WITNO00530100
WITNO0530100
Witness Name: Matthew Guy Lenton
Statement No.: WITN00530100
Dated: 14 May 2024
POST OFFICE HORIZON IT INQUIRY
FIRST WITNESS STATEMENT OF MATTHEW GUY LENTON
I, MR MATTHEW GUY LENTON, will say as follows:
INTRODUCTION
1. I am currently the Document Manager in Fujitsu’s Post Office Account team
(POA), a role I have held since May 2009.
2. This witness statement is made to assist the Post Office Horizon IT Inquiry (the
Inquiry) with the matters set out in a Rule 9 Request dated 5 April 2024 (the
Request), to the extent I have or had direct knowledge of such matters. I was
assisted in preparing this statement by Morrison Foerster, the recognised legal
representatives for Fujitsu in the Inquiry.
3. Many of the matters set out in the Request relate to events that took place
between 5 and 10 years ago. I have tried to remember these events and matters
to the best of my ability to assist the Inquiry. However, there are areas where
my recollection is limited. The content of my statement therefore focuses largely
on the content of contemporaneous documents made available to me by the
Page lof 54
WITNO00530100
WITNO0530100
Inquiry and Fujitsu. Where my recollection has been assisted by documents, I
set out the URN of the relevant document below.
BACKGROUND
4. The Inquiry has asked me to set out my professional background, including a
summary of my career, qualifications and the positions I have held at Fujitsu.
5. In 1987 I obtained a BA degree in Film Studies and Philosophy from the
University of Kent. After university I worked in various temporary roles, including
for British Gas (Exploration & Production) from 1988 in a document control
department for a gas drilling platform project. This role continued and
developed over several years with other British Gas offshore projects.
6. From 1996 to 2006 I worked at Arup, leading a small document control team for
a building design group of around 100 staff working on multiple structural and
building services construction projects. In 2006 I moved to work in a similar role
on a defence contract within the Government & Infrastructure division of KBR.
7. In November 2006 I joined Fujitsu as a Document Manager to lead the
document control team for the NHS account. Following the end of the NHS
account, in 2008, I worked on a small number of other Fujitsu accounts for
periods of a few months each, including, temporarily, the POA. These other
roles related to the planning of document deliverables and information
management methodologies for bid teams; the temporary role on POA was as
a Document Manager. In May 2009, I joined the POA as Document Manager,
a role which has continued to the present.
Page 2 of 54
WITNO00530100
WITNO0530100
POA DOCUMENT MANAGER ROLE
8. The core part of my role as Document Manager for the POA is the responsibility
for ensuring that design documentation and key process documentation is
controlled. The basis of that control is the use of a single repository for such
documentation, which is a configuration management database known as
Dimensions (Dimensions). The database provides the POA clarity on the
latest versions of current documents, and that previous (superseded) versions,
as well as obsolete documents, are retained. Records of document reviews
and approvals are maintained to ensure that cross-team and peer checking is
carried out in a way appropriate to the document type and the context of the
document change. Document issues and receipts between Fujitsu and Post
Office Limited (POL), as well as other parties, are controlled via a central
mailbox owned by me, and those transactions are recorded and the emails
stored.
9. On joining the POA in 2008, and then re-joining in mid-2009, the focus of my
role was almost exclusively on the completion of the documentation sets that
Fujitsu was to deliver to POL as part of the Acceptance activities for Release 1
of HNG-X (HNG-X or Horizon Online) under the Horizon contract (the Horizon
Contract). These document deliverables comprised a set of approximately 100
design documents that formed part of the Solution Baseline Documentation Set
(SBDS) as defined in the Horizon Contract, and a set of around 130 documents
defined in the Horizon Contract as Contract Controlled Documents (CCDs).
10. Prior to the completion of the roll out of HNG-X Release 1, the original Horizon
system (Legacy Horizon) continued to be in operation, so there continued to
Page 3 of 54
11.
12.
13.
14.
WITNO00530100
WITNO0530100
be document change activity relating to that system, gradually tailing off until all
activity focused on Horizon Online. The Legacy Horizon system documentation
was always, and continues to be, stored in a separate instance of the
Dimensions database.
Since HNG-X Release 1, further releases and changes have continued to result
in the creation of both new documents, and changes to existing documents, so
that part of my role has continued in a similar vein.
From October 2011 my responsibilities started to include administration of the
POA SharePoint site (SharePoint), which is used as a sharing and
collaboration tool for non-formal documentation; this mostly involves managing
permissions and assisting teams and users with the use of the tool.
Between 2014 and 2021 I also managed access to a number of server-based
POA file shares, many of which are largely legacy repositories pre-dating the
use of SharePoint, as well as some other obsolete information repositories
which are no longer in active use but which are retained for record purposes.
In addition, from 2013 I have managed internal POA communications. Mostly
this involves checking and editing content proposed by a member of the POA
who wishes to communicate something to the whole of the POA and obtaining
authorisation prior to sending the email; it also involves organising and
recording regular all-POA conference calls.
In late 2017 I was asked by Pete Newsome (Business Change Manager, POA)
to produce sets of formal Fujitsu documentation in relation to the group litigation
involving Mr Bates and others and POL (the GLO Proceedings). Following on
from that, and as a result of the knowledge I had accrued in my role as I have
Page 4 of 54
WITNO00530100
WITNO0530100
described it above, I continued to assist with the provision of documentation
and records in preparation for, and during, the GLO Proceedings. Although not
a formally defined role, this extended to acting as one of the points of contact
for the transmission of information between Fujitsu and Womble Bond
Dickinson (WBD).
15. After the GLO Proceedings, I continued to provide information in relation to
Horizon issues. Within Fujitsu this related to internal POA activities being
carried out as a result of the GLO Proceedings, and, when requested, for the
Fujitsu legal team in their work to assist the Inquiry. I have also provided
information directly to POL in connection with the Historical Shortfall Scheme,
virtually all relating to the start and end dates of Legacy Horizon and/or Horizon
Online at specific branches. However, the majority of my time continues to be
spent in my role as Document Manager for the POA. Due to the nature of my
work, including in relation to the GLO Proceedings and the Inquiry, I have seen
many documents, including emails and correspondence, that were not authored
nor received by me at the time they were originally created. For this reason, I
am sometimes unsure exactly when I became aware of certain issues in relation
to matters with which this witness statement is concerned.
ACCESS TO, KNOWLEDGE OF AND RESPONSIBILITY FOR DOCUMENTS
16. The Inquiry has asked me to summarise my access to, knowledge of and/or
responsibility for documents relating to three issues, detailed below. As noted
above, I have held the role of Document Manager in the POA since May 2009.
Page 5 of 54
17.
18.
19.
20.
WITNO00530100
WITNO0530100
(i) Bugs, errors and defects in the Horizon IT system
The principal sources of information relating to the reporting and management
of bugs, errors and defects (BEDs) is in Peaks and Known Errors Logs (KELs),
both of which are controlled by the POA Third Line Support team (SSC) in the
bespoke Peak database repository and website (the Peak system) which that
team owns and controls.
Access to the Peak system is controlled by a separate username and password.
I first received user credentials to access the Peak system in July 2016, about
a year prior to commencing my involvement with work relating to the GLO
Proceedings. I had requested access so that I could more easily view Peaks
which related to document updates; “documentation Peaks” are sometimes
raised to track document revisions, normally in relation to a documentation error
being noted during testing.
Prior to July 2016 I had no direct access to the Peak system, and until that time,
no specific knowledge of the contents. I had only a general knowledge of what
the system was for; if I needed to see a Peak then I would have asked someone
in the Third or Fourth Line support teams to obtain it for me.
Some procedures related to the reporting and management of BEDs, such as
those relating to Problem Management, Incident Management, and Third and
Fourth Line Support, are stored in the Dimensions repository. These documents
do not in themselves contain details of any BEDs. There are also internal SSC-
specific work instructions that relate to the reporting and management of BEDs
which are stored within the SSC website / Peak system.
Page 6 of 54
21.
22.
WITNO00530100
WITNO0530100
Post Incident Review reports on Incidents and Major Incidents which document
some types of BEDs have at various times been stored in Dimensions,
SharePoint, and a File Share. During the Legacy Horizon period such reports
were stored on a File Share, with some also being added to Dimensions; in the
Horizon Online period, from February 2010 the reports were stored in
SharePoint, and since May 2014 they have been controlled on Dimensions.
Ensuring these reports (and any other documents) are managed appropriately
from a documentation perspective does not necessitate reading the main
content of the document; my role only requires me to read the document control
section at the start of the report, and generally ensure compliance with
documentation standards (for example, ensuring that a document uses the
correct template, contains valid version history entries, includes suitable
reviewers and approvers, is marked with an appropriate security classification,
and is stored correctly). Prior to 2018 I would most likely have seen such
reports that covered BEDs, but I do not recall reading any of them in detail.
Similarly, as the administrator for SharePoint and some File Shares, I have had
access to documents which in some cases refer to BEDs (for example, Monthly
Service Reviews), and many other working documents which may relate to
BEDs, such as drafts of, or analyses for, Post Incident Review reports. For
context, as an administrator of various document repositories on the POA, I
have had access to hundreds of thousands of documents and files. However,
my role did not require that I read such documents until the GLO Proceedings
as there had been no need for me to do so.
Page 7 of 54
23.
24.
