POL00460591
POL00460591
@
Summary of the Horizon Issues Judgment
(Bates and others v Post Office Ltd [2019] EWHC 3408 (QB) (Judgment (No. 6) "Horizon Issues") (16/12/19)
Background
As part of the preliminary steps in the case brought by Alan Bates and others (the claimants) against Post
Office, it was agreed that the Court should, amongst other things, resolve various issues relating to the
operation, functionality and reliability of the Horizon systems provided by the Post Office with support from
Fujitsu.
The Court looked at questions around:
(i) bugs, errors and defects in Horizon including whether Horizon was ‘robust’ as well as looking at
accuracy and integrity of data, whether it was possible for bugs errors and defects in Horizon to
have the potential to cause discrepancies in branch accounts, and the controls and measures for
preventing/fixing bugs and developing the system; and
(ii) the operation of Horizon including remote access, availability of information and report writing,
access to and/or editing of transactions and branch accounts, branch trading statements, making
good and disputing shortfalls, and transaction corrections.
The Judge concluded that it was possible for bugs, errors or defects of the nature alleged by the claimants to
potentially cause apparent or alleged discrepancies or shortfalls in Subpostmasters' branch accounts or
transactions.
He also concluded that, although later iterations of the computer system were far more robust, Legacy
Horizon "was not remotely robust", and that there was a "material risk" of shortfalls in branch accounts being
caused by the computer systems in use between 2000-2010 and between 2010-2017.
The judgment makes numerous criticisms regarding the approach to the litigation in this case, but areas of
particular interest include witness and expert evidence and disclosure (see Appendix).
Decision
The Judge concluded:
1. it was possible for bugs, errors or defects of the nature alleged by the claimants to have the potential
both: (a) to cause apparent or alleged discrepancies or shortfalls relating to Subpostmasters’ branch
accounts or transactions, and also (b) to undermine the reliability of Horizon accurately to process
and to record transactions. He also concluded that not only was there the potential for this to happen
but that it had happened.
2. Regarding ‘robustness’:
a. Legacy Horizon "was not remotely robust",
b. the first iteration of Horizon online was “slightly more robust”, but the robustness was
questionable and did not justify the confidence routinely stated by Post Office in its accuracy.
c. The current version of Horizon is far more robust than either of the previous two iterations
of the system.
d. the increase in robustness in part developed from around 2017 from Post Office discovering
bugs, errors and defects in live use and then applying fixes and improving monitoring.
e. there is a "material risk" of shortfalls in branch accounts being caused by the Horizon system
in use between 2000 and 2010 and between 2010 and 2017.
3. There is a material risk for errors in data recorded within Horizon to arise in: (a) data entry, (b) transfer
or (c) processing of data in Horizon in both the Legacy Horizon and initial Horizon online forms.
POL00460591
POL00460591
4. If the data in Horizon was wrong (due to bugs, errors or defects within Horizon) and did not reconcile
with third-party data, then “manual corrective fixes” and the issuing of Transactional Corrections
(TCs) would be undertaken, which would not be an automatic process. Post Office used Transactional
Corrections (which are outside of the Horizon system per se) to adjust branch accounts. This required
Subpostmaster consent to implement, but if disputed it was recorded outside of Horizon system and
a second transactional correction was issued to correct the first. TCs were issued ~2000 times per
week from 2006 and 23% were successfully challenged by Subpostmasters as wrongly issued.
5. There were many measures and controls within Horizon that existed to prevent, detect, identify
report or reduce the risk of varying errors and for detecting system integrity concerns, however these
automatic mechanisms had been shown to have failed in the past.
6. Post Office was able to read, and Fujitsu was able to read and access transaction data recorded by
Horizon remotely (i.e. not from within a branch).
7. Fujitsu had the ability/facility to: (i) alter and delete transaction data or data in branch accounts; (ii)
implement fixes in Horizon that had the potential to affect transaction data or data in branch
accounts; and (iii) rebuild branch transaction data in each case without the knowledge or consent of
the Subpostmaster in question. Post Office could alter and delete transaction data or data in branch
accounts without knowledge or consent of the Subpostmaster in question, although there was the
possibility of doing (ii) and (iii) physically in branch. The Subpostmaster or staff would know someone
was in branch doing something to access their branch accounts.
8. Permission controls for the above were very wide and not controlled (including a lack of proper logs)
and so was effectively unaudited. Prior to 2009 logs did not exist and until 2015 only recorded users
logging on/off, knew what they were doing. This amounts to a deficiency in controls.
