WBON0002009
WBON0002009
womblebonddickinson.com
BON
DICKINSON
17 January 2019 Womble Bond Dickinson (UK) LLP
Oceana House
39-49 Commercial Road
‘Southampton
SO15 1GA
Freeths LLP
100 Wellington Street
Leeds
West Yorkshire
LS1 4LT
By email only SpeArers6408s.1300 7
Your ref:
JXH/1684/2113618/9/SJ
Email: james.hartley@_ imogen.randall!_
Dear Sirs
The Post Office Group Litigation
Horizon Issues Trial: Disclosure and Trial Bundle
We refer to your letters dated 10 December 2018, 19 December 2018 (second letter), 21 December
2018, 14 January 2019 and 15 January 2019.
1. Witness statements
41 We have responded to your request to inspect those documents referred to within our client's
witness statements for the Horizon Issues Trial pursuant to CPR 31.14(1)(b) in the table below.
Disclosure Request Response to request
4 Hard copy Horizon System User I Document has been disclosed: POL-0026602
Guide
(1999/2000)
2. Security Operation Manual There have been a number of versions of the Security
Operation Manual issued by Post Office to Subpostmasters.
We understand from Post Office that the process for reviewing
the Security Operations Manual included a review to simplify
the document by removing unnecessary duplication,
amalgamating some sections, and updating others.
The following documents have already been disclosed:
© —POL-0156169 (May 2004)
© —POL-0184466 (May 2005)
* — POL-0175375 (January 2008)
* —POL-0156170 (August 2013)
I As per your request, Post Office have provided us with a copy
of the Security Operations Manual issued in October 2016.
Disclosure of this document is being provided under the Begin
I Bates number of POL-0449053, which is contained within the
_enclosed Disclosure list. J
Womble Bond Dickinson (UK) LLP is a limited liability partnership registered in England and Wales under number 0C317661. VAT registration
number is GB123393627. Registered office: 4 More London Riverside, London, SE 2AU, where a list of members’ names is open to inspection. We
use the term partner to refer to a member of the LLP, or an employee or consultant who is of equivalent standing. Womble Bond Dickinson (UK) LLP
is authorised and regulated by the Solicitors Regulation Authority.
Womble Bond Dickinson (UK) LLP is a member of Womble Bond Dickinson (International) Limited, which consists of independent and autonomous
law firms providing services in the US, the UK, and elsewhere around the world. Each Womble Bond Dickinson entity is a separate legal entity and is
not responsible for the acts or omissions of, nor can bind or obligate, another Womble Bond Dickinson entity. Womble Bond Dickinson (International)
Limited does not practise law. Please see www.womblebonddickinson.com/legal notices for further details,
‘AC_153742931_1
WBON0002009
WBON0002009
[3 Branch Focus article Disclosure of this document is being provided under the Begin
(3 March 2016) Bates number of POL-0449052, which is contained within the
enclosed Disclosure list.
4. Branch Focus article Disclosure of this document is being provided under the Begin
(5 September 2018) Bates number of POL-0449090, which is contained within the
enclosed Disclosure list.
5; Record of alterations to the This request relates to the First Witness Statement of Torstein
Oracle audit table Godeseth and asks for the ‘record of alterations’ to the Oracle
audit table.
No reference is made to a record of alterations within the First
Witness Statement of Torstein Godeseth. Fujitsu have now
confirmed no such record of alterations exists.
Disclosure of the available information held by Fujitsu was
given on 21 December 2018 under the Begin Bates numbers
of POL-0444105 > POL-0447287.
6. Managed service change Disclosure of the MSC Logs was provided on 21 December
document which has been signed I 2018 under the Begin Bates numbers of POL-0444102, POL-
off each year 0444103 and POL-0444104.
(prior to July 2015)
You will note that Mr Godeseth simply makes reference to a
process and does not reference any specific document. For
this reason, we do not consider this request to be a proper
request pursuant to CPR 31.14 (1)(b). In any event, the
MSCs have already been disclosed to your client.
7. Audit reports of Horizon carried I Copies of the following audit reports have already been
out annually by Ernst and Young I provided:
or otherwise
« 2011 E&Y Report (POL Management Letter) :
POL-0219218
2012 E&Y Report (ISAE3402) : POL-0219219
© 2013 E&Y Report (ISAE3402) : POL-0218336
* 2014 E&Y Report (ISAE3402) : POL-0218579
« 2015 E&Y Report (ISAE3402) : POL-0218708
« 2016 E&Y Report (ISAE3402) : POL-0219210
© 2017 E&Y Report (ISAE3402) : POL-0220665
* 2018 E&Y Report (POL Audit Planning Report) : POL-
0219017
While our client has provided the disclosure ordered by the
Court, our client is prepared to provide the documents
requested on a voluntary basis. Our client has requested
relevant documents from Fujitsu. They will be reviewed for
privilege and disclosed as soon as possible.