WITNO00530100
WITNO0530100
My earliest awareness of any of the issues potentially relating to BEDs were
the “Data Integrity” reports authored by Gareth Jenkins in 2009 (Legacy
Horizon) (ARC/GEN/REP/0004) and 2011 (ARC/GEN/REP/1229) (Horizon
Online). 1! recall processing these into Dimensions. I provided the Legacy
Horizon document in response to a request from Lobna Mohammed, a member
of POL's Project Management Office (PMO) staff, in December 2010
(FUJ00226322). I clearly checked before sending it, as I told her that it had
been sent previously by Jeremy Worrell to David Smith. I sent the Legacy
Horizon document to POL again in September 2011, for the attention of Lesley
Sewell, copying in lan Howard (then POA CISO) possibly in connection to the
E&Y ISAE3402 report (FUJ00226326). I provided the Horizon Online
document to POL for review in September 2011, either at the request of lan
Howard or Gareth Jenkins, for the attention of Dave King, Richard Barber,
Lesley Sewell and John Scott (FUJ00235020). These reports do not, however,
specifically refer to any BEDs.
(ii) The ability of Fujitsu employees to alter transaction data or data in
branch accounts (“remote access”) without the knowledge or consent of
SPMs
The ability for Fujitsu to insert a balancing transaction in Horizon Online is
documented in a number of documents stored in Dimensions; I only became
aware of this particular aspect of these documents during the GLO Proceedings
in around 2018. The ability of the SSC to make approved corrections to the
Branch Database, while not having the ability to modify historical branch data,
is outlined at the highest level in the Architecture document ‘HNG-X
Architecture — Branch Database’ (ARC/APP/ARC/0008) (BRDB ARC)
Page 8 of 54
25.
26.
WITNO00530100
WITNO0530100
(FUJ00091411). The tool designed to insert corrective balancing transactions
in Horizon Online is described at a high level in the Branch Database High Level
Design document (DES/APP/HLD/0020) (FUJ00235023) (BRDB HLD), with
the detailed technical design of the tool being documented in the Host BRDB
Transaction Correction Tool Low Level Design document (DEV/APP/LLD/0142)
(FUJ00164815) (TCT LLD). I have reviewed these documents and they do not
appear to contain any references to SPM knowledge or consent. Both BRDB
HLD and TCT LLD do however contain prominent warnings on the use of the
tool.
Both the BRDB ARC and BRDB HLD were included in the SBDS which I
transmitted to POL in November 2009 as part of HNG-X Release 1 Acceptance
(see paragraph 9 above) (FUJ00235022 and FUJ00235028). I was aware of
both documents at that time, but they are relatively long and detailed technical
documents which my role did not require me to read, and I do not recall doing
so in any detail until the GLO Proceedings. Prior to the delivery of the BRDB
ARC as part of the SBDS, an earlier version of the same document had been
issued to POL for review, with comments being received back from Torstein
Godeseth in October 2008 (FUJ00235031).
I was not aware of the potential significance of the TCT LLD until the GLO
Proceedings, it being one of over 200 application low level design documents
that were written during the development of HNG-X Release 1. Fujitsu was not
required to provide LLDs to POL under the Horizon Contract, so application
LLDs, including this specific LLD, were therefore not subject to the same focus
as the documents that formed part of the SBDS.
Page 9 of 54
27.
28.
29.
WITNO00530100
WITNO0530100
The work instruction that governed how the SSC were to use the balancing
transaction tool is, I believe, stored only within the SSC’s web site (WI3649S)
(FUJ00194686); while I had access to it from July 2016, I was not aware that it
existed until the GLO Proceedings in 2018.
The ability to affect branch accounts in Horizon Online is clearly alluded to in
meeting minutes created by POL as a result of one of the BEDs (the BED known
as Receipts and Payments Mismatch, I believe) (FUJ00081584). I first became
aware of this presentation in 2018 or 2019 during the GLO Proceedings,
however I may have had access to an instance of the file via a file share before
2018.
In relation to Legacy Horizon, I am not aware of design documents that describe
a means to insert a balancing transaction in a similar way to that described
above for Horizon Online. It is documented within design documents that
access to counters and message stores was possible, and it is implied that it
was a part of the practice of Third Line Support when carrying out corrective
actions in, for example, ‘Counter Support Requirements’ (SY/REQ/001)
(FUJ00139162), and ‘CS Support Services Operations Manual’ (CS/QMS/004)
(POL00000912), although I believe these documents are not specific on what
type of corrections may be involved. Through my normal role as POA
Document Manager I have had access to such documents since 2008-2009,
but as they relate only to Legacy Horizon, they are part of an inactive archive
repository, with my attention only being drawn to such documents during the
GLO Proceedings in 2018 or 2019.
Page 10 of 54
30.
31.
WITNO00530100
WITNO0530100
(iii) The extent to which remote access was used
My understanding is that for Horizon Online, any use of the balancing
transaction tool was automatically recorded within a journal contained within
the Branch Database, to which I have had no access. I was only made aware
of the existence of the journal and its contents due to my work on the GLO
Proceedings in, probably, 2018.
The manual record of the use of the tool exists within the SSC’s Peak system,
both in a Peak and in an Operational Change Proposal (OCP). I only became
aware of these records due to my work on the GLO Proceedings in, probably,
2018. The records that I saw after that time indicate that the balancing
transaction tool was used on only one occasion, and apparently with the
knowledge and consent of the SPM and POL. The single instance of the use of
the tool is documented in a Peak PC0195561 (FUJ00086586) in which it is
recorded by the member of the SSC that made the correction, Cheryl Card, that
she spoke to the SPM the day before inserting the transaction, informing the
SPM of the proposed repair. On the day of the repair, 11 March 2010, it is
recorded that Cheryl Card asked the SPM to print a balance snapshot, then ran
the insertion tool, then asked the SPM to print another balance snapshot, which
the SPM confirmed then looked correct. The insertion was pre-approved on
behalf of POL by Emma Langfield, a member of the POL Service Delivery team,
this being recorded in OCP 25882 (FUJ00087431). The record that the tool
was used only once is contained in a database table named
“BRDB_TXN_CORR_TOOL_JOURNAL!” that is a part of the BRDB. The tool
was designed to insert a record into this journal table when run. For the
Page 11 of 54
WITNO00530100
WITNO0530100
purposes of the GLO Proceedings, all log records from this journal table were
extracted, and were shown to contain only a single instance of the record type
that the balancing transaction tool created. I understand that this information
was passed by WBD to Freeths in February 2019.
32. For Legacy Horizon, I am less clear on how “remote access’ to alter transaction
data or other data worked, as it is not as clearly documented in the design
document set as it is for Horizon Online, as I have described in paragraph 29
in this statement. I recall this being subject to discussion during the GLO
Proceedings, with the information referred to as part of that work being
contained within the SSC web site in Peaks, OCPs and Operational Change
Records (OCR). While I had access to the Peak system from July 2016, I was
not aware that within it there existed such records of remote access until the
GLO Proceedings in 2018 or 2019.
FUJITSU DOCUMENT UNIVERSE
33. The Inquiry has asked that I summarise how Fujitsu’s document universe was
organised to answer queries in relation to the above matters (BEDs in Horizon
and remote access). As detailed above, Fujitsu uses the following systems:
a. Dimensions: A database containing controlled design and procedural
documentation for Legacy Horizon and HNG-X. The database is
administered by me, and I have had access in 2008 and again from 2009.
b. SharePoint: A collaboration website used for uncontrolled documentation
and records for HNG-X. The website is administered by me and I have had
Page 12 of 54
WITNO00530100
WITNO0530100
access from, I believe, 2009 or 2010, when it was implemented within the
POA.
. File shares: There are a number of separate shares, access to some of
which were controlled by me for a number of years. These all originate from
the period prior to the implementation of SharePoint in around 2009 and
were used for storage and collaboration within various POA teams. I had
access to some from 2009, others from around 2013. In November 2021
the POA Security Operations teams took over the control of access to these
file shares. Examples of the larger file shares include those for teams
involved with Customer Service, Business Support, Service Introduction,
HNG-X Development, Finance and Commercial; there were also file shares
for the purpose of individuals to store data as an alternative to storing solely
on their PCs.
. SSC website / Peak system: A website with various databases used for
Incident management and support documentation for Third and Fourth line
support. This is administered by SSC, and I have had access from mid-
2016.
. Change Management system: The systems used by SSC for recording
operational changes has changed over time. During the early Legacy
Horizon period the use of the POA-specific OCR and OCP was
administered and stored within the SSC server. The adoption within POA
of the Fujitsu-wide Managed Service Change (MSC) system led to MSCs
replacing OCPs in 2010 and OCRs in 2011. MSC was itself replaced across
Page 13 of 54
WITNO00530100
WITNO0530100
Fujitsu by Triole for Service (TfS) in 2018. I have not had direct access to
these systems.
ROLE IN RESPECT OF CONCERNS REGARDING HORIZON
34. The Inquiry has asked me to summarise my understanding of the support or
services Fujitsu provided to POL in relation to the issues set out below and
describe the nature and extent of any involvement I had in providing such
support or services. In responding to this question and the questions noted at
paragraph 42 in this statement, the Inquiry has asked me to consider
FUJ00169057, FUJ00224733, POL00028062 and FUJ00156902. These
documents are dated between late 2013 to mid-2016.
35. In describing my involvement below, I would like to make clear that since 2008,
I have provided documents to POL on many occasions, and it is possible that I
may have been asked to provide documents to POL which were then used for
one or more of the below issues, without me being aware of the purpose.
