685
95. There is nothing to suggest that these specific bugs identified have been the
cause of wider loss to SPMRs in the Scheme cases or otherwise.
(B) Thematic Issues
96. Second Sight’s Part Two Report addresses a number of areas of complaint raised
in Scheme cases which they describe as ‘thematic issues’. It is POL’s position
that few, if any, of those issues can sensibly be said to relate to any error in the
operation of the Horizon system. Second Sight recognise, largely implicitly, that
the themes they see are regular forms of errors at the counter on the part of
SPMRs and their staff. It is notable that nowhere in their Part Two Report do
Second Sight revise or disavow their conclusion in the Interim Report that they
have found no evidence of systemic problems with the Horizon software.
97. There is a considerable amount of documentation concerning those thematic
issues, including: the Second Sight Reports; POL’s responses to those reports,
including in draft; Spot Review paperwork; witness evidence provided by
Fujitsu in the course of criminal and civil trials which explain some apparent
concerns; and the detailed investigation work done in POIRs and CRRs for a
sample of the Scheme cases. While not every issue raised by SPMRs has been the
subject of a categorical answer or explanation (still less an accepted one), that is
inevitable in circumstances where the events in question happened some time
ago and an understanding of how the problem arose is dependent upon an
accurate explanation on the part of the SPMR.
98. As discussed in (A) above, the Horizon system does occasionally suffer from
bugs which have caused losses in some branches. Those bugs have been generic
in the sense that they have the potential to affect any branch, depending on how
it is structured. It is often the case that those bugs are identified when an SPMR
draws the attention of POL and Fujitsu to an odd situation which he or she
4A_32907351_1 34
POL00156685
POL00156685
cannot explain and which appears to have caused a discrepancy. When carrying
out their investigations into Scheme cases, investigators were looking out for
unusual or unexplained patterns of transactions which might have required
further technical examination by Fujitsu to confirm whether there was a wider
bug. No instance arose and Fujitsu were not asked to look at the records in any
case.
(C) — Third Party Action
99. I SPMRs have alleged that certain transactions appear in their transaction records
which they did not perform. There is, as a result, an allegation - usually generic
rather than specific - that branch records can be remotely altered by POL
and/or Fujitsu to the detriment of the SPMR.
100. The Scheme investigations show that in the vast majority of cases specific
transactions of concern have been readily explicable by common-sense
explanations; such as sharing of user identifications, or SPMRs being on leave,
or mistakes as to the timings. Other types of amendment of branch records -
Transaction Acknowledgements relating to third party information, and
Transaction Corrections issued by POL - require the acceptance of the SPMR
before they are adopted into the accounts on Horizon. (In some of the Scheme
cases, the shortfalls included unaccepted Transaction Corrections.)
101. A slightly different category is that discussed in the report drafted by Helen
Rose on 12 June 2013 in respect of the Lepton branch, which formed part of
Second Sight’s Spot Review 1 consideration. That discusses a Horizon record
that a transaction was reversed, and the assertion of the SPMR that he had not
carried out the reversal. Ms Rose discusses the fact that it only became clear
through detailed discussions with Fujitsu (in the person of Gareth Jenkins) that
the transaction was automatically reversed because of a system failure before
completion (as the system was designed to do), but that this was only clear at a
4A_32907351_1 32
POL00156685
POL00156685
level of raw data not apparent in the transaction logs available to the SPMR and
POL. Ms Rose raised the fact that the data available may appear misleading
depending on which report is retrieved from Horizon (although the origin of
the reversal is clearly stated in the raw transaction data). This is not, however, a
true example of the system altering branch records, as it is really Horizon not
completing a transaction due to a system failure of some kind. Ms Rose’s report
was available to Second Sight who agreed with her that the clarity of the
transaction logs should be improved.
102. The consistent position of POL and Fujitsu has been to the effect that transaction
records, and therefore branch balances, cannot be remotely altered without
SPMR knowledge. For example, in Fujitsu’s response to a draft of the Part Two
Report, dated 15 September 2014, paragraph 11.2 states “To be clear, any system
generated transaction requires a branch user to acknowledge and accept this transaction
and it is this operative’s id that is recorded as the primary id”. As an example of
POL’s expression of the position, its Response to the Westminster Hall Debate of
17 December 2014, dated January 2015, responded to the concerns raised by
MPs during that debate. At paragraph 47, POL states that “There is no
functionality in Horizon for either a branch, Post Office or Fujitsu (suppliers of the
Horizon system) to edit, manipulate or remove transaction data once it has been recorded
in a branch's accounts.” At paragraph 48, POL discusses Transaction
Acknowledgements and Transaction Corrections, reiterating that both be must
be accepted by the SPMR.
