The Great Post Office Scandal E-Book

Nick Wallis

• Herausgeber: Bath Publishing
• Kategorie: Fachliteratur
• Sprache: Englisch

Seitenzahl: 989

Veröffentlichungsjahr: 2021

Beschreibung

The Great Post Office Scandal is the extraordinary story behind the recent ITV drama series Mr Bates vs The Post Office. 

This gripping page-turner recounts how thousands of subpostmasters were accused of theft and false accounting on the back of evidence from Horizon, the flawed computer system designed by Fujitsu, and how a group of them, led by Alan Bates, took their fight to the High Court. Their eventual victory in court vindicated their claims about the defects of the software and exposed the heavy handed attempts by the Post Office to suppress them. 

The book also chronicles how successive senior managers, business leaders, lawyers, civil servants and Government ministers, at best failed to expose the injustice or, even worse, sought to cover it up, resulting in one of the largest miscarriages of justice in UK history. 

The author, Nick Wallis, is a journalist and broadcaster who has been reporting on the scandal for over ten years and who acted as script consultant on Mr Bates vs The Post Office, the ITV drama that brought the affair into the national consciousness.

As the public inquiry reaches its climax, and senior figures such as Paula Vennells come to be questioned, The Great Post Office Scandal reveals the full scale of what happened and will leave you enraged at how so many of our trusted institutions allowed the saga to go on for nearly a quarter of a century, shattering the lives of thousands of innocent people. 

Leseprobe

Originally published October 2021This paperback edition published October 2022

ISBN 978-1-7390992-0-6

Text © Nick WallisTypography © Bath Publishing

All rights reserved. No part of this publication may be reproduced in any material form (including photocopying or storing it in any medium by electronic means and whether or not transiently or incidentally to some other use of this publication) without the written permission of the copyright holders except in accordance with the provisions of the Copyright, Designs and Patents Act 1988 or under the terms of a licence issued by the Copyright Licensing Agency (www.cla.co.uk). Applications for the copyright owner’s written permission to reproduce any part of this publication should be addressed to the publisher.Nick Wallis asserts his rights as set out in ss77 and 78 of the Copyright, Designs and Patents Act 1988 to be identified as the author of this work wherever it is published commercially and whenever any adaptation of this work is published or produced including any sound recordings or films made of or based upon this work.

Bath Publishing Limited27 Charmouth RoadBathBA1 3LJTel: 01225 577810

email: [email protected]

Bath Publishing is a company registered in England: 5209173Registered Office: As above

To Mum, Dad, Nic, Amy, Abi and James.

Thanks for everything.

HORIZON SCANDAL FUND

Many of the Subpostmasters featured in the book – and many more not mentioned – are still fighting for proper compensation or having to seek damages through malicious prosecution claims. Some will not have the resources to raise a claim, find the documents they need or travel to meet their lawyers or parliamentary representatives. Others may be suffering in silence, without peace of mind or the opportunity to afford basic items.

To help those directly affected by the Horizon scandal, Bath Publishing have set up the Horizon Scandal Fund (Registered Charity Number 1199595). Since 2021, the Fund has been distributing money to assist people and their families who have suffered as a result of the Post Office’s punitive methods. This has mainly involved counselling for psychological trauma, hardship and travel grants, but the Fund can also provide cash for expert and legal advice, medical equipment, and media and creative projects. A small but significant percentage of revenue from all hardback, paperback, audio and digital sales of this book are diverted into the Fund. We are, however, mainly reliant on donors. You can find out more about the charity and/or make a contribution to the Fund at www.horizonscandalfund.org.

We are delighted that Lord Arbuthnot, who features prominently in this book, has agreed to become patron of the Horizon Scandal Fund charity.

If you are a former or existing Subpostmaster, Postmaster’s Assistant or member of Post Office staff, or you are related or close to anyone who has suffered as a result of the Post Office Horizon scandal and some kind of financial assistance is needed, we warmly encourage you to investigate applying for a grant. Email [email protected] explaining your situation and what you would like a grant for. All applications will be considered in the strictest confidence. Bath Publishing would like to put on the record their thanks to everyone who contributed towards the Horizon Scandal Fund and/or helped make it a reality, including Ian Fagelson, Flora Page, Gauruv Malhan and the current trustees.

Thank you for buying this book. It will make a difference.

ABOUT THE AUTHOR

Nick Wallis is an award-winning journalist and broadcaster. He has worked with the BBC (Panorama, the One Show, Inside Out, Newsbeat), ITV News, Channel 5 and Private Eye. He co-presents the ‘Investigating the Post Office Scandal’ podcast with the journalist Rebecca Thomson. Nick is married and lives in Surrey with his wife and three children.