(i) POL’s response to concerns regarding the Horizon IT System raised by
current and former SPMs, MPs and journalists
36. In consideration of FUJ00169057, an email chain dated March to April 2016
between Fujitsu and Deloitte employees, I do recall providing the
documentation detailed in the email chain to Deloitte. Prior to this period, I had
provided the two reports “Horizon Data Integrity” (in 2010 and 2011) and
“Horizon Online Data Integrity” (in 2011) directly to POL, which were most likely
related to those same concerns regarding the Horizon system. I do not believe
I was involved in any detailed discussion about the purpose of the document
Page 14 of 54
WITNO00530100
WITNO0530100
production at that time, it was just presented to me as a request to retrieve and
provide some documents.
(ii) Second Sight’s investigation in 2012 — 2013 leading to the Interim Report
37. In consideration of FUJ00156902, an internal email chain dated October 2013
between Fujitsu employees, I confirm that I did set up the SharePoint subsite
“for all documentation relating to data integrity to be stored” as referred to in
James Davidson's 31 October 2013 email (the Data Integrity SharePoint).
The Data Integrity SharePoint contains copies of design documents that I
extracted from Dimensions and which I then sent to James Davidson and/or
Pete Newsome for the purpose of onward transmission to an external party.
38. I believe that around this time there was at least one formal agreement with
POL that Fujitsu would provide certain support services to POL for this review;
this was in the form of a commercial change document known as a CT
(Commercial Terms). I was not involved in the drafting or agreement of that
CT.
(iii) The Initial Complaint Review and Mediation Scheme and related
investigations
39. 1 do not recall having any involvement in the Initial Complaint Review, Mediation
Scheme or related investigations. However, as noted above, it is possible that
I may have been asked to retrieve and provide documents to specific recipients
in relation to these issues without me being aware of the purpose.
Page 15 of 54
WITNO00530100
WITNO0530100
(iv) The work conducted by Deloitte in 2014 under the project name Zebra
40. In consideration of the draft version of Deloitte’s report titled ‘Horizon: Desktop
Review of Assurance Sources and Key Control Features’ dated 23 May 2014
(POL00028062), I can see that I am included in the list on page 60, and I think
this means that I provided some documents to, presumably, POL in response
to a request. I do not believe I was “interviewed”, so I assume that “consulted”
may include being asked to provide documentation.
(v) POL’s search for an expert witness to opine on the integrity of the Horizon
IT System
41. I am not aware of being involved in any activity relating to POL’s search for an
expert witness in any context.
Information sharing with POL
42. The Inquiry has asked me the following in relation to (i) BEDs, (ii) remote
access, and (iii) the issues noted at paragraphs 36 to 41 in this statement:
a. what my impression was of POL’s purpose and/or motives when seeking
information;
b. whether there was any reluctance or caution within Fujitsu to sharing
information with POL; and
c. my views on the adequacy of the documents or information I was able to
provide POL.
Page 16 of 54
WITNO00530100
WITNO0530100
43. I have set out my recollections and views in relation to BEDs and remote access
at paragraphs 117 to 128 in this statement, as they relate to the GLO
Proceedings.
44. Inrelation to the issues noted at paragraphs 36 to 41 in this statement, I cannot
say that I formed a clear impression of POL’s purposes or motives at the time.
As above, any involvement that I had during this time was limited to the
provision of design documents to specified recipients when requested. I was
aware that these activities related in some way to questions of the integrity of
the Horizon system, but I think I would have assumed that the purpose was to
get to the truth as to the integrity of Horizon and the cases of balancing
problems experienced by SPMs. I was not aware of any reluctance or caution
on the part of Fujitsu to sharing information with POL. My recollection is that
most, if not all, of the documents that I was asked to provide for external use in
response to various requests at that time were at a fairly high level, many of
which had already been shared with POL as part of the SBDS or were CCDs.
As described previously in this statement, I provided the documents I was asked
to provide, and, as I was not involved in discussion about what they were used
for, Iam not able to comment on their adequacy.
REMOTE ACCESS
45. The Inquiry has asked that I describe the nature and extent of my involvement
prior to the GLO Proceedings in providing information or documents to POL
relating to remote access. Prior to late 2017, I have already explained above
the circumstances under which I provided to POL documents that may have
contained, and in the cases of the BRDB ARC and BRDB HLD, did contain,
Page 17 of 54
46.
47.
WITNO00530100
WITNO0530100
information relating to certain types of remote access. Those circumstances
were as far as I am aware not in response to requests that were specifically
related to the subject of remote access.
The BRDB HLD and TCT LLD documents I refer to in paragraph 24 above, that
describe the HNG-X balancing transaction tool, were included in the set of all
design documentation that I provided to WBD in 2018. Subsequently, starting
later in 2018, I recall that WBD made a number of requests for further
information relating to the use of the balancing transaction tool, and there were
also a number of requests passed to Fujitsu by WBD that originated from
Freeths.
By the time these detailed requests were coming from WBD, I was involved in
terms of receiving the requests, passing them onto a group of Fujitsu staff
(principally comprising of Pete Newsome, Stephen Parker, John Simpkins,
Mark Wright, Torstein Godeseth, Gareth Jenkins) who were supporting the
provision of information to POL via WBD and then passing their responses back
to WBD. This role was shared with a Fujitsu Project Manager, first Rik Lovejoy,
then Dave Ibbett. The role could be said to have evolved informally, but the
purpose of it, in my view, was to:
a. channel requests from, and responses to, WBD via a limited number of
mailboxes so that numbers of requests and priorities could be managed;
b. limit, though not completely exclude, direct email access from WBD to
individual members of the Fujitsu team in order to minimise the number of
separate email threads that might otherwise evolve;
Page 18 of 54
48.
49.
50.
WITNO00530100
WITNO0530100
c. ensure that requests could be targeted to the most appropriate members of
the team;
d. facilitate internal team discussion of the questions and responses before
sending them back to WBD; and
e. ensure that all email threads were stored.
I recall forming the impression that Dave Ibbett and I acted as the point of
contact between two sides:
a. onone side were legal professionals WBD who, to begin with at least, had
effectively no detailed knowledge of Horizon; and
b. on the other side was the Fujitsu team with very detailed technical collective
knowledge of Horizon.
Dave Ibbett and I (acting as the point of contact) used our detailed knowledge
of the POA, and general but largely non-technical knowledge of Horizon, to
ensure that the questions from WBD were prioritised, properly addressed, and
answers collated so that responses would be correctly understood by WBD. I
took the view that if I understood the information provided by the technical team
then I would be able to make sure that WBD also understood it.
I recall that a relatively large amount of time was spent on requests related to
the use of the balancing transaction tool, including the retrieval, presentation,
and explanation of journal logs from the branch database. As explained above,
my own involvement with this was effectively a management role, of finding the
Page 19 of 54
51.
52.
WITNO00530100
WITNO0530100
right Fujitsu subject matter experts, explaining what we needed, ensuring we
understood the resulting data, and reporting it back to WBD.
There were also requests on other issues relating to remote access. For
example, I recall that a schedule was created to detail different types of what
might be considered remote access (but not necessarily limited to, as it is
described in the Request, the ability to “alter transaction data or data in branch
accounts”). My role in the creation of that schedule, as I recall, was the collation
of information from various Fujitsu subject matter experts, which was then
provided to WBD, who then created the final document.
The Inquiry has asked that I consider POL00091411 (Chronology of statements
made by Post Office in respect of “Remote Access” Allegation) and set out my
views on the accuracy of the statements made in relation to remote access.
Taking each statement in turn:
a. “January 2015”. I believe the highlighted part of the statement to be correct.
My understanding is that once a record of a transaction has been created,
there was no functionality in Horizon Online at that time to edit, change or
remove that record. The balancing transaction tool could only insert
another, separate, record, which may have the effect, for example, of
cancelling out the value of an existing transaction record, but the record of
the existing transaction would continue to exist and itself remain unchanged.
The balancing transaction tool could effectively remotely amend an SPM’s
account balance in that a new transaction may be inserted, but, as above,
not alter or remove existing records of past transactions. Whether or not
this could be done without the knowledge of those working in the branch is
Page 20 of 54
WITNO00530100
WITNO0530100
less clear to me. My understanding is that the tool itself did not include a
fail-safe means of notifying an SPM that a transaction has been inserted,
for example through a message sent to the counter, so it seems possible
that it could have been used without the SPM noticing at the time it was
done. I believe it did however write the transaction record in such a way as
to indicate how the transaction was entered. I have reviewed the work
instructions relating to the use of the balancing transaction tool, and both
appear to state that an MSC (‘Managed Service Change’) or TfS (‘Triole for
Service’) (or whichever formal operational change vehicle was in use in
POA at the time) is required, and it is the process leading to the approval of
the MSC that I believe would provide the governance to ensure that POL
approval was obtained. As far as I am aware, the decision to inform the
SPM would be for POL, but it is recorded that on the one occasion this
Horizon Online tool was used, the SPM was informed (FUJ00194686 and
FUJ00194687).
. “17/02/2015”. I believe this whole statement from the words “This confirmed
that...” to “...remotely or otherwise” to be correct. As far as I am aware, the
basement of the Bracknell building contained a test area, which I have
myself seen, and at which I have seen members of the test team working.
