POL00333344
POL00333344
Don
Burges 4 fieldfisher
Salmon
Solicitor to the Inquiry ‘One Glass Wharf
Post Office Horizon IT Inquiry
5th Floor, Aldwych House
71-91 Aldwych
London www.burges-salmon.com
WC2B 4HN DX 7829 Bristol
By email
Our ref: AW15/CJ01/65113.3 9 January 2024
Dear Solicitor to the Inquiry
Requests for statement pursuant to Rule 9 of the Inquiry Rules 2006 - following Chair's Directions
dated 14 September 2023 - update in relation to the structural review
We refer to the First Witness Statement of Christopher Michael Jackson dated 19 December 2023 (‘CJ1”)
provided in response to the Inquiry’s requests fora witness statement from Mr Jackson pursuant to Ruk 9 of
the Inquiry Rules 2006 dated 31 October 2023 and 17 November 2023.
Appendix 3 to CJ1 anticipated Post Office providing the Inquiry with an update in relation to certain structural
review activities. In summary, structural review adivities are ongoing but positive progress has been made
generally and since CJ1 was drafted. We have set out a more detailed update below.
To help this letter be read alongside CJ1, we haveused the same defined terms and terminology used inthe
statement.
1 ESI STORED ON EMEDIA
Investigation of the five servers and twelve back-up tapes located at Chesterfield
141 The five servers have asset numbers AF510115, M503NWFAP1, M53BLDC1, M53BLBOA01 and
BL49XXDC3, to which we refer for precision.
1.2 Analysis is continuing but investigations have been progressed in relation to all five servers. Past
Office's current understanding is set out below.
1.3 AF510115 hosts virtual hard disk files for virtual machines (i.e., files that are used to emulate the
functionality of a physical computer). AF510115 does not contain user data (i.e., data created or used
by individuals), so itis not believed to contain anything likely to be of evidential relevance. Accodingly,
further examination of AF510115 does not appear tobe something that would assist the Inquiry.
1.4 M53BLBOA01 hosts the same virtual hard disk files for virtualmachines as AF510115. It also does
not contain any user data. Accordingly, further exanination of MS3BLBOA01 does not appear to be
something that would assist the Inquiry.
15 M503NWFAP1 contains more than 700GB of deleted user data butonly a small amount of live user
data. From the available metadata, it appears that any deletion of data on this server would have been
before 24 May 2016 as that is the date of the last recorded time a user logged on to the server.
WORK\51094617\v.1 Classification: Confidential
6 New Street Square, London EC4A SBF Atria One, 144 Morrison Street, Edinburgh EH3 BEX
Tol: +44 (0}20 7685 1200 Tel: +44 (0)131 3142112
INVESTORS IN PECPLE
‘Burgas Salmon LLP i a limited Kabilty partnership registered in England and Wales (LLP number 06207212, SAA ID 401114), and f authored and
i ve pee if ‘ . We invest in people Platinum
regulated by the Solicitors Regulation Authoty.Itis also regulated by the Law Sociely of Scotland. is registred offeeis at One Glass Whar, Bristol
1852 02X. Alistof the members may be inspecied at its registred offce. Further information about Burges Salmon entities, including data of thei
regulator, fs Set out on the Burges Salmon website at vw burgos-san
POL00333344
POL00333344
[Page 2 en}
i January 2024 Burges 4
1.6 Many deleted documents have been recovered, alhough it has not been possible to recover all files
and metadata. The file path names on this server seem to be consistent with file path names on the
NAS Drive (which, as explained in our letters to the Inquiry dated 10 and 17 November 2023, contains
a copy, created in around 2018, of the data that was stored on the Post Office File Share). Using
information from available records, the users who accessed MS503NWFAP1 seem to have been Royal
Mail Group employees/contractors who appear to havebeen involved in file server migration work. It
appears likely MS03NWFAP1 was used to populate othe data repositories and there is a material
possibility that the data recovered on M503NWFAP1 will be duplicative of NAS Drive data rather than
new data. Post Office will however conduct furtherinvestigations to test that current understanding and
will update the Inquiry.