103. The issue of the ability to remotely alter branch balances derives from the case
considered in Spot Review 5, where an SPMR (whose wife was later convicted
of false accounting in a Post Office branch) alleged that he had visited the
Fujitsu Bracknell site in 2008, had been shown around by a member of POL
staff, and had been shown the ability of the team to alter the recorded holdings
of a branch. In their Part Two Report, Second Sight refer to their having
requested email records for all of the POL staff working at Bracknell in 2008 but
4A_32907351_1 33
POL00156685
POL00156685
only having been provided with those for August 2008 (when the visit took
place). Second Sight state these emails would be “the most compelling evidence on
this point” (paragraph 2.10). Second Sight confirmed to us that it is only those
wider tranche of emails to which they refer in paragraph 2.13 when they state
that it is “regrettable that we have not been provided with the further evidence we have
requested in order to reach a properly researched conclusion”. They nonetheless
concluded at paragraph 2.12 that their “current, evidence based opinion, is that
Fujitsu / Post Office did have, and may still have, the ability to directly alter branch
records without the knowledge of the relevant Subpostmaster” .
104. Martin Rolfe, who is the POL employee who carried out the tour in question,
explains, as POL has always stressed and Fujitsu have confirmed, that POL
employees at that time only had access to a test environment which was not
connected to the Horizon network. He believes that the SPMR must have
misunderstood what he was seeing, because the test screens would have looked
like the Horizon system but were not live or connected to actual branches.
Fujitsu have confirmed that the live network is accessible only to Fujitsu
employees in a secure area on a different floor of the Bracknell building.
105. It is possible that this secure area is what was being referred to by Mr Roll when
he spoke to the BBC Panorama programme, in which it is said by the reporter
that Mr Roll told him that “financial records were sometimes changed remotely
without the postmaster knowing” and which Mr Roll describes as going “in through
the back door”. It is understood that Mr Roll was a Fujitsu employee in the level
of line support which would have had access to the secure area. The specific
comments in the Panorama programme are, however, ambiguous and unclear
as to precisely what is being suggested was done.
106. Second Sight’s Part Two Report also obtained and quoted from documents
between Fujitsu and POL in 2008 and 2010, which suggested that Fujitsu had the
capability to amend or correct live branch data. The documents quoted in the
4A_32907351_1 34
POL00156685
POL00156685
Part Two Report at paragraphs 14.8-14.15 do suggest that Fujitsu does have the
ability to “manually write an entry value to the local branch account’. POL are noted
by Second Sight to say that the references in those documents to amendments
and corrections are inaccurate, because the system only allows additions to the
records which can be seen by the SPMR.
107. In May and June 2014, Deloitte produced two documents for POL entitled
‘Horizon: Desktop Review of Assurance Sources and Key Control Features’ and
an accompanying ‘Board Briefing’. POL instructed Deloitte to carry out some
review work as to how Horizon functions, the controls in place and the extent to
which it was achieving the objectives of the system. Deloitte’s work was a
desktop review of the operating documentation, including discussions with
Fujitsu and POL. It did not involve access to the system itself or testing
processes.
108. Deloitte note, following a review of the technical documentation, the ISAE3402
and verbal discussions with POL and Fujitsu, that database access privileges
which “would enable a person to delete a digitally signed basket” do exist, but are
“restricted to authorised administrators at Fujitsu”. Those privileges “would enable a
person to create or amend a basket and re-sign it with a ‘fake’ key, detectable if
appropriately checked”. Deloitte had not identified specific controls to prevent a
person with the appropriate authorisation carrying out this exercise in an
unauthorised manner. The Briefing goes on to state that administrators had the
ability to “delete data from the Audit Store during the seven year period, which was a
matter...contrary to POL’s understanding...This could allow suitably authorised staff
in Fujitsu to delete a sealed set of baskets and replace them with properly sealed baskets,
although they would have to fake the digital signatures”. Deloitte describe this
functionality as resulting, in essence, from the level of security contained in the
Horizon servers being a level down from the maximum.