This meant that Horizon counter terminals were present and running, but
connected only to a test environment, and with no ability to connect to the
live environment. As described above, I believe that it is also correct that,
in any event, existing records of transactions in live branches cannot be
edited. The use of the balancing transaction tool would have required
access to the live environment, and my understanding is that such access
Page 21 of 54
WITNO00530100
WITNO0530100
was possible only from, at that time, the sixth floor of the Bracknell building,
from a special terminal within a secure room, controlled by the SSC team.
. “09/04/2015”. I believe this whole statement to be correct. I believe it
describes accurately the distinction between editing or deleting transaction
records (which could not be done) and inputting a new transaction (which
could be done) either via a Transaction Correction (which I understand is
issued to branches by POL and must be accepted by the SPM), or a
balancing transaction (carried out by Fujitsu using the balancing transaction
tool). I believe it is correct that it would have been possible to identify a
balancing transaction inserted in this way both in the branch accounts
available to a SPM, and in the audit trail (available via the Audit Record
Query (ARQ) process). I am less familiar with the reference to “transaction
acknowledgment’ but believe that this related to systems for updating
branch account records by the use of client data, for example, Camelot
records of National Lottery sales, rather than by an SPM performing manual
input into the Horizon counter.
. “17/08/2015”. I believe this statement to be correct, and it mostly restates
what is contained in the previous statements. The sentence starting with
“There is no evidence...” I believe also to be true. To my knowledge, the
origin of the idea that branch accounts had been or could be inappropriately
accessed appears to be the account of the visit of Michael Rudkin to
Fujitsu’s Bracknell building, where he believes that such access was
demonstrated to him. My understanding is that on this visit he spoke to
Page 22 of 54
53.
54.
WITNO00530100
WITNO0530100
Martin Rolfe, a member of POL staff that worked in what was known at that
time as the Joint Test Team.
The Inquiry has asked that I consider POL00091411 (Chronology of statements
made by Post Office in respect of “Remote Access” Allegation) and set out to
the best of my knowledge, the extent to which Fujitsu provided information to
POL that (a) it relied on in making those statements or (b) was consistent with
those statements. Given that the statements were all made in 2015, I believe I
had no direct involvement in providing information that POL relied on in making
those statements. It may be the case that had people within POL read the
documents that I had provided up to that time, then they may have found
information that was consistent with some of the content of those statements.
At least in the case of the balancing transaction, and possibly in relation to
transaction corrections and transaction acknowledgements, information
consistent with those statements was contained within documents provided to
POL at various stages, but for purposes not necessarily related to the making
of the statements.
In terms of others at Fujitsu providing information that POL may have relied on
in making those statements, I believe I remember hearing a conversation taking
place in Fujitsu’s Bracknell building, I think involving James Davidson, Pete
Newsome and possibly others, in which they were discussing whether Fujitsu
had the ability to amend, edit or delete transactions. However, I was not directly
involved in the conversation. It does seem possible that this conversation was
in 2014 or 2015. My recollection is only that those taking part in the
conversation were themselves unclear as to what the answer was, and that
Page 23 of 54
WITNO00530100
WITNO0530100
they needed to consult with members of the Third and Fourth Line support
teams.
THE GLO PROCEEDINGS
55. The Inquiry has asked me to summarise my understanding of the support or
services Fujitsu provided to POL in the below matters, and to describe the
nature and extent of any involvement I had in providing such support or
services.
(i) POL’s defence of the GLO proceedings
56. My understanding is that the claimants, through their expert Jason Coyne and
legal representatives Freeths, made requests for information to POL, via their
lawyers WBD, and where those requests required information from Fujitsu,
WBD made requests to Fujitsu.
57. _ If the information was available, Fujitsu then provided the information; if it was
not available, Fujitsu then provided an explanation of why it was not available.
Within Fujitsu it was not always immediately known where some information
was or whether it existed at all, so while many requests were relatively simple
to respond to, others took longer as there was a need to carry out searches in
order to attempt to locate information.
58. The provision of information by Fujitsu went further than the simple
transmission of existing documents and records, as there were many requests
originating from both WBD, and the claimants, for explanations, analysis, and
interpretation of the information that had been provided. Fujitsu were also
asked in some cases to provide detailed explanations as to how certain
information had been found and retrieved.
Page 24 of 54
WITNO00530100
WITNO0530100
59. As Document Manager, with the responsibilities outlined in paragraphs 8 to 15
above, I was one of the main contacts within the POA for the retrieval of some
of the documents and records to be provided, and this included being one of
those involved in transmitting the information to WBD. Due to the number of
requests made, I also became involved in helping to gather and collate
information.
(ii) The work carried out by Deloitte under the Project Bramble
60. I had less involvement with the work carried out by Deloitte than I did with the
GLO Proceedings, and as a result I am less clear on the type of support that
Fujitsu provided.
61. My limited understanding is that the support would again have taken the form
of requests for information, and where that took the form of Horizon design
documentation, then those requests would most likely have come to me. As I
recall, I dealt with only a relatively small number of requests and did not have
much interaction with external parties in relation to this exercise. As I have
explained previously in this statement, it is clear to me that various pieces of
work were taking place within POL in the several years prior to the GLO
Proceedings, and some of those may have resulted in requests to Fujitsu for
information, some of which may have been fulfilled by me, but the extent of my
involvement was such that I was not necessarily aware of what the information
was used for within POL.
Page 25 of 54
WITNO00530100
WITNO0530100
Process for providing information
62. The Inquiry has asked that I summarise how Fujitsu searched for and provided
information and/or documentation to POL relevant to BEDs and/or remote
access for the purpose of the GLO Proceedings. I would like to make clear that
all information and documentation provided by Fujitsu to POL for the purpose
of the GLO Proceedings was provided via WBD rather than directly from Fujitsu
to POL.
63. My recollection is that among the first ‘bulk’ packages of information that Fujitsu
provided to WBD for passing on to the claimants were the complete technical
design document sets for Legacy Horizon and HNG-X, and the current versions
of all immediately available KELs. Both sets of documents were readily
identifiable; the design documents were downloaded from the Dimensions
database, an off the shelf application that facilitates the uploading and
downloading of documents in bulk; the KELs were more difficult to obtain as
they are stored in a bespoke database that was not designed to allow for bulk
exports of its contents; work was therefore required to create a method of
exporting the contents in a readily usable form.
64. These packages were transmitted to WBD in the form of a portable hard drive
delivered by courier. The packages followed on from an earlier provision of a
smaller subset of design documents and KELs that had been provided at the
request of Jason Coyne, following a visit by him to Bracknell, in November
2017, at which he had been provided by members of the SSC with a
demonstration of the KEL database. I understand that Mr Coyne then carried
out various searches within these packages in order to locate records and
Page 26 of 54
65.
66.
WITNO00530100
WITNO0530100
documents that led him to identify the 29 BEDs that were central to the GLO
Proceedings. I believe he carried out similar searches in order to identify
information that related to “remote access”.
I believe the provision of the design documents and KELs package was
followed by all currently available Peaks. Design documents, KELs, and Peaks,
normally contain cross-references to other records, which resulted in requests
for other information, such as OCRs, Service Review Reports and Help Desk
Call Logs.
Due to the period of interest being around 20 years, there were difficulties in
locating some information. Systems and people had changed significantly over
time, and information had been archived, or was no longer related to current
operations and was therefore not immediately familiar to current staff. As
described in relation to the KEL database in paragraph 63 in this statement,
sometimes information is stored in repositories that are not designed to facilitate
bulk downloads or exports of records in easily usable formats, and this was the
case with several other types of information Fujitsu was asked to provide. The
changeover from Legacy Horizon to Horizon Online, and the fact that in the late
1990s to early 2000s storage costs were relatively expensive, meant that some
information from the early period of Legacy Horizon had been archived to offline
storage such as portable hard disks and optical disks (or, in some cases,
deleted, in order to save online storage space). These factors meant that
searches were sometimes time consuming and complicated, and it was
sometimes unclear if data simply had not yet been found, or whether it in fact
no longer existed.
Page 27 of 54
WITNO00530100
WITNO0530100
67. I What I am describing is that the provision of information by Fujitsu was driven
by requests from the claimants, and that those requests evolved over time, and
expanded to include more information as, presumably, the claimants analysed
the information in their possession. There was no strategy that I am aware of
to ensure that all information was provided in a single limited time exercise.
68. Both WBD, on behalf of POL, and the claimants, via Freeths and WBD, also
made requests for analysis and explanations. These normally involved
consulting with various subject matter experts within Fujitsu, and as referred to
earlier, a small group were regularly involved in providing those analyses, with
occasionally other members of the wider POA team being consulted.
Disclosure and electronic documents questionnaire
69. The Inquiry has asked me to explain the nature and extent of Fujitsu’s
involvement with assisting POL with information relevant to completing its
disclosure list or electronic documents questionnaire (EDQ).
70. FUJ00158114 shows that Michael Wharton of WBD sent a draft of the electronic
documents questionnaire (Draft EDQ) to Fujitsu on 6 December 2017, following
a previous email in the same chain on 28 November 2017 in which Amy Prime
of WBD requested a call with Fujitsu on 30 November 2017 to discuss the
location of potentially relevant documents. I do not specifically remember the
content of that call, but believe that I did take part, probably with Pete Newsome
and Chris Jay. It makes sense to me then that at least some of the information
that WBD populated into the Draft EDQ was derived from the call on 30
November 2017. It is possible that Pete Newsome may have had other calls
with, or sent other emails to, WBD on the same subject of which I am unaware.