17 BL49XXDC3 contains more than 400GB of deleted user data but aly a small amount of live user data.
From the available metadata, it appears that any ddetion of data on this server was before 28 June
2016 as that is the date of the last recorded time a user logged on to the server.
1.8 As with M503NWFAP‘1, the file path names on this server are consistent with file path names on the
NAS Drive and BL49XXDC3 was accessed by the same users as MS50O3NWFAP1. The same working
conclusions have been reached for BL49XXDC3 as forMS03NWFAP1. Post Office will conduct further
investigations to test that understanding and willupdate the Inquiry.
1.9 The data on M53BLDC1 has been deleted and is unrecoverable with forensictools. Therefore, it is not
known whether M53BLDC1 ever contained any user data As M53BLDC1 does not contain accessible
data, it is not a potential source of new data on a standalone basis.
1.10 However, eleven of the twelve tapes appear, fiom their external labelling, to relate to M53BLDC1.
Accordingly, it is possible that they will contain data that was at one stage, on M53BLDC1. The external
markings of those eleven tapes also indicate that hey relate to different periodic backup cycles forthat
server. If that is the case, there would be a matetial possibility that the data on each tape would be
significantly duplicative of the data on other tapes.
1.11. All twelve backup tapes have, in recent days,been restored and are now in a condition in which hey
can be subjected to further analysis, which Post Ofice has commissioned.
1.12 We will continue to update the Inquiry on Post Office’s further work to examine M503NWFAP1,
BL49XXDC3 and the twelve tapes. Given the technology involved, progressing those investigations
may take a material period.
Confirmation of understanding relating to the NAS Drive data
1.13 As explained in our letter to the Inquiry dated 17 November 2023, Post Office has been liaising wth
Accenture to obtain further assurance about Post Ofice’s understanding (summarised in our letter of
17 November) that, up to 2018, Post Office File Share data is duplicative of the NAS Drive (a previougy
known repository of data) and, since 2018, Post Office File Share would not have been used for user-
managed shared drives or folders, which are likelyto be of most interest to the Inquiry.
1.14 Post Office had hoped to complete that work ahead of the upcoming disclosure hearing on Friday.
However, investigations to date indicate that Post Office File Share may remain more active than
previously understood. Further investigations in cmjunction with Accenture are necessary to
understand whether Post Office File Share continuesto host user-managed shared drives or folders
and, if so, whether data stored in them could be ofevidential relevance to the Inquiry and not duplicative
of data already collected from other sources.
1.15 Post Office is seeking to establish how long hose investigations will take and we will update the Inquiry
once that timeframe has been clarified.
Validation of historical assumptions about the likely probative value of eMedia
1.16 This work is materially progressed and we remdn of the view that it will be completed within the
timeframe anticipated in Appendix 3 to CJ1 (i.e., by the end of January 2024).
WORK\51094617\v.1 Classification: Confidential
POL00333344
POL00333344
Page 3 en}
i January 2024 Burges 4
Review of custodian disclosure questionnaires to e¢ablish whether further collection of eMedia is required
1.17 This work is materially progressed and Post Office remains of the view that it will be completed within
the timeframe anticipated in Appendix 3 to CJ1 (i.e., by the end of January 2024).
1.18 Post Office wants to ensure that the Inquiry is aware of decisions Post Office has made relating to the
collection of data. Accordingly, by way of update, Post Office has not identified (after investigations of
users, including by questionnaires that have asked custodians to provide details of their WhatsApp
usage) repositories of WhatsApp messages reasonably anticipated to be responsive as substantive
evidence to the Inquiry’s Terms of Reference and Canpleted List of Issues so has not collected
WhatsApp messages from custodians’ eMedia devices €.g., smartphones). Post Office would be
happy to discuss this with the Inquiry and hopes that providing this information will facilitate that
engagement if it would be helpful.
1.19 Post Office will continue to investigate custodians’ WhatsApp usage and will keep decisions relatng to
the collection of WhatsApp messages under assessmert when considering future requests for
documents from the Inquiry and in light of knowledge acquired through disclosure and structural review
processes.