8. I Professor McLachlan’s reports We note that this request relates to documents prepared by
Professor McLachlan, a witness for the Claimants, on behalf
of Seema Misra, who is one of the Claimants.
While you will be able to obtain these from Professor
McLachlan direct, for ease of reference these reports have
already been disclosed by the Claimants as follows:
2 21 September 2009 : C-0005287
AC_153742931_1
WBON0002009
WBON0002009
19 November 2009 : C-0005255
4 February 2010 =: C-0005215
12 February 2010 : C-0005222
25 February 2010 =: C-0005232
30 September 2010 : C-0005246
9. I Advice sent to Subpostmasters in I Torstein Godeseth, at paragraph 13.5 of his second witness
relation to the bug known as statement, states:
Callendar Square
"Once the bug had been reported by the Subpostmaster and
investigated by Fujitsu, advice was provided to
Subpostmasters by Post Office. I have not seen this advice
but I understand from speaking to Gareth Jenkins that it would
have told Subpostmasters to take extra care in handling
transfers and to avoid duplicating Transfers" I
You will note that Mr Godeseth simply makes reference to the
advice given and does not reference any specific document
containing this advice. For this reason, we do not consider
this request to be a proper request pursuant to CPR 31.14
(1b).
Notwithstanding the above, we confirm Post Office is in the
process of searching for copies of the advice sent to
Subpostmasters in relation to the bug in Riposte Software
known as Callendar Square. As the Callendar Square bug
occurred in 20085 it is not envisaged that Post Office still holds
the document containing this advice. We will provide any
responsive documents to you as soon as possible.
10. West Byfleet Event Log From our reading of your letter, it appears that the documents
you are seeking disclosure of are the transaction logs which
were provided to Professor McLachlan in connection with the
preparation of his Technical Report dated 4 October 2010 in
relation to the criminal proceedings against Ms Seema Misra.
Again, as Professor McLachlan is one of the Claimants’
witnesses in the group litigation, and Ms Misra is one of the
Claimants, we presume that these documents are available to
you
We note that this request relates to the criminal proceedings
against Ms Seema Misra, which resulted in Ms Misra being
convicted of theft and false accounting and being sentenced to
15 months’ imprisonment in November 2010, over 8 years
ago. For the avoidance of doubt, should the Claimants seek
to re-litigate issues decided within these criminal proceedings,
we confirm Post Office's rights are entirely reserved to pursue
an abuse of process point.
Notwithstanding the above, disclosure of the Horizon
I Transaction and Events log for the West Byfleet branch for the
period 1 December 2006 > 31 December 2007 is being
provided within the enclosed Disclosure List.
[ 11. I Spreadsheet of affected branches I Disclosure of this document is being provided under the Begin
(payments mismatch bug) Bates number of POL-0448951, which is contained within the
enclosed Disclosure list.
12. Problem review tracker As per your request, Fujitsu have provided us with copies of
(forum between Atos and POL) I the Problem Review Tracker which documents the forum
AC_153742931_1 3
WBON0002009
WBON0002009
meetings between Fujitsu, Post Office and Atos. From
approximately October 2012, the weekly Problem Review
Tracker incorporated all “Closed Problems”, meaning the most
recent version includes all of the problems closed since
October 2012.
Disclosure of the following documents is being provided within
the enclosed Disclosure list:
e Problem Review Trackers completed during 2011
« Problem Review Trackers completed during 2012
¢ Problem Review Tracker dated 13 June 2018
including all problems closed since October 2012 up
to 13 June 2018
13. Fujitsu security policy ‘This document, Fujitsu reference: SVM/SEC/POL/0003 forms
part of the Horizon Technical Disclosure Post Office provided
on 18 July 2018 (further explained below).
There are 49 different versions of this document. Disclosure
of these documents is being provided within the enclosed
Disclosure list. None of these versions have been redacted or
withheld from inspection on the basis of privilege.
2. Horizon Management Council
21 You have requested that our client carries out a search for seven categories of documents in
relation to three new custodians in relation to a document that was disclosed on 1 August 2018,
over 5 months ago.
2.2 You state that we should treat your request as a formal Model C disclosure request. However,
your request extends to a broad range of issues, including risk assessment, data logging and
those documents relevant to the Horizon Management Council. It is hard for Post Office to make
targeted searches for documents responding to the request given its scope and the lack of a date
range or source provided. The Disclosure Pilot for the Business and Property Courts requires
Model C requests to specify either a particular or narrow class of document relating to a particular
issue for disclosure. Your request does neither of these things.