Page 28 of 54
WITNO00530100
WITNO0530100
71. Taking each section of the EDQ in detail (referring to FUJ00158115 and
FUJ00158119):
a. “Known Error Log (KEL)”. As I outlined at paragraph 18 above, although I
had user credentials to log into the SSC website that contained KELs since
mid-2016, I was not familiar with KELs, having at that time used the access
only for the purpose of accessing Peaks. I believe that the information
relating to KELs did not originate with me, but in the meeting was most likely
to have come from Pete Newsome (I presume as a result of him having
consulted with the SSC). I do not recall commenting on this section, and
WBD did not make any specific requests for clarification within it.
b. “Dimensions”. This information almost certainly came from me.
c. “Peak System”. As I outlined at paragraph 18 above, although I had access
to the Peak system from mid-2016, I believe that the information did not
originate with me, but in the meeting was most likely to have come from
Pete Newsome (I presume as a result of him having consulted with the
SSC). I made one comment on the draft (see page 2) that related to Peak
being applicable to both Horizon and HNG-X; this was based on wanting to
clarify the distinction and did not rely on any detailed knowledge of Peak
itself.
d. “TFS and Powerhelp”. I am unfamiliar with both of these systems, so it is
unlikely that I was the source of the original information. I believe that where
WBD asked for confirmation on a point, I consulted with another member of
the POA team, Sandie Bothick, and added the confirmation.
Page 29 of 54
WITNO00530100
WITNO0530100
e. “SharePoint and shared drives, Projectweb”. This information almost
certainly came from me.
f. “Emails”. This information almost certainly came from me.
g. “Local computers”. This information may well have come from me.
72. Asis apparent from FUJ00158114, which contains an email attaching the Draft
EDQ that was sent to Fujitsu on 6 December 2017, only a brief period was
available in which to review and comment on the draft, as it was sent at 10:19,
with the request that we return comments by 14:30 the same day (on the basis
that the EDQ needed to be exchanged that day).
Provision of KELs
73. The Inquiry has asked me to explain the reason(s) why Fujitsu did not provide
all documents relevant to the existence of BEDs (such as full copies of KELs
and/or PEAKs) to POL when initially requested as part of the disclosure process
for the GLO Proceedings. My understanding is that in response to the initial
request, Fujitsu provided the most recent version of all KELs that were
immediately available in the live KEL system that the Fujitsu support teams
used; this being KELs that were categorised as “Authorised” (i.e. approved by
SSC management for operational use) and may be regarded as “live” (i.e. did
relate to the current Horizon system) and those categorised as “Deprecated”
(those that were no longer regarded as live, because the issue they related to
no longer occurred for whatever reason in the current Horizon system).
74, I recall it being explained to me that the search tool within the KEL system
defaulted to search only the live KELs, but that the support staff could easily
Page 30 of 54
75.
76.
WITNO00530100
WITNO0530100
configure the search to also include the deprecated KELs. This is the set of
KELs transmitted via WBD to the claimants in May 2018, as can be seen in the
letter from WBD to Freeths of 25 October 2019 (FUJ00167332).
The first set of KELs could only include KELs that existed up to the date of the
extract. As a result of the passage of time, a second set of KELs in the same
categories as those described above, which were new KELs created since the
date of the first extract, was provided in January 2019. This was effectively a
“catch-up” exercise. To my knowledge, no method of keeping the claimants up
to date with new KELs as they were created and authorised had been
discussed, although I assume it was apparent to the claimants that new KELs
may be created. I am also not aware of whether there was any cut-off date in
terms of issues that may or may not be dealt with during the trial.
I recall that, at some point after the first set of KELs was provided, as a result
of a specific query from WBD asking if there were KELs relating to the issue at
Callendar Square, John Simpkins of the SSC found and retrieved a KEL from
a deleted table within the SSC website. The deleted table was not searchable
directly from the KEL tooling in the same way that a live or deprecated KEL
was. Mr Simpkins had already been aware that, at some point in the past, some
KELs had been deleted because they were no longer relevant to the live
system, but my recollection is that he only located the deleted table as a result
of a general search for these specific Callendar Square related KELs, the
references of which had been identified from cross-references within some
Peaks. Mr Simpkins was able to retrieve two relevant KELs from the deleted
table, and these were then provided to the claimants via WBD. During the GLO
Page 31 of 54
77.
78.
WITNO00530100
WITNO0530100
Proceedings, I learned from Mr Simpkins that KELs may be deactivated when
the problem they relate to has been resolved; this removes them from default
searches, but they can optionally be included. I passed this information to Ms
Prime (FUJ00086758). KELs may be deleted if the function they refer to no
longer exists in the live system; these cannot be optionally included in a search
but are stored in a separate deleted table. I believe that prior to 2008, deleted
KELs were not stored in a deleted table but were simply permanently deleted.
Following the deleted table being found, all of the KELs it contained were
extracted and provided. It was also the case however that there were KELs that
were known to have been deleted but which did not exist within the deleted
table, and these could not be retrieved by any means. This is an example of
where information that was not stored in current operational areas, and with
which current staff were not familiar, sometimes took longer to find, as
described at paragraph 66 above.
There was also the issue relating to the fact that in many cases previous
versions of KELs did exist, contrary to what had been stated in the EDQ. The
statement in the EDQ (FUJ00158119) “The previous entries / versions of the
current entries are no longer available” is incorrect. The error in the EDQ
became apparent following a specific query to Fujitsu from WBD as to the
validity of this statement in early October 2019. Having received from Fujitsu
the information that previous versions of KELs did in many cases exist, WBD
requested that Fujitsu retrieve and provide all existing versions of KELs, and
also informed Freeths. It was known that not every superseded version that
had ever existed was available for various reasons; I believe versioning had
Page 32 of 54
WITNO00530100
WITNO0530100
only been introduced at a certain point, and also that some superseded
versions of some KELs had been permanently deleted in the past. Knowledge
of these details was particular to certain members of the SSC, I do not think
that this was generally known within the POA.
79. Although this resulted in an apparently large number of KELs being provided
by Fujitsu to WBD after the trial, the set provided comprised of both all old
versions, where the more up to date version had already been provided, and
the latest versions of KELs (FUJ00166835 and FUJ00086847).
Provision of Peaks
80. Regarding Peaks, it was known that the current live Peak database had
replaced an earlier but similar system known as “PinICL” in around 2003. I
believe it is the case that at the point of the cutover from PinICL to Peak, only
open (i.e. unresolved) PinlICLs were transferred to Peak, while PinICLs that
were closed (i.e. resolved) were archived. The two systems used the same form
of reference identification numbers, with the prefix “PC” followed by seven
digits; as Peak continued the numbering sequence from PinlCL, the reference
numbers for the two systems are not readily distinguishable.
81. Atsome point after the original set of Peaks was provided, a request came from
WBD as a result of the claimants having come across cross-references within
Peaks that they did already have, to what appeared to be other Peaks that they
did not have. This led to the realisation that the “missing Peaks” may be
PinICLs that had not been migrated into the Peak system.
Page 33 of 54
82.
83.
84.
WITNO00530100
WITNO0530100
John Simpkins had a recollection that PinICLs had been archived at various
times to an Access database, which led me to search for and then find two such
Access databases on a file share, so outside of the SSC website and not
connected with the current live Peak system. I recall needing to set up
permission for John Simpkins to access the file share. It was then possible to
retrieve and provide some, but not all, of the PinICLs that the claimants had
been asking for; some of the referenced PinICLs being requested were not
present in either of the Access database archives. Subsequently the two
databases and two related Excel indices of their contents were provided to the
claimants. I recall that the archiving of PinICLs to the Access databases was
thought to have been done by Lionel Higman pre-2003, with no record of what
the criteria was, and it is therefore unknown why some of the referenced
PinlCLs were not included in either of the Access archives. At the time, I recall
discussing the matter with John Simpkins and as a result I considered that they
had either been deleted, or were archived by some other means, that archive
then being lost.
This is another example where information that was not stored in current
operational areas, and with which current staff were not familiar, sometimes
took longer to find, as described in paragraph 66 above.
The Inquiry has also asked that I explain why I agreed with Stephen Parker's
question “Do we really want to start sharing more Peaks unless they request
them as I can only expect more requests to deep dive investigations from
them?” in FUJ00203305. I note that the question was asked by John Simpkins
rather than Stephen Parker. The sentence contains two parts, a somewhat
Page 34 of 54
WITNO00530100
WITNO0530100
rhetorical question: “Do we really want to start sharing more Peaks unless they
request them’, and then a statement: “as / can only expect more requests to
deep dive investigations from them’. It is clear to me that I was agreeing with
the statement — that if more Peaks are shared then more requests for
investigations can be expected. From the remainder of my sentence, it is clear
to me that I believed that, as a result of us responding to the request for the
individual Peak, it was likely that we would be requested to provide the
additional Peaks that post-dated the set that we had already provided, and that
we would then provide them. In summary, I am effectively saying, “Agreed,
while we may not want that, because, yes, it will cause more work for you, it is
probably now inevitable.”
85. As stated in paragraph 75 above in relation to KELs, to my knowledge there
had been no discussion or arrangement in relation to ensuring that the
claimants were kept up to date with any new Peaks created since the original
set was provided. I believe it was clear to all parties that these were live
operational systems, and therefore new Peaks and KELs would continue to be
created.