2 ESI EXCLUDING EMEDIA
Identification of the extent of Post Office's live data universe
24 CJ1 contained details of the collaborative workto identify the full extent of Post Office's electronic data
universe. That systematic exercise has been completd for Post Office’s enterprise data universe in
its current form (i.e., the extant architecture of software, data repositories etc. implemented for use by
Post Office).
2.2 Ongoing feedback ‘loops’ are a key element of he EDRM disclosure model. If information comes to
light that indicates the potential existence of a new data source, Post Office will respond to that
information and will update the Inquiry as it has n the past in relation to data sources (for example, our
letters of 10 and 17 November 2023). A system has been established to ensure that an effective
feedback loop exists between those who are reviewirg documents (which might indicate the existence
of data sources) for the purposes of providing disdosure to the Inquiry and those who are involved in
conducting the structural review.
2.3 Having completed that identification work, a systematic review of preservation work and arrangemerts
(which was anticipated in Appendix 3 to CJ1) has been commenced. It is materially progressed but is
ongoing. We anticipate it will take several further weeks fully to complete this work.
24 Through that review Post Office has identified that litigation holds (i.e., technical settings implemented
to prevent the permanent deletion of documents by automatic or deliberate processes) have been
implemented in various places within Post Office's data universe at different times.
2.5 As stated at paragraph 38(a) of CJ1, Post Office's understanding is that a litigation hold was
implemented across the Post Office in respect of Exchange mailfiles from March 2021. The
preservation of mailfiles since 2012 has also been supported by the email journalling function of
Mimecast and its predecessor ProofPoint and the retntion period for Mimecast data is in practice
indefinite (up to 100 years). We are continuing towork with Post Office to confirm any prior litigation
holds applied to individual custodians prior to theglobal litigation hold applied from March 2021 (se
further below).
2.6 However, the technical settings that can be apjied to different Microsoft Office 365 applications are
not uniform. We are instructed that Post Office has sought to preserve documents within different
Microsoft Office 365 applications using different combinations of technical settings. For example, a
user's documents stored on OneDrive would have beenretained for five years after they were manually
deleted (there was no automatic deletion) or the user left the Post Office (whichever was earlier) unil
WORK\51094617\v.1 Classification: Confidential
POL00333344
POL00333344
Page 4 ay
i January 2024 Burges 4
March 2021’. In March 2021, that retention period was extendedto seven years. An indefinite delete
prevention setting was applied to OneDrive in October 2023.
27 We understand that the position now across all Post Office’s Microsoft Office 365 applications is that
there are technical settings applied ‘tenant-wide’ (i.e., across the Post Office’) that ensure documents
are retained forever, even if users delete them.
2.8 We also understand that adjustments continue tobe made to litigation holds, document preservation
notices and related guidance to improve the robustress of the arrangements that seek to ensure the
preservation of potentially relevant documents andreduce the likelihood that such documents could
be permanently deleted.
2.9 Post Office would welcome the opportunity to engage with the Inquiry to seek to provide the furthe
details the Inquiry considers would assist it.
Activities relating to the Mimecast/Exchange issue
2.10 Wewill write separately today in relation tothis issue.
Validation of historic preservation activity across other ESI data sources
2.11 This work is materially progressed. However, nvestigations are ongoing.
2.12 We understand from investigations to date thatthere was a particular focus in the GLO proceedings
on preserving documents by issuing document presenation notices (i.e., formal notices informing
individuals that they should not delete or destroy documents) and taking forensic copies of data
repositories (sometimes referred to as images).
2.13 We are also seeking to establish what technicd settings were implemented to prevent the permanert
deletion of documents, when they were implemented ad how those settings compared to the
technological capability to apply those settings available at relevant times.
2.14 There continues to be a number of challenges n establishing the position, including the relativdy
limited availability of long-term institutional knowledge, the fact that certain activities may have been
locally rather than centrally coordinated and the Imitations of technological audit features in relation to
checking historical changes to technical settings.
2.15 While we continue to target completion within the timeframe anticipated in Appendix 3 to CJ1 (i.e, by
the end of January), it is possible that this work will take longer.