23 For example, the request for electronic and hard copy documents which contain the words
“Horizon Management Council" or "which relate to the work" of the Horizon Management Council
potentially includes emails, letters, meeting minutes, notes of calls, several iterations of draft
documents etc. Providing disclosure of documents which contain or which relate to the Horizon
Management Council would require a number of steps, including:
2.3.1 The email accounts of Mr Rees, Ms McGinn and Ms George to be extracted from Post
Office's servers and processed into our e-disclosure platform. As you will be aware
from Post Office's earlier disclosure relating to NFSP, the extraction and processing of
this data into the e-disclosure platform will take approximately 1 - 3 weeks (depending
on the volume of data);
2.3.2 Keyword searches/textual analysis of example documents provided by Post Office
would then need to be undertaken to locate potentially relevant documents. It may
also be necessary to refine these searches so as to ensure the volume of responsive
material passed through to the manual review is reasonable and proportionate. This
process would take at least a further 2 - 4 days; and
‘AC_153742931_1 os
WBON0002009
WBON0002009
2.3.3 A manual review of search term responsive documents for relevance/privilege. This
review may take a number of days or weeks (depending on the volume and size of
documents that respond to the searches and analysis).
2.4 We therefore propose a pragmatic solution as follows:
2.4.1 The scope of the search is limited to:
(a) the email accounts of Mr Rees, Ms McGinn and Ms George; and
(b) the SharePoint site which Post Office's Information Security team stored
documents in.
2.4.2 Once we have extracted the agreed email accounts and SharePoint documents, we
propose to run a search of the following keywords to locate potentially relevant
documents:
(a) "Horizon Management Council"
(b) "Horizon Document Pack"
(c) "Solution Overview*"
(d) "Solution Diagram*"
(e) "Risk Register*"
(f) “Detailed Solution Documentation"
(g) "Single Change Control Process"
(h) "Single Change Process"
(i) "Financial Review*"
(j) “Financial Audit*"
(k) "Financial spot check*"
() "Risk Assessment"
(m) "Risk Assessment Information"
(n) “Risk Profil*"
(0) “IT Assurance"
(p) "data logging"
(q) “data monitor*"
(r) “data delet*"
(s) "data chang*"
Please note, should any of these terms be over-responsive, resulting in the volume of
results being too high to review, the keywords will need to be revised and/ or further
refined.
AC_153742931_1
WBON0002009
WBON0002009
2.5 Since receiving your letter we have extracted Ms George's email account and have requested Mr
Rees and Ms McGinn's email accounts from Mimecast (Post Office's email server provided). As
advised above, this process can take approximately 3 weeks. In terms of the SharePoint site, we
are in the process of liaising with Post Office's IT team to confirm whether this has already been
extracted.
2.6 Should you not agree with the above approach, please provide your requests in the form of a
Model C request, specifying either a particular or narrow class of document relating to a particular
Issue for Disclosure, as required under the Disclosure Pilot for the Business and Property Courts
so that Post Office can understand and consider the further disclosure which you now seek.
3. Annual Audit Reports
3.1 This has been addressed at section 1, request 7 above.
4. Branch Database High Level Design [POL-0219310]
41 We confirm this document forms part of the Horizon Technical Disclosure Post Office provided on
18 July 2018. As explained within our letter of 17 May 2018:
4.44 The Horizon Technical Disclosure was formed of documents sourced from Dimensions
that had previously been withheld from inspection on the concern that they contained
privileged material;
4.1.2 Through keyword searching it was identified that 10,758 (32,702 when families are
included) of the documents stored within Dimensions (which was the source of the
Horizon Technical Disclosure) may contain privileged material and inspection of these
documents was not provided. However, a list of the documents withheld was provided
with our letter of 17 May 2018, further copy enclosed for your reference;
4.1.3 An invitation was given that, if there were a small number of non-disclosed Dimensions
documents which the Claimants' Expert wished to review, then we would be open to
reviewing these on an individual basis. This invitation was repeated within our letters
of 17 July and 23 July 2018. This same opportunity was given to Dr Worden.
42 We confirm there are additional versions of this document in Relativity that were not disclosed
due to the fact that these versions contained a privileged keyword. We have now reviewed these
additional versions for privilege and disclosure of these versions is being provided within the
enclosed disclosure list.