9. Due to Fujitsu’s poor record keeping, there was no confident evidence on the number of times this
right was exercised, but on a balance of the evidence from experts and to the extent records are
available, it was likely to be about once per day over the lifetime of the system.
10. These facilities had the potential to affect the reliability of a Subpostmaster branch accounts to a
material extent. Further, the evidence shows clearly that there were instances when this in fact
occurred.
Other points in his Judgment (see Appendix for more detail) concerned the inequality in the range of
reports, management information and audit data available to Post Office but not to Subpostmasters, as
well as the fact that Subpostmasters had further difficulty identifying causes of some types of
discrepancies or shortfalls because of their limited knowledge of back-end systems.
Furthermore although Subpostmasters could print out transactions on till rolls, there was evidence in the
Common Issues trial about how unwieldy and non-user friendly this was - a till roll the length of a court
room would be required for one day’s transactions in a busy branch.
The judge noted that the “identification of the causes of apparent or alleged discrepancies required the
co-operation of PO staff and SPMs” and that co-operation is an important part of any investigation, as it
is an important part of the contractual relationship between the Post Office and Subpostmasters.
The above is a brief summary of a long and complex judgment, if there are any aspects where more
detailed briefings would be helpful please contact Sarah Clayton.
POL00460591
POL00460591
Appendix
More detail on some of Judge’s conclusions:
1. Post Office had access to data and systems providing a range of Horizon reports and management
information systems which were not available to Subpostmasters. Post Office could also request audit
data (to be retrieved via Fujitsu) - and this was the only source of actual key stroke information (i.e.
what buttons had been pressed in the branch). This meant Post Office did have access to “causes of
alleged shortfalls in branches, including whether they were caused by bugs, errors and/or defects in
the Horizon system”, albeit this had to be obtained through Fujitsu.
2. The causes of some types of apparent or alleged discrepancies and shortfalls may be identified from
reports or transaction data available to Subpostmasters. Other causes were more difficult to identify
because of Subpostmasters’ limited knowledge of the complex back-end systems.
3. Subpostmasters had access to reports relating to the different aspects of running a branch (e.g.
currency exchange, stock and so on) as well as access to transaction logs that would show individual
transactions, and event logs, but these were only available for a short period (initially 42 days then
changed to 60 days).
4. The Horizon system can compare cash and stock figures, but it has no facility to record a dispute. A
Subpostmaster cannot dispute a discrepancy or any figure on Horizon, or record on Horizon that they
have raised a dispute. Horizon records figures even when they are not correct, and there is evidence
of figures on Horizon being known to be incorrect by the Subpostmaster and the Post Office, or both.
Adispute is normally raised by a Subpostmaster through contacting the helpline, which is a telephone
service — outside of Horizon itself.
The judgment also contains several criticisms regarding the approach of Post Office in this litigation:
* Witness evidence: The Judge made numerous criticisms regarding the approach to witness evidence: both
in terms of how witness statements had been prepared, and regarding cross-examination of witnesses of fact.
Some examples:
1. “unhelpful" aspects of cross-examination by Post Office: e.g. examining a witness for the
claimants on extensive spreadsheets that he had not seen, which were not in chronological order,
had been filtered" by Post Office's legal team, had not been agreed by the claimants, and where
there had been no explanation of the filtering process.
2. It transpired in cross-examination of a witness for claimants that documents (16,500 emails and
18,500 other documents "sensibly organised in 1,700 folders”) had not been provided to the
claimants in the same way, lacking folder structure, metadata and date and time stamps. It was
also possibly not the complete set of data provided to Post Office witnesses.
* Disclosure: The Judge criticised Post Office’s approach to evidence disclosure including producing
substantial volumes of evidence at hearings rather than in advance and blaming Royal Mail for refusing to
produce audit documents when it transpired Royal Mail had not been asked.
He further criticised Post Office as being obstructive for denying the existence of known error logs, then
asserting they were not relevant, and finally claiming (as they were maintained by Fujitsu) they were not in
the control of Post Office and could not be introduced as evidence.
Lastly, he concluded that the production by Post Office of 218,000 error records two weeks before expert
witness documents were due to be exchanged could only have delayed and disrupted investigations.
* Expert evidence: The Judge seriously criticised the approach of one of Post Office’s expert witnesses who
(i) tried to decide unilaterally what evidence was useful to the Court, (ii) sought to re-write the questions the
Court was considering regarding the possibility of the impact of bugs errors and defects, (iii) contacted the
Court directly in contravention of the court procedure rules.