Review of ESI received in the past from third parties to establish whether further collection of ESI is required
2.16 This work is ongoing in relation to priority Post Office third-party advisers. We are instructedthat key
advices were requested from third party advisers pfor to our involvement. Post Office is mapping what
documents have been requested, what documents havebeen provided and where those documents
are stored so that they can be searched, if necessary, in response to Inquiry requests.
2.17 Certain factors limit Post Office's ability to validate that it has been provided with copies of all
documents that it has requested from third parties. In particular, Post Office does not have full visbility
of the documents in the possession of third parties (i.e., where Post Office requests categories of
documents, it is limited in its ability to check that it has been provided with copies of all document in
the possession of a third party that Post Office would consider fall within that category).
2.18 Further, Post Office is aware that third partes are likely to possess documents that might respad to
the Inquiry's terms of reference and completed list of issues that Post Office does not have a right to
' This period would have started with the introducton within Post Office of Microsoft Office 365. Before that, the ability to apply technical
settings to seek to preserve documents was differert and generally more limited.
? For completeness, it is not possible to apply the same settings to F3 licence holders. F3 licences are assigned to Post Office staff in front
line roles (typically counter staff and van drivers) who do not use a computer for day-to-day work but occasionally need to access some
Post Office resources.
WORK\51094617\v.1 Classification: Confidential
POL00333344
POL00333344
Page 5 en}
i January 2024 Burges 4
possess (i.e., that are not within Post Office’s control). In particular, The Law Society's practice note
“Who owns the file?” and guide on “Ownership of documents” indicate that, where a solicitor was acting
as a professional adviser, certain categories of documents in the matter file belong to the solicitor rather
than the client, which means that a client is not able to compel production of certain parts of the file,
including, for example, drafts and working papers and copies of internal emails and other
correspondence.
2.19 Those complexities and the unavoidable reliance on third party timescales mean that this work is taking
longer than was originally anticipated. It is anticipated that material work will, therefore, continue
beyond January 2024. Post Office will continue to update the Inquiry.
2.20 Post Office would be happy to engage with the Inquiry in relation to documents in the possession of
third parties. Post Office recognises that the Inquiry has greater powers than Post Office to require the
production of documents and will seek to provide to the Inquiry any information Post Office considers
might assist the Inquiry in assessing whether to invoke those powers.
3 HARD COPY DOCUMENTS
Post Office enhanced self-certification process supplemented by an on-site search by Innovo Law
3.4 Post Office’s enhanced self-certification process supplemented by an on-site search by Innovo Law is
complete. We respectfully refer the Inquiry to HSF’s letter to you dated 20 December 2023 and to the
witness statements of Brian Stanton, Deirdre Domingo and Michael Moore (all of Innovo Law), which
we understand have now been filed.
3.2 Post Office is considering whether any further reasonable validation work is appropriate and will, in any
event, continue to respond to information identified through the ongoing EDRM feedback loops.
Post Office reindexing of hard copy documents stored in Oasis archives
3.3 We understand that the reindexing exercise has been completed. We are collating a consolidated
further update to the Inquiry, which will provide details of whether Post Office expects to provide further
disclosure in connection with reviews of the updated indices. That update will be provided shortly.
Review of custodian disclosure questionnaires to establish whether further collection of hard copy documents
is required
3.4 This work is materially progressed and we continue to anticipate that it will be completed within the
timeframe anticipated in Appendix 3 to CJ1 (i.e., by the end of January 2024).
Post Office will continue to update the Inquiry on an ongoing basis. If it would be helpful, Post Office would
welcome the opportunity to engage with the Inquiry in relation to these issues.
While the EDRM model was the subject of evidence at the previous disclosure hearing (on 5 September 2023),
given its relevance to the structural review and for ease of reference, we have enclosed a further copy with this
letter (which can also be accessed directly from EDRM at Current EDRM Model - EDRM}
Yours faithfully
BURGES SALMON LLP and FIELDFISHER LLP
Enc. Current EDRM Model
WORK\51094617\v.1 Classification: Confidential