WITN11070100
WITN11070100
Witness Name: Naranker Dulay
Statement No.: WITN11070100
Dated: 12 September 2024
POST OFFICE HORIZON IT INQUIRY
FIRST WITNESS STATEMENT OF NARANKER DULAY
I, Naranker Dulay, will say as follows:
INTRODUCTION
1. lam anemployee of Imperial College London and hold the position of Reader
in Computing Science.
2. This witness statement is made to assist the Post Office Horizon IT Inquiry
(the "Inquiry") with the matters set out in the Rule 9 request dated 22
February 2024 (the "Request").
3. I have been asked to submit a written statement addressing the questions
set out in paragraphs numbered 3 to 16 of the Annex of the letter headed
“Request for information pursuant to Rule 9 of the Inquiry Rules 2006 —
Request number 1, regarding Dr Naranker Dulay" dated 22 February 2024.
4. I hold a BSc in Computer Science from the University of Manchester and a
PhD from the University of London. My research has focused on the design
and engineering of distributed systems. I have over 150 peer-reviewed
Page 1 of 11
WITN11070100
WITN11070100
publications and have served on many international program committees in
computer science. My teaching has included courses on Distributed
Algorithms, Compilers, Privacy Engineering, Databases, Computer
Architecture, and Network Security.
INITIAL APPROACH
5. — Imperial Consultants (a wholly owned subsidiary of Imperial College London
that facilitates consultancy services to third parties by employees of Imperial
College) approached me on the 29 August 2013 to ask if I would be
interested in a consultancy for them with a client that was seeking an expert
to produce a report in connection with a criminal matter. The focus of the
report was to examine the integrity of the software and its associated data. I
expressed my interest and later learned that the client was Cartwright King
Solicitors who were acting on behalf of Post Office Limited.
6. Professor Jeff Kramer was also approached and also expressed interest.
7. I believe that Professor Alexander Wolf was also approached by Imperial
Consultants but was away at the time and did not conduct any work or offer
any opinion on the Horizon IT System.
8. Professor Kramer and I subsequently worked together on the consultancy
for Imperial Consultants with the Post Office.
FIRST MEETING WITH CARTWRIGHT KING
9. A meeting was held at Imperial College on the 23 September 2013.
Attendees included one or more people from Imperial Consultants likely
including Business Development Executive Rosemary Paxman (later
Page 2 of 11
WITN11070100
WITN11070100
Rosemary Stevenson) and Business Development Manager Paul Cray, one
or more people from Cartwright King likely Martin Smith and Simon Clarke,
and me. Professor Kramer was away and did not attend the meeting. The
meeting is referred to in POL00327062.
10. I do not recollect the discussion at this first meeting. It would likely have
focused on the scope and the timeline of the work and the contents of the
document "Draft Scope for computer experts" (POL00040040) by Simon
Clarke of Cartwright King dated 17 September 2013.
SECOND MEETING WITH CARTWRIGHT KING
11. The second meeting between Imperial Consultants and Cartwright King was
held on the 13 January 2014 to further discuss the scope and timeline of the
work. This meeting was held at Imperial College London. Attendees included
one or more people from Imperial Consultants likely including Rosemary
Paxman (later Rosemary Stevenson) and Paul Cray, one or more people
from Cartwright King likely including Martin Smith and Simon Clarke, and me.
Professor Kramer was away and did not attend the meeting.
12. Following the second meeting Professor Kramer and I concluded that we did
not have sufficient knowledge about the Horizon system to scope and cost
the work as proposed so asked for the work to be separated into an initial
review that would produce a proposal for subsequent work.
13. An agreement (POL00210444) between the Post Office and Imperial College
Consultants was signed on the 28 April 2014 to cover the initial review. Any
subsequent work would require a new agreement.
Page 3 of 11
WITN11070100
WITN11070100
THIRD MEETING WITH CARTWRIGHT KING
14. Following the agreement (POL00210444) between Imperial Consultants and
the Post Office a meeting was held between Imperial Consultants and
Cartwright King on the 16 May 2014. Attendees at the meeting likely
included Rosemary Stevenson and Paul Cray from Imperial Consultants,
Martin Smith from Cartwright King, Professor Kramer, and me.
15. I do not recollect the discussion at the meeting. It likely discussed the
information and documentation that would help Professor Kramer and me
prepare the Initial Review.
16. The following documents were forwarded to Professor Kramer and me on
the 9 May 2014 by Imperial Consultants:
= "Draft Scope for Computer experts" (POL00040040) by Simon Clarke
of Cartwright King dated 17 September 2013.