5. Claimants’ Stage 3 Disclosure
Sf We note that, whilst the Claimants have made a number of additional requests for disclosure, you
are yet to describe how those documents provided in your clients' Stage 3 Disclosure were
identified or the searches undertaken to find relevant documents. This is in contrast to Post
Office's approach to disclosure, whereby we have been transparent throughout the process in
terms of the scope of searches undertaken, relevant keywords applied and sought your
agreement and input into the process.
5.2 We remain concerned that your clients may not have undertaken reasonable (or any) searches
for material. We therefore ask that you provide the following information, as previously requested
within our letters of 23 July 2 August 2018:
5.2.1 The sources which have been searched for potentially disclosable documents. Whilst
each of the Lead Claimants have provided an Electronic Disclosure Questionnaire,
Post Office has not been provided with information on the other document sources
available to the remaining Claimants who may hold documents relevant to the Horizon
Issues Trial;
‘AC_153742931_1 6
WBON0002009
WBON0002009
5.2.2 How the Claimants / your firm undertook the search for potentially disclosable
documents and the review process which was undertaken (ie. keyword searching,
document clustering, manual review, etc); and
5.2.3 Any limitations which were placed on the search for potentially disclosable documents
5.3 We note your comments within your letter of 3 August 2018 and 14 January 2019 that you do not
consider this information to be relevant and furthermore that you do not consider it to be
proportionate exercise for you to undertake to provide the same. However, without such
information Post Office is unable to understand the breadth of searches and whether they were
sufficiently wide so as to mitigate the risk of further disclosure being given later. Please could
you provide this information by 21 January 2019.
6. Documents not uploaded to the trial bundle
6.1 As per our instructions to Opus on 20 December 2018, subject to paragraph 1.2 below, the
documents which you identified have been uploaded to the Horizon Issues trial bundle on
Magnum.
6.2 In relation to PC0099530, we have not able to locate this document within Mr Worden's Report or
its accompanying Appendices. Please could you confirm where this document is referenced and
we will arrange for it to be uploaded to the Horizon Issues Workspace.
ts Texts and articles referred to in Dr Worden's report
wa We will deal with the uploading of these documents to the trial bundle separately.
8. PorterS199P and dsed2640M
8.1 Disclosure of these KELs is being provided under the Begin Bates numbers of POL-0448589 and
POL-0448567, which are contained within the enclosed KEL Disclosure List. These KELs were
not previously disclosed due to their being deleted KELs, as further explained below, and are
being disclosed to Dr Worden at the same time as being disclosed to the Claimants. Dr Worden
was aware of these KELS prior to them being disclosed as they are referenced in the Peaks
PC0197409 and PC020367.
9. Missing KEL Entries
9.1 Regarding your queries on the contents of the KEL indexes provided in January 2018, we
understand from Fujitsu that:
9.1.1 The index named “Historc_Kels.xlsx” contains the KEL entries which relate to Horizon.
9.1.2 The index named “Active_Kels.xlsx” contains the KEL entries which relate to Horizon
Online.
9.1.3 Both of these indexes contain those KEL entries which, as at the date the indexes
were produced, were "live" KELs. Therefore, these indexes did not contain the
deactivated KELs (as explained at paragraph 61.6 of Mr Parker's witness statement),
or deleted KELs (as explained at paragraph 61.9 of Mr Parker's witness statement).
9.1.4 The KELs which were extracted by Fujitsu and disclosed in May 2018 were those
entries listed in both indexes, plus the deactivated entries. The difference between the
number of KELs in the indexes and number of KELs in the extraction is therefore
believed to be caused by the exclusion of deactivated KELs from the indexes, which
were however disclosed.
10. Deleted KELs
AC_153742931_1 =
WBON0002009
WBON0002009
10.1 The extraction of KELs which was provided by Fujitsu in March 2018 did not contain the deleted
KELs and Fujitsu did not make us aware at that time that some KELs had been deleted.
10.2 Fujitsu have now provided us with copies of the deleted KELs and disclosure / inspection of these
documents is now being provided. The documents are contained within the enclosed KEL
Disclosure List. None of the deleted KELs have been redacted or withheld from inspection on the
basis of privilege.
11. Request for updated disclosure
11.1 As per your disclosure request, Fujitsu have provided us with copies of the KELs which have
been generated between 19 March 2018 and 10 December 2018. These are also contained in
the enclosed Disclosure List. None of these KELs have been redacted or withheld from
inspection on the basis of privilege.
Yours faithfully
\loedle Byatt Didarn. (UR)MLAP
Womble Bond Dickinson (UK) LLP
Enclosures
Ts Horizon Issues Disclosure List 17 January 2019
2. KEL Disclosure List 17 January 2019
AC_153742931_1 8