Investigations regarding deleted Horizon KELs
86. The Inquiry has asked me to set out what, if any, investigation I carried out in
respect of “deleted Horizon KELs” following receipt of the John Simpkins’ email
of 14:40 on 26 September 2018 (with reference to FUJ00179940) and what I
told WBD and/or POL on this issue. To confirm, all of my communication in
relation to the GLO Proceedings with parties external to Fujitsu was via WBD,
and not directly with POL.
Page 35 of 54
87.
88.
89.
WITNO00530100
WITNO0530100
John Simpkins’ email of 14:40 on 26 September 2018 alerted me to the
existence of deleted but retrievable KELs for the first time. It was clear to me
that:
a. Fujitsu would need to explain how the specific KELs in question had been
found and why they had been deleted;
b. further questions would follow as to how many other deleted KELs there
were and the reasons for them having been deleted; and
c. any deleted but retrievable KELs would ultimately need to be provided.
I outlined the first two of these concerns and asked for further clarification in my
email to Dave Ibbett, John Simpkins and Pete Newsome at 15:56 on 26
September 2018 (FUJ00179952). John Simpkins provided the explanation of
why the KEL had been deleted, which was because the issue had been fixed
by the S90 release. Pete Newsome agreed to that explanation being provided,
and in a separate email asked that I explain to WBD how the KEL had been
found by John Simpkins “on a local drive” (FUJ00179940).
On the next day, 28 September 2018, I sent an email at 14:07 to Lucy Bremner
(WBD) attaching with two Peaks and a KEL (FUJ00159985), explaining that
two relevant KELs had been deleted, the reason for the deletion, and that the
text from one of them had been retrieved. I believe that I did not include the
part suggested by Pete Newsome about the KEL being found “on a /ocal drive”
as I thought it may not be accurate, as John Simpkins had stated in his email
of 14:40 on 26 September 2018 that he had retrieved the KELs from “the
deleted Horizon KELs table”, which I believed to be within the SSC website
Page 36 of 54
90.
91.
92.
WITNO00530100
WITNO0530100
rather than “on a local drive”. After a few minutes, I sent another email to Lucy
Bremner attaching the other relevant KEL.
At 09:37 on 11 October 2018 I received an email from Lucy Bremner asking for
further information on the deletion of KELs (FUJ00160063). I discussed these
questions with John Simpkins via email (FUJ00181400) and then provided
responses back to Lucy Bremner at 15:51, to which she replied almost
immediately, asking how many deleted KELs there were. I passed this question
to John Simpkins. I believe it can be seen in this email chain that I was seeking
clarification where I believed it was needed, and also anticipating what would
be likely follow up requests from WBD. I believe it is also evident that my role
was acting as a contact point between WBD and the Fujitsu team, passing on
the information to either side in such a way as to provide clarity, for example
asking John Simpkins for clarifications on his answers to my questions before
passing the information back to WBD.
As explained to me by John Simpkins, I explained to WBD that:
a. it was a general rule that KELs were deleted when the issues that they
described were known to be fixed; and
b. deleted KELs were not currently text searchable, and that to make them so,
they would first need to be retrieved.
I also provided WBD with details of the documents already in their possession
that explained the process. I further provided WBD with the total numbers of
HNG-X and Legacy Horizon KELs that had been deleted.
Page 37 of 54
93.
94.
95.
96.
WITNO00530100
WITNO0530100
On reviewing the ‘End to End Application Support Strategy’
(SVM/SDM/PRO/0875) (FUJ00080212), which relates to Horizon Online, I
understand that KELs should be deleted when “the function they refer to no
longer exists in the live system” (section 11.2.5). I also understand from this
document that KELs “should be updated with details of when a resolution was
delivered to the live estate. KELs should not be deleted under these
circumstances since code regression may occur later’ (section 11.2.4).
Whether this was different for Legacy Horizon, which was the period the KELs
in question related to, I do not know.
It should be made clear that I was not the manager or supervisor of the overall
activity of the provision of information to WBD and neither was I the manager
of any of the members of the Fujitsu team involved. I believe this is evident in
the email chains, in that I am normally asking questions and seeking
clarification. The manager of the overall activity was Pete Newsome. The
immediate manager of John Simpkins was Stephen Parker.
I recall thinking that it was inevitable that Fujitsu would need to provide the
deleted KELs, and also that, given the nature of the GLO Proceedings, it was
clear that KELs that had been deleted because the issues that they related to
had been fixed, would certainly be regarded as potentially relevant.
As I have explained at paragraph 66 above, there was no overall strategy that
I was aware of to ensure that all information was provided in a single limited
time exercise; the provision of information by Fujitsu was driven by requests
from WBD, and the ways in which some information was stored within Fujitsu
did not facilitate the retrieval of information that was no longer operationally
Page 38 of 54
WITNO00530100
WITNO0530100
current. I believe it is also relevant to note that some members of the Fujitsu
team appeared to wish to minimise the amount of work in relation to this
exercise. To my knowledge, none of the Fujitsu team, including me, were
engaged on this exercise on a full-time basis, but were supporting these
activities alongside their normal roles on the POA.
Witness statement preparation
97. The Inquiry has asked me to describe the nature and extent of my involvement
with preparing or assisting in the drafting of witness statements in the GLO
Proceedings.
98. My recollection is that my involvement with preparing or assisting in the drafting
of witness statements in GLO Proceedings was more limited in comparison to
most of the other activities relating to the GLO covered in this witness
statement, which I have described as being collective in nature, with requests
and responses often being received and sent by me and/or one of the project
managers. In the case of witness statements, communication between WBD
and those providing the witness statements tended to be more direct.
99. ‘It is apparent from the email contained in FUJ00179872 that I assisted Torstein
Godeseth in obtaining answers to some questions from Jason Muir, and then
communicated these back to WBD. While the drafting note at 11.3.2 within the
draft of Torstein Godeseth’s witness statement (FUJ00179873) states that
confirmation is awaited from me, this was one of the questions that I put to
Jason Muir in FUJ00179872.
Page 39 of 54
WITNO00530100
WITNO0530100
100. I believe that the other witness statements to be provided by Fujitsu were of
Stephen Parker, William Membery, and Andrew Dunks. I do not recall having
much involvement with these during the original drafting process. I would
however have been copied into some email chains for the purpose filing the
emails in the email archive and keeping records of the statements.
Corrections of witness statements
101. The Inquiry has asked me to explain my understanding of the reasons why
corrections needed to be made to Fujitsu employees’ witness statements in the
Horizon Issues trial, in particular that of Stephen Parker. My view is that it came
down to a lack of knowledge and familiarity on the part of some of those giving
the witness statements with some aspects of the Horizon systems, particularly
Legacy Horizon, and the ways in which the solution had been supported over
the twenty or so years of existence.
102. By the time the statements were being written, Horizon Online had been in use
for eight years, and it was significantly different from Legacy Horizon. Legacy
Horizon no longer existed in any form, so it was not possible for anyone to re-
familiarise themselves directly with how it worked. Some records from the
Legacy Horizon period were no longer available. Even when Legacy Horizon
had last been operational, during 2010, it had undergone significant changes
from the system that had existed between 1996 to 2003. The Horizon solution
is highly complex — different people work on different aspects of the system,
and there are specialists even within teams. No one individual within Fujitsu is
able to attest to every aspect of the system and the way that it has been
supported over twenty years. My belief is that some of those who provided
Page 40 of 54
WITNO00530100
WITNO0530100
witness statements simply made mistakes in what they wrote through lack of
knowledge.
103. Normally documents covering wide ranging technical aspects of the solution
would receive reviews from various parts of the POA in order to try to ensure
accuracy and avoid omission, and this means that they are effectively jointly
written by the POA rather than being the isolated work of an individual. It seems
to me that witness statements are not subject to such thorough peer review but
are the personal statements of those that sign them, so when the statements
deal with complex technical issues, particularly over two decades, it is much
more likely that they will contain errors and omissions.
Stephen Parker's witness statement
104. The Inquiry has asked me to explain my understanding of why the position on
remote access as described in Stephen Parker's second and third witness
statements had not been set out by Fujitsu at an earlier stage. Following on
from paragraphs 101 to 103 above, my belief is that this was mostly due to a
lack of knowledge on the part of Stephen Parker, and any others who may have
assisted with the drafting of the original and second witness statements.
Whether this was knowledge that was never possessed by Mr Parker and
others, or had once been known but was subsequently forgotten over the years,
I do not know.
105. I would suggest however that it may also be indicative of a certain level of
complacency about some support matters, particularly in the very early period
of Horizon, where support teams were themselves still learning about how to
support the system and how to resolve problems that arose. All support teams
Page 41 of 54
WITNO00530100
WITNO0530100
inevitably want to ‘fix things’ and will sometimes use a workaround if that
appears to be a pragmatic, or perhaps the only, course of action. I believe this
makes it more likely that procedures may be informally developed that are not
documented, have not been formally reviewed and approved, and the risks
involved may not always have been fully appreciated. Had the subject of the
need for any remote access in Legacy Horizon been appropriately developed
and formally documented during its period of development and early operation,
then those writing the witness statement would have been more likely to have
had a reliable foundation on which to base their statements on that subject, no
matter what period was being covered. Additionally, had the methods
employed by support teams been based only on such documented procedures,
then all methods used may have been more clearly known. In my view, this
appears to have been appreciated during the creation of Horizon Online, where
specific tools to carry out tasks that may be regarded as forms of remote
access, such as the balancing transaction tool and other branch database
related tools, were formally developed, tested, and documented.