4A_32907351_1 35
POL00156685
POL00156685
109. Fujitsu responded to this aspect of Deloitte’s investigation, based upon a
summary of the investigation provided by POL rather than the original Board
Briefing itself. Fujitsu appear to accept that Deloitte’s interpretation is
technically correct, but emphasise the wide range of security measures in the
software, hardware and environment which reduce the risk of interference.
Fujitsu also, properly, stress that there is no evidence that any such action has
occurred and that likelihood of all the security measures being overcome is so
small that it does not represent a credible line of further enquiry.
110. The fact that such activity is possible does not, of course, indicate that it has
actually occurred. Indeed, it is difficult to see why it would have done so.
Second Sight have suggested that Fujitsu employees could, in theory, run a
fraud in collusion with an SPMR whereby transactions were added to the
branch records generating cash payments out. Even if it may be theoretically
possible, there is no evidence for this and it is inherently improbable. An
alternative may be closer to Mr Roll’s account, which would be that Fujitsu
would use the functionality to correct system bugs without drawing them to the
attention of POL or SPMRs in order to avoid any form of contractual penalty.
111. Another issue expressly noted by Deloitte is the existence of a third mechanism
by which errors can be corrected: a Balancing Transaction. This is “an emergency
process, accessible only to restricted individuals in Fujitsu, which can create transactions
directly in Branch ledgers. This process creates an identifiable transaction in the ledger,
verbally asserted by POL staff to be visible to Sub-postmasters in their branch reporting
tool, but does not require positive acceptance or approval by the Sub-postmaster.”
Deloitte explain that they were told that this tool had only been used once since
2008 - in 2010 - and generated a full audit trail.
112. Although it is not entirely clear, it is likely that the admitted 2010 instance is the
same, or linked to, the 2010 documents referred to by Second Sight in their Part
4A_32907351_1 36
POL00156685
POL00156685
Two Report. Deloitte have scoped further work that could provide assurance as
the use of this function.
4A_32907351_1 37
POL00156685
POL00156685
V. The Support Provided to SPMRs
113. A consistent theme of the complaints made by SPMRs is that the training they
were provided was insufficient, particularly in relation to the accounting side of
their role, and that the support provided to SPMRs in office through the NBSC
was unhelpful or misleading. There have been allegations that NBSC call-
handlers advised SPMRs that discrepancies would ‘sort themselves out’ and
SPMRs have alleged that NBSC advised them to submit false accounts.
114. These issues have been addressed as comprehensively as possible by both POL
and Second Sight through their investigations of all the Scheme cases. Although
training records were not always available, NBSC call logs were available back
to around the year 2000.
115. It is inevitable that the ability of any investigation to definitively deal with each
individual allegation would be hampered by a number of factors:
(1) I Even where training records exist, if an applicant alleges that they
received less training than they should have done it will be very difficult
now to establish the correct position. Individual trainers, even if still
employed, are highly unlikely to remember training sessions many years
ago.
(2) I The NBSC call logs do not tend to provide the details of the call-handler’s
answer to any issue. They are often helpful in identifying the issue for
which assistance is sought, but the answer recorded is very often simply
that the SPMR was given an answer from the Knowledge Base, but not
which part of the Base or precisely what was said. Calls were not
routinely recorded.
4A_32907351_1 38
POL00156685
POL00156685
(3) The call logs are filled in by the call-handlers. It is highly unlikely that
even if a call-handler had suggested that an SPMR falsely account, the
advice would have been logged.
(4) As with the training, even if individual call-handlers were still employed
it is highly unlikely that they would be able to remember the details of
any individual call.
(5) I SPMRs have generally been unable to recall with any specificity the dates
or precise content of advice they received from the NBSC or HSD. This is
similarly unsurprising.
(6) I Anumber of instances were alleged by SPMRs whereby their discrepancy
doubled (or worse) when they followed the advice of the NBSC. The
advice given by NBSC - who had no access to the branch systems - was
dependent upon the caller correctly identifying the problem to the call-
handler. If the problem was misunderstood, then the corrective action
proposed might in fact exacerbate the problem. Working out now
whether the SPMR identified the correct problem, or the NBSC gave the
incorrect advice is not likely to be possible.