= "draft Instructions — IC Consultants Ltd" (WITN11070101) by Simon
Clarke dated 9 May 2014.
= "Interim Report into alleged problems with the Horizon system
(POL00099063)" by Second Sight dated 7 July 2013.
17. The following documents were forwarded to Professor Kramer and me on
the 4 June 2014 by Imperial Consultants:
= "DES/SEC/HLD/0002, HNG-X Crypto Services High Level Design"
(POL00398766).
= "Description of Fujitsu’s System of IT Infrastructure Services supporting
Post Office Limited’s POLSAP and HNG-X applications, Throughout
the Period 1 April 2012 to 31 December 2012" (FUJ00237007).
Page 4 of 11
WITN11070100
WITN11070100
= "PSO/HNG/FRNF/REQ/001, Horizon Next Generation Conceptual
Design v2.1" (WITN11070102).
= "IT Organisation" (WITN11070103) slides.
= "Process management Systems Diagram (Version 14)"
(POL00398970).
= "ARC/NET/ARC/0001, HNG-X Technical Network Architecture"
(POL00140236)
= "DES/APP/IFS/0018, XML Message Audit between Counter and
BAL/OSR" (WITN11070104).
= "DES/NET/HLD/0016, Network Security High Level Design"
(POL00140237).
18. I do not recall any further meetings with Cartwright King, nor any meetings
with the Post Office or Fujitsu or their representatives prior to completion of
the Initial Review.
19. The Initial Review (POL00125569) was titled “Initial Review: Proposal for
investigation into the integrity of the Post Office Online accounting system”
and is dated 26 June 2014. It would have been forwarded by Imperial
Consultants to Cartwright King shortly after this date.
FOLLOWING THE INITIAL REVIEW.
20. Following completion of the Initial Review (POL00125569) no new
agreement was signed between Cartwright King and Imperial Consultants.
21. The following four events were held following the Initial Review
(POL00125569) and in the belief that a new agreement would be signed:
Page 5 of 11
WITN11070100
WITN11070100
= 19 August 2014. A general meeting at the Post Office’s premises in Old
Street, London. Attendees likely included Martin Smith and Simon
Clarke from Cartwright King, Julie George and Jarnail Singh from the
Post Office, likely someone from Imperial Consultants, Professor
Kramer, and me. I do not recollect the discussions at this meeting.
= 22 September 2014. A demonstration of the operation of a Horizon
branch terminal at the Post Office’s premises in Old Street, London.
Professor Kramer and I attended.
= 15 October 2014. A visit to Fujitsu's premises in Bracknell. The visit
included technical presentations and discussions with the staff from the
Post Office and from Fujitsu. Attendees likely included Andy Holt and
Steve Bansel from the Post Office, Steve Bembury, and Torstein
Godeseth from Fujitsu, James Davidson who may have been a
contractor, Professor Kramer, and me. I do not recollect the details of
the technical presentations or discussions with staff.
= 27 November 2014. A meeting at the Fujitsu's premises in Bracknell.
People at the meeting likely included Torstein Godeseth from Fujitsu,
Professor Kramer, and me. I do not recollect the discussions at this
meeting.
22. The following documents were emailed to Imperial Consultants, Professor
Kramer, and to me on the 25 November 2014 by Martin Smith at Cartwright
King:
= "Horizon Core Audit Process" (FUJ00210312).
= "ARC/APP/ARC/0001, HNG-X Architecture - Reference Data"
(WITN11070105).
Page 6 of 11
WITN11070100
WITN11070100
= "ARC/APP/ARC/0003, HNG-X Counter Architecture" (WITN11070106).
= "ARC/APP/ARC/0004, HNG-X Architecture - Branch Access Layer"
(POL00140245).
= "ARC/APP/ARC/0008, HNG-X - Branch Database" (WITN11070107).
= "ARC/APP/ARC/0009, HNG-X Architecture - Counter Business
Application" (WITN11070108).
= "ARC/SOL/ARC/0001, Horizon Solution Architecture Outline"
(WITN11070109).
= "SVM/SDM/PLA/0031, HNG-X Security Business Continuity Plan"
(WITN11070110).
23. Following a cursory examination of these documents and from the
information garnered from the four events enumerated in paragraph 21
above, Professor Kramer and I concluded that we would need access to
many more documents, possibly all available documents to form any opinion
or view on the integrity of the Horizon IT System.