106. The Inquiry has asked me to set out my views of WBD’s explanation of the
disclosure issues relating to KELs in WBD’s letter to Freeths on 25 October
2019 (FUJ00167332). My view is that each explanatory point provided in the
letter is accurate. I recall being involved in discussions that related to the
provision of that explanation with members of the Fujitsu team, WBD, and also
Fujitsu’s then external lawyers, Pinsent Masons.
107. lam aware that this letter is dated after the conclusion of the GLO Proceedings
and is a response to a letter from Freeths dated 11 October 2019
Page 42 of 54
WITNO00530100
WITNO0530100
(POL00043107) which essentially asked for an explanation as to why KELs had
been disclosed at different times in the lead up to, during, and after the court
proceedings. The letter from Freeths refers to the particular statement in the
EDQ in relation to KELs that “The previous entries /versions of the current
entries are no longer available” as being incorrect and points out the
seriousness of the matter.
108. While I consider it is right that this matter was challenged by Freeths, I am not
aware if there was any impact from the late disclosure of superseded versions
of KELs (of which the most recent versions had already been disclosed) and I
do not recall WBD raising any further concerns with Fujitsu after they were
disclosed. The introduction of the incorrect statement into the EDQ was an
error on the part of someone within Fujitsu or WBD, but it is not clear to me
who. The EDQ was completed in December 2017, close to the start of Fujitsu's
provision of information, and I do not recall it being revisited at any point until
around the time of these letters in October 2019, so that there was not any other
point at which the incorrectness of the statement might have been noticed.
109. As noted in paragraph 72 in this statement, in December 2017 Fujitsu had been
given approximately four hours in which to review and respond to the EDQ, and
clearly the review that it was subjected to was inadequate. I do not believe it to
have been a deliberate attempt to withhold information.
110. In paragraphs 62 to 68 in this statement, I gave my views on the reasons for
some of what could be described as the fragmented provision of information in
relation to the GLO, and I believe that is relevant here. I am of the view that
prior to the court proceedings, myself, and other members of the Fujitsu team,
Page 43 of 54
WITNO00530100
WITNO0530100
were not as aware as we perhaps should have been of the importance of
disclosure. I do not recall any instructions or guidance being given regarding
disclosure in relation to the GLO Proceedings.
Other involvement in the GLO Proceedings
111. The Inquiry has asked me to summarise any other involvement I had in the GLO
Proceedings, or supporting POL’s defence of the same, in so far as is relevant
to the Inquiry.
112. During the court proceedings, a member of Fujitsu staff normally attended the
court hearings in order to observe proceedings and act as a contact, if needed,
between WBD, POL’s barristers, and the POA. I attended in this capacity on at
least two occasions. I recall that this involved activities such as making contact
with the most appropriate person in the POA in the event of an urgent query
from the POL legal team, and providing brief reporting notes for the POA at the
end of the day.
113. As I understand it, it was originally planned that there would be a further trial
following the Horizon Issues trial, which would look at individual cases of some
(or possibly all, I am not clear which) of the claimants’ cases, but this did not go
ahead. I recall that I was involved in a small amount of preliminary work for
this, mainly in relation to helping to co-ordinate the extraction and delivery to
WBD of Horizon Service Desk call logs for individual claimants. This took place
towards the end of 2019 and was then terminated by WBD.
114. Fora short period in 2020 I was involved in the provision of historical information
to Peters & Peters, in connection with one SPM whose case was to be referred
Page 44 of 54
WITNO00530100
WITNO0530100
by the CCRC to the Court of Appeal. This was known to me to be a sample
case, following which there were, to my knowledge, no further similar pieces of
work.
115. I have also been involved with supplying information directly to POL in
connection with the Historical Shortfall Scheme, virtually all relating to the start
and end dates of Legacy Horizon and/or Horizon Online at specific branches.
116. Iauthored a report for POL that described the 29 BEDs detailing how and when
they occurred and were resolved; this was based on analyses carried out by
Fujitsu for the trial (POL00030528). The purpose of the report was to assist
POL in planning testing activities in order to assure itself that none of the 29
BEDs continued to exist.
Information sharing with POL
117. The Inquiry has asked what my impression was of POL’s purposes and/or
motives when seeking information in connection with the GLO Proceedings. I
was aware that the GLO Proceedings, specifically the Horizon Issues trial, was
a civil trial rather than an audit or a review, and that as such, the two parties
would be attempting to prove their positions. It seemed to me during this period
that POL’s purpose would be to demonstrate that any BEDs that may exist
within Horizon were not the cause of shortfalls or other balancing problems
experienced by SPMs, and also that the ability of Fujitsu to insert balancing
transactions or carry out any form of “remote access” did not cast doubt on the
integrity of Horizon and were not the cause of shortfalls or other balancing
problems experienced by SPMs.
Page 45 of 54
WITNO00530100
WITNO0530100
118. The Inquiry has asked me whether there was any reluctance or caution within
Fujitsu to sharing information with POL in relation to the GLO Proceedings and
Project Bramble. I am not fully aware of the exact scope of “Project Bramble”
as I understand it to be a POL name for a POL project, and my answer here is
based on the assumption that it covers all of the issues related to Common
Issues and Horizon Issues trials.
119. I was aware of caution in terms of the principle that any information that Fujitsu
shared with POL was to be done by transmitting information to WBD rather than
directly to POL, and any information which had not been shared previously in
the normal course of the contracted services provided by Fujitsu was only to be
used by POL for the purposes of the litigation. This was due to Fujitsu’s
ownership of the Intellectual Property (IP) rights for most of the design
documentation, which at that time was subject to future purchase by POL. This
was in order to protect Fujitsu’s future income from the purchase by POL of the
IP rights and to prevent POL from any attempt to use the IP to assist them in
replacing Fujitsu as the supplier of the application in use on Post Office
counters.
120. The volume of information to be provided in connection with the issues in the
GLO Proceedings was much greater than that which had been provided in
connection with the issues discussed at paragraphs 36 to 41 above. It included
all of the Fujitsu owned Horizon IP, rather than a select set of high-level
documents (most of which had already been shared with POL in the normal
course of the Horizon Contract).
Page 46 of 54
WITNO00530100
WITNO0530100
121. Particularly at the start of the process of providing information to WBD, there
were the normal security concerns relating to how the information would be
stored and potentially shared, and whether any redactions may be necessary
in order to protect the security of the Horizon system, POL, and Fujitsu. During
the trial itself there was significant concern over the potential for documentation
to be made public which may then expose the Horizon system, POL, or Fujitsu,
to cyber-attack, and I believe some documents were redacted prior to being
released to the press. There is always increased concern when it is likely that
any technical documents relating to Horizon may be shared outside of Fujitsu,
POL and other parties to the contract; technical documents entering the public
domain is regarded as a serious security risk. The concern was not, to my
knowledge, particularly in relation to information in relation to BEDs or remote
access, but to any and all technical information.
122. Occasionally some individuals that were being asked by WBD to provide
explanatory analysis in relation to information that Fujitsu provided during the
GLO Proceedings appeared to express some frustration over the amount of
information being requested. The process began with a clear set of requests
that were relatively simple to respond to, but gradually became more complex
and time consuming. This increasingly involved providing analysis and
commentary, rather than simply existing records and documents. Clearly there
is a distinction to be made between the provision of existing records and
documents on the one hand and providing analysis and opinion on the other. It
had been expressed within the group who were supporting the provision of
information to POL via WBD that the more information that was provided, the
more analysis and explanation would be requested, and there may have been
Page 47 of 54
WITNO00530100
WITNO0530100
a belief in some cases that the additional information and work did not in fact
shed any further light on matters beyond what had already been provided. I
certainly recall some staff that were tasked with providing analyses of events
that may have occurred many years previously, saying that they felt
uncomfortable in giving their opinion on what may or may not have occurred in
connection with, for example, a shortfall at a particular branch, or a certain
incident. I believe this was in recognition of the potential risk involved in
providing interpretation solely from available records of an individual Incident a
number of years after it had occurred. I recall Stephen Parker and Mark Wright
expressing this sort of view, however my sense is that it was an expression of
discomfort over such risks, rather than something that had any impact on the
responsiveness of Fujitsu to providing the information.
123. My own impression was that whatever was requested would need to be
provided, as any attempt to limit the flow of requested information would be
interpreted as obfuscation.
124. The Inquiry has asked me to set out my views on the adequacy of Fujitsu’s
provision of documents and information relevant to the GLO Proceedings and
Project Bramble.
125. I believe that I provided all of the information that was requested, as and when
it was known to exist. I make that qualification because there were instances
of requests that were responded to, only for additional information to be
discovered at a later date, and then provided, such as the Access database of
pre-Peak PinlCLs, or the database table of deleted KELs. Due to some of the
scenarios being investigated occurring in the relatively distant past, and
Page 48 of 54
WITNO00530100
WITNO0530100
involving systems that were no longer in use, some of the information did not
form part of current operational toolsets and staff working knowledge, so it was
not immediately known to me, or to others involved in the information gathering
exercise.
126. I find it difficult to say whether the information provided was adequate for the
purpose for which it was required; it is the information that Fujitsu was able to
retrieve, but I think there was an awareness that certain aspects were limited
and therefore not always as helpful as might be hoped for. However, the risk
and significance of such limitations may not have been as fully appreciated in
the past, as itis now. For example, the transactional audit trail prior to 2007 no
longer exists; Legacy Horizon no longer exists and cannot be replicated;
detailed audit logs of which counter keys and buttons were pressed by SPMs
do not exist; where Incidents involving SPMs were passed back to POL, Fujitsu
had no onward audit trail of what occurred afterwards, leaving the
consequences of some BEDs unrecorded; files originally attached to closed
Legacy Horizon Peaks had been deleted some years before, and were not
retrievable. We were therefore unable to provide some types of information
that may have been helpful in understanding some of the issues more clearly.