116. Calls to the NBSC were recorded against the identity of the call-handler, and
call-handlers were and are the subject of performance monitoring. Through its
external lawyers, POL has now undertaken an exercise to cross-reference
specific complaints that the NBSC provided misleading advice against the
personnel files of possible call-handlers to establish whether anything in the
performance monitoring or complaints might indicate that it was more likely
that a particular call-handler had provided misleading advice. The result of this
review was that nothing was found in the performance review documents to
indicate that there were any concerns about the quality of the advice given by
the call handlers in question.
4A_32907351_1 39
POL00156685
POL00156685
117. Second Sight concluded in their Part Two Report that the training provided by
POL was “probably adequate”, at least for SPMRs with reasonable levels of IT
skills, numeracy and accuracy (paragraph 11.1). When read with the criticisms
of the unqualified nature of some of the SPMRs appointed at paragraph 21.25,
this has to be taken as effectively meaning that the training was adequate for
SPMRs who were properly qualified and appointed to be appointed to run a
branch, Second Sight reiterate this finding at paragraph 12.5 when they say that
the errors at the counter made by SPMRs are more likely to be the result of
inadequate support than inadequate training. However, Second Sight are unable
to reach any evidenced view as to the allegations about the NBSC and HSD in
the light of the limited evidence now available (paragraph 12.8).
118. However, Second Sight do suggest that POL’s training programme required
more product-specific training (paragraph 11.1), greater accounting and
balancing training (paragraph 11.2) and that there was an insufficient degree of
quality control to deliver effective training (paragraph 11.7).
119. POL accepts that improvements to both its training and support can and should
be made. The Business Support Programme established in 2013 has made
various refinements to the training programme for SPMRs, to providing express
balancing support advice from the Branch Support Team and increasing the
tools available to the NBSC in assisting callers, including access to branch
transaction data and the recording of all calls (with a retention period yet to be
determined).
120. Angela Van Den Bogerd (POL Director of Support Services) produced a
‘Lessons Learnt Log’ dated 11 November 2015, which sets some 30 pages of
proposed changes to POL processes to address issues arising from the Scheme
investigations and the views of Second Sight.
4A_32907351_1 40
POL00156685
POL00156685
VI. Scheme Investigations
121, Those SPMRs who complained to POL via the Scheme about losses for which
they had been held accountable have had their cases and complaints
investigated by both POL and Second Sight.
122. An applicant to the Scheme would submit a case questionnaire review setting
out their grievance and what they wished to achieve from any mediation, along
with any supporting evidence that they had available. In some cases, this was
considerable. In many, it was minimal or limited. Many applicants took
advantage of the contribution POL made towards the cost of a professional
advisor.
123. POL would then investigate the details of that complaint and gather as much
documentary evidence as they were able to find, reaching what conclusions they
were able to on each aspect of the complaint. Depending on the age of the
events in question, POL was normally able to retrieve from Fujitsu the
transaction logs for the branch, any NBSC call logs and logs of calls to the HSD
or to Fujitsu. In some cases, POL was able to find training records and other
correspondence. POL also sought the audit records for the branch which
uncovered the shortfall, and the correspondence between POL and the SPMR
during the investigation and termination processes. POL produced a POIR
which addressed the specifics of the grievance by reference to the evidence
collected.
124. The POIRs were produced by two teams of POL investigators, made up of field
support advisors, who carry out the branch training and audit work, and some
security personnel (who would usually carry out internal criminal
investigations). All investigators were experienced on Horizon and many were
former SPMRs. They were not computer system experts, and Fujitsu did not
conduct their own analytical review of the relevant transaction logs.
4A_32907351_1 a
POL00156685
POL00156685
125. This material was then passed to Second Sight, who reviewed it, might speak to
the SPMR, and produced their own CRR expressing a view as to whether
mediation was suitable, along with findings in relation to the complaints made
by the SPMR. This work took some 18 months to complete, following the closure
of the application window for the Scheme in November 2013.
126. In the CQRs, very many of the SPMRs_ were unable to give much by way of
specific instances of concern, or anything other than vague and generic
complaints. Most of the cases involved a shortfall at audit of between £10,000-
20,000, but some cases gave rise to losses in the hundreds or thousands of
pounds. The cases involved a mix of time periods. Some spanned both the
original Horizon system (from 2000) and Horizon Online (from 2010), some
involved only one or the other. Most involved losses over approximately a two-
three year period, but some involved much lengthier periods. Some cases were
of considerable antiquity, which posed real and understandable problems of
evidential clarity, along with data retention.