24. We requested that the Post Office and/or Fujitsu set up a secure means to
let us to view or download all available digital documents and if feasible
provide an index of all available paper documents. The request was
disregarded.
CONCLUSION.
25. Imperial Consultants made several requests to Cartwright King for a new
agreement in the months following the Initial Review (POL00125569) to
refine and carry out the work proposed in the Initial Review. Anew agreement
Page 7 of 11
WITN11070100
WITN11070100
was never reached and communication between Cartwright King and
Imperial Consultants petered out.
26. Neither the Post Office, Cartwright King, Fujitsu or their representatives
expressed any dissatisfaction with the work that Professor Kramer and I
carried out nor challenged our independence.
27. At the time I assumed that the Post Office no longer wished Imperial
Consultants to carry out the work proposed in the Initial Review
(POL00125569) due to its complexity and cost.
28. On reflection the reason may have been that the Post Office decided that
Professor Kramer and I were likely to reach a negative opinion on the
integrity of the Horizon IT system if they acceded to our request for access
to a more comprehensive set of documents and that this was not something
that they desired.
Statement of Truth
I believe the content of this statement to be true.
Page 8 of 11
WITN11070100
WITN11070100
Index to Dr Dulay's Written Statement
Document I Control number
Item I URN Document Description
Date
1 POLO0327062 Email from Laura Pinkey to 16/09/2013 I POL-0173565
Simon Clarke and Martin
Smith
DraE Scope f I POL-0036522
2 Ipotoooaooao I “= °COPE Tor computer 17/09/2013
experts
3 Ipotoo210444 I Agreement to Appoint an _I 28/04/2024 I pOL-BSFF-0048507
Expert between Post Office
Limited and I C Consultants
Limited
dra Instructions —IC WITN11070101
4 Iwitnato7o101_ I Oe nstructions 09/05/2014
Consultants Ltd
5 POLO0099063 Interim Report into alleged 08/07/2013 I POL-0098646
problems with the Horizon
system
6 POLO0398766 DES/SEC/HLD/0002, HNG-X 21/02/2014 I POL-BSFF-0225436
Crypto Services High Level
Design
7 FUJO0237007 Description of Fujitsu’s System I 31/12/2012 I POINQ0243112F
of IT
Infrastructure Services
supporting
Post Office Limited’s POLSAP
and
HNG-X applications,
Throughout the
Period 1 April 2012 to 31
December 2012
8 WITN11070102 I PSO/HNG/FRNF/REQ/001, undated WITN11070102
Horizon
Next Generation Conceptual
Design v2.1
IT Organisation slides, April
WITN11070103
8 070 2014
01/01/2014 I WITN11070103
Page 9 of 11
WITN11070100
WITN11070100
10
POLO0398970
Process management Systems
Diagram (Version 14),
20/10/2011
24/10/2011
POL-BSFF-0225640
11
POLO0140236
ARC/NET/ARC/0001, HNG-X
Technical Network
Architecture
04/10/2007
POL-0141472
12
WITN11070104
DES/APP/IFS/0018, XML.
Message Audit between
Counter and BAL/OSR
23/06/2010
WITN11070104
13
POLO0140237
DES/NET/HLD/0016, Network
Security High Level Design
06/09/2007
POL-0141473
14
POLOO125569
Initial Review: Proposal for
investigation into the integrity
of the Post Office Online
accounting system
26/06/2014
POL-0130687
15
FUJO0210312
Horizon Core Audit Process
30/01/2014
POINQ0216034F
16
WITN11070105
ARC/APP/ARC/0001, HNG-X
Architecture - Reference Data
23/08/2011
WITN11070105
17
WITN11070106
ARC/APP/ARC/0003, HNG-X
Counter
Architecture
19/08/2011
WITN11070106
18
POLOO140245
ARC/APP/ARC/0004, HNG-X
Architecture - Branch Access
Layer
16/10/2009
POL-0141481
19
WITN11070107
ARC/APP/ARC/0008, HNG-X -
Branch Database
17/08/2011
WITN11070107
20
WITN11070108
ARC/APP/ARC/0009, HNG-X
Architecture - Counter
Business
Application
26/08/2011
WITN11070108
21
WITN11070109
ARC/SOL/ARC/0001, Horizon
Solution Architecture Outline
30/07/2013
WITN11070109
Page 10 of 11
WITN11070100
WITN11070100
22
WITN11070110
SVM/SDM/PLA/0031, HNG-X
Security Business Continuity
Plan
22/08/2014
WITN11070110
Page 11 of 11