127. Overall, my view is that the provision of documentation and information was
effectively adequate. Although criticism has been expressed over the late
disclosure of KELs, some of which followed the court proceedings, as explained
in paragraph 108 above, I am not aware of the impact it had. I think it could
potentially have been a significant omission that Fujitsu did not identify and
provide the retrievable deleted KELs at an earlier date, but as far as I am aware,
Page 49 of 54
WITNO00530100
WITNO0530100
Mr Coyne identified all 29 BEDs that formed the basis of the claimants’ case by
analysing the sets of Peaks and KELs that were provided to him in 2018. The
superseded KELs that were provided so late on were old versions of KELs that
had already been provided. Although the issue of the superseded KELs and
the erroneous statement in the EDQ was described by Freeths and WBD as
serious, the fact that KELs had versions, and that previous versions of KELs
could be viewed, was stated within the ‘End to End Application Support
Strategy’ (FUJ00080212) that I assume Mr Coyne read as it was referred to by
him in one of his statements to the court (FUJ00082162).
128. I believe that Fujitsu, in almost all cases, provided the information that was
requested in a timely manner, and in those cases where it was late or lacking,
it was through error rather than intention. As I have mentioned already, the
information provided by Fujitsu went beyond the disclosure of existing
documents and records, and extended into analysis and interpretation.
GENERAL
129. The Inquiry has asked me to set out whether there is anything I would have
handled differently with hindsight. I think the provision of information by Fujitsu
should have been carried out in a more organised way. Appropriate legal
advice and oversight should have been provided for those within Fujitsu, and
for the purpose of liaising with POL’s legal representatives, as, for example, I
attended a number of meetings with WBD without any Fujitsu legal
representative being present. This would, I think, have led to a better
understanding of the importance of, and risks related to, disclosure. It may also
have addressed issues relating to the risks of providing analysis and
Page 50 of 54
WITNO00530100
WITNO0530100
commentary on specific BEDs, and identifiable SPMs, branches, and Incidents.
The performance of Fujitsu in this matter would probably have been improved
had the team providing the information been adequately resourced so that it
was not only being done by staff who also all had other “business as usual”
work to do. I think that I and other members of the Fujitsu team involved were
placed in a position of risk due to the lack of legal oversight and advice. Lack
of experience in such matters meant, I believe, that no-one in the team, certainly
not me, realised that we should perhaps have tried to insist upon better
oversight.
Statement of Truth
Dated: 14 May 2024
Page 51 of 54
WITNO00530100
WITNO0530100
INDEX TO THE FIRST WITNESS STATEMENT OF
MR MATTHEW LENTON
Exhibit
No.
URN
Document Description
Control No.
FUJ00226322
Email chain last dated 2 December 2010
with subject “ARC/GEN/REP/0004 (urgent
Document request)”
POINQ0232439F
FUJ00226326
Email chain last dated 29 September 2011
with subject “FOR INFORMATION:
ARC/GEN/REP/0004 V1.0 HORIZON
DATA INTEGRITY”
POINQ0232443F
FUJ00235020
Email dated 29 September 2011 with
subject “Fujitsu POA Document For
information Only: ARC/GEN/REP/1229
v0.1 Horizon Online Data Integrity”
POINQ0241010F
FUJ00091411
HNG-X Architecture - Branch Database,
Version 3.0, dated 30 October 2009
POINQ0097582F
FUJ00235023
Branch Database High Level Design,
Version 1.0, dated 17 November 2009
POINQ0241013F
FUJ00164815
Host BRDB Transaction Correction Tool
Low Level Design, Version 0.4, dated 13
November 2007
POINQ0170993F
FUJ00235022
Email dated 30 November 2009 with
subject “HNG-X Document Approved:
DES/APP/HLD/0020 v1.0 Branch
Database High Level Design”
POINQ0241012F
FUJ00235028
Email dated 20 November 2009 with
subject “HNG-X Document Approved:
ARC/APP/ARC/0008 v3.0 HNG-X - Branch
Database”
POINQ0241018F
FUJ00235031
Comment sheet on HNG-X - Branch
Database, dated 15 October 2008
POINQ0241021F
10.
FUJ00194686
Fujitsu Work Instruction 3649S, dated 20
February 2019
POINQ0200403F
11.
FUJ00081584
Notes of a meeting between POL and
Fujitsu on Receipts/Payments Mismatch
issue, undated
POINQ0087755F
12.
FUJ00139162
Counter Supportability Requirements,
Version 0.2, dated 17 May 2001
POINQ0145357F
13.
POL00000912
CS Support Services Operations Manual,
Version 1.0, dated 7 November 2000
VIS00001926
14.
FUJ00086586
Peak PC0195561, dated 4 May 2010
POINQ0092757F
Page 52 of 54
WITNO00530100
WITNO0530100
Exhibit
No.
URN
Document Description
Control No.
15.
FUJ00087431
Branch 226542 Transfer Out doubled up
Report, dated 10 March 2010
POINQ0093602F
16.
FUJ00169057
Email chain last dated 6 April 2016 with
subject “Post Office's handling of the
complaints made by Sub-Postmasters
about the operation of the Horizon
software system”
POINQ0175238F
17.
FUJ00224733
Email chain last dated 28 April 2016 with
subject “Project Sparrow - Code Review”
POINQ0182419F
18.
POL00028062
Deloitte draft Horizon Desktop Review of
Assurance Sources and Key Control
Features, dated 23 May 2014
POL-0023065
19.
FUJ00156902
Email chain last dated 31 October 2013
with subject “Post Office — Terms of
Reference for Expert”
POINQ0163096F
20.
POL00091411
Chronology of statements made by Post
Office in respect of “Remote Access”
Allegation, undated
POL-0090433
21.
FUJ00194687
Fujitsu Work Instruction 3028L, dated 20
February 2019
POINQ0200404F
22.
FUJ00158114
Email chain last dated 6 December 2017
with subject “Legally Privileged - EDQ
Appendix -Fujitsu documents [BD-
4A.FID26896945]”
POINQ0164290F
23.
FUJ00158115
Appendix D - Databases of electronic
documents, Fujitsu Databases, undated
POINQ0164291F
24.
FUJ00158119
Appendix D - Databases of electronic
documents, Fujitsu databases, undated
POINQ0164295F
25.
FUJ00167332
Letter from Womble Bond Dickinson LLP
to Freeths LLP with subject “Post Office
Group Litigation - Horizon Issues Trial:
KELs disclosure”, dated 25 October 2019
POINQ0173510F
26.
FUJ00086758
Email chain last dated 19 February 2019
with subject “Peaks/Kels which have not
been disclosed but referred to by Coyne
[WBDUK-AC.FID27032497]”
POINQ0092929F
27.
FUJ00166835
Email chain last dated 7 October 2019 with
subject “KELs - query [WBDUK-
AC.FID26896945)"
POINQ0173013F
28.
FUJ00086847
Email chain last dated 13 March 2020 with
subject “5000 KEL’s Legal and
Confidential”
POINQ0093018F
Page 53 of 54
WITNO00530100
WITNO0530100
Exhibit
No.
URN
Document Description
Control No.
29.
FUJ00203305
Email chain last dated 29 March 2019 with
subject “Bug 28 Drop and Go Bug Peaks”
POINQ0209025F
30.
FUJ00179940
Email chain last dated 27 September 2018
with subject “Calendar Square, Falkirk
[WBDUK-AC.FID27032497)"
POINQ0185657F
31.
FUJ00179952
Email chain last dated 27 September 2018
with subject “Calendar Square, Falkirk
[WBDUK-AC.FID27032497)"
POINQ0185669F
32.
FUJ00159985
Email chain last dated 28 September 2018
with subject “Calendar Square, Falkirk
[WBDUK-AC.FID27032497)"
POINQ0166163F
33.
FUJ00160063
Email chain last dated 11 October 2018
with subject “Calendar Square, Falkirk
[WBDUK-AC.FID27032497]"
POINQ0166241F
34.
FUJ00181400
Email chain last dated 11 October 2018
with subject “Calendar Square, Falkirk
[WBDUK-AC.FID27032497)"
POINQ0187117F
35.
FUJ00080212
End to End Application Support Strategy,
Version 1.0, dated 28 July 2011
POINQ0086383F
36.
FUJ00179872
Email chain last dated 26 September 2018
with subject “Your witness statement- now
v6 [WBDUK-AC.FID27032497]"
POINQ0185589F
37.
FUJ00179873
First witness statement of Torstein Olav
Godeseth in the High Court of Justice
queen's bench, Alan Bates & Others v
POL, dated 28 September 2018
POINQ0185590F
38.
POL00043107
Letter from Freeths LLP to Womble Bond
Dickinson with subject “Post Office Group
Litigation Horizon Issues Trial: Undisclosed
KELs”, dated 11 October 2019
POL-0039589
39.
POL00030528
The BED Report (29 BED as identified by
Fraser J, Version 1.0, dated 22 February
2021
POL-0027010
40.
FUJ00082162
Expert Report of Jason Coyne in the High
Court of Justice queen's bench, Alan Bates
& Others v POL, dated 16 October 2018
POINQ0088333F
Page 54 of 54