127. In many cases, Second Sight broadly accepted the analysis of the evidence set
out in the POIR. Where it did not, it was usually because Second Sight felt
unable to express a concluded view. In none of the cases was Second Sight
willing to conclude that the shortfall was due to some form of systemic technical
failure of the Horizon computer system, although they did speculate that the
disproportionate appearance of power failures in the CQRs was likely to
contribute to some extent. Where Second Sight was able to reach a view, they
often accepted that the most likely cause of many shortfalls was operator error
on the part of SPMRs or their staff (albeit that this often came with a related
criticism around the training and support provided by POL to SPMRs which
may have contributed to these operator errors).
4A_32907351_1 42
POL00156685
POL00156685
128. Both the POIRs and CRRs were often unable to identify a specific cause of losses
which is not surprising. Most cases involved very little assistance from the
SPMR to highlight potential causes or even time periods. Where there was
assistance, the dates given often proved to be incorrect when the evidence was
examined. Moreover, the integrity of the transaction records is essentially
dependent upon the information inputted at the branch. It is extremely difficult
for any third party - or the SPMR after the passage of time - to review those
records to identify precisely what went wrong, although likely causes were
identifiable in many instances. Further, a proportion of the cases involved
blatant instances of false accounting, rendering POL’s task of assisting the SPMR
in working out where problems had arisen very much harder without an
accurate reference point from which to work - a point which Second Sight
accepted.
4A_32907351_1 43
POL00156685
POL00156685
VII. Group Action
129. On 11 April 2016, a claim was issued on behalf of 91 postmasters by Freeths
LLP. The Claim Form stated that the Claimants intend to make an application
for a Group Litigation Order so the number of Claimants could potentially rise.
130. The claim as described on the Claim Form is wide ranging and the Particulars of
Claim have not yet been received but, in broad terms, the Claimants allege that
they have been subjected to unlawful treatment by Post Office causing financial
losses, bankruptcy and criminal prosecutions among other heads of loss.
131. The claim is concerned with the reliability of the Horizon system but also a
number of connected issues discussed above including, by way of some
examples, the allocation of legal responsibility between SPMRs and POL, level
of training and support offered by Post Office to postmasters and Post Office’s
approach to investigating shortfalls at the Claimants’ branches.
132. There are also a large number of legal heads of claim, namely the following:
breach of express and/or implied contractual terms; breach of duties of care in
tort; breach of fiduciary duty; unjust enrichment; harassment under the
Protection from Harassment Act 1997; negligent misstatement; deceit; unlawful
means conspiracy; malicious prosecution; misfeasance in public office; breach of
the Claimants' rights under Articles 6 and 8 ECHR and/or Article 1 of the First
Protocol contrary to section 6(1) of the Human Rights Act 1998; and/or
procuring a breach of their common law fair trial rights and/or rights under
Article 6 and 8 ECIIR. and/or Article 1 of the First Protocol.
133. Freeths have not put any financial value on the claims. However, experience
from the Scheme suggests that the Claimants may have highly inflated
expectations around what they might recover. During the Scheme, many
SPMRs went into mediation seeking hundreds of thousands of pounds in
4A_32907351_1 44
POL00156685
POL00156685
compensation (despite having had the benefit of professional, and often legal,
advice). In practice, those cases that did settle, did so for low single digit
thousands (though a handful of cases with special circumstances settled for low
tens of thousands).
134. Of the 91 claimants, 70 were Scheme applicants and are therefore cases known
to POL. The other 21 claimants are unknown to POL and their cases will need
further investigation. Of 70 known cases, 6 have entered into settlement
agreements with POL, 24 have been convicted of criminal offences relating to
their tenure as an SPMR and up to 37 (some of which overlap with the 24
criminal cases) could be subject to limitation issues.
135. Freeths requested a response to their Letter of Claim within 30 days, namely by
28 May 2016. Bond Dickinson has written to Freeths indicating that it may take
up to 3 months to provide a full substantive response due to the complexity and
breadth of the issues involved. Work is currently underway to investigate a
number of the points raised in the Letter of Claim.
18 May 2016
4A_32907351_1 45