READER NOTE

For most of the last century the Post Office was known corporately as the General Post Office. The initials GPO were ubiquitous and well-understood. The GPO governed the activities of Royal Mail and Britain’s telephony network (which later became British Telecom).

When the GPO was scrapped the Post Office went through various reorganisations. At one stage it was known as Post Office Counters Limited – or POCL (pronounced ‘pockell’). Soon afterwards it became Post Office Limited, often written up in documents as POL (pronounced ‘poll’). Many Subpostmasters therefore call the Post Office ‘POL,’ though Post Office employees tend to just call it ‘the business.’

If it’s not being called POL or ‘the business,’ there is a habit (mainly among its representatives) of dropping the definite article, so ‘the’ Post Office becomes ‘Post Office.’

The various official and unofficial names the Post Office has gone by are reflected in the hundreds of documents and interviews which have informed this book.

To save confusion and to be as consistent as possible, I have added, where appropriate, the definite article and changed many (but not all) of the POLs and POCLs to ‘the Post Office.’ I hope this aids the reader.

CONTENTS

Horizon Scandal Fund

About The Author

Reader Note

Foreword By Seema Misra

Introduction

PART 1

Building An Empire

Tracy Felstead

The Magic Bullet

Leaping Antelopes

The First Government Agency

Rolling Out Horizon

What Is A Subpostmaster?

Tracy Is Sent To Prison

The NFSP

Noel Thomas

Not To Worry

The Subpostmasters’ Bind

Going In Hard

Enter Alan

‘I Hate Them’

As Long As It Takes

Kamran And Siema

Onching And Remming

Jo Hamilton

Jo’s Sentencing

Lee Castleton

Full Authority Digital Engine Control

Computer Weekly

Taro Naw

Alan Marshals The Troops

A Campaign Coming On

The Misras

Instant Losses

Fear And Loathing In West Byfleet

Seema Loses It

Criminal Charges

Seema Blames Horizon

Dangerous Presumptions

Hard Going

Wendy Buffrey

False Accounting And The Law

Ministerial Complacency

The Ismay Report

The Trial

Seema Is Sent To Prison

Mark Baker

PART 2

A Chance Tweet

First BBC Commission

The Whistleblower

Trying To Get Traction

Private Eye

Cultural Blindness

Second Sight Get Hired

The Flat Denial

The Interim Report

The Clarke Advice

The Detica Report

The Mediation Scheme

Martin Griffiths

Mop And Bucket

War Of Attrition

Complete Breakdown

The Briefing Reports

Inside Out South The Sequel

Meeting Alan Bates

Pam Stubbs

Total Sham

MPs Break Cover

The Westminster Hall Debate

Gina’s Ultimatum

Pete Murray

Regional Variations

The George Thomson Show

Paula Vennells Speaks

Working Group Dissolves

Second Sight’s Final Report

Twisting The Knife

A Panorama Is Born

Richard Roll

Trouble At The Post Office

Just Outcomes

Julian Wilson

Group Litigation Granted

PART 3

Large Commercial Deals

Crowdfunding

Extremely Aggressive Litigation

First Trial Begins

On The Stand

Roll Rolls

Judgment No

Recusal

Nicki Arch

Time To Change

Expert Evidence

Court Of Appeal Ruling

High Stakes Poker

Result!

Horizon Trial Judgment

Not Remotely Robust

The Fallout

Defending The Settlement

Continuing Corporate Denial

Boris Gets Involved

CCRC Referral

New Legal Suitors

The Apportioning

A Scandal You Can See From Space

Vennells Rides Again

Ahem, Fujitsu?

The Settlement Agreement

Back To Court

International Wrongful Conviction Day

Out On A Limb

Contempt

The Ombudsman Complaint

Sideshow Brian

First Convictions Quashed

Limb 2 Is Go

More Referrals

Shame, Breakdowns And Recurring Mental Anguish

Presumptions About Machines And AI

Document Shredding

True Prosecution Number

Read Sides With Bates

Judgment Day

Redress And Accountability

The Billion Pound Disaster

No Arrests

Who’s Who

Timeline

Glossary

Sources

Acknowledgments

Index

FOREWORD BY SEEMA MISRA

I have always been a spiritual person. When I was convicted of theft in 2010, my faith and my belief in justice was shattered. I was pregnant at the time. My despair caused me to think of suicide. I wondered if God wanted me to have something in prison to worry about. Thoughts of my unborn child kept a bit of hope, and me, alive.

The Hindu religion has a concept of Ramarajya. That is the realm of what Ghandi called the moral authority of the people. It is a realm in which peace, honesty, prosperity and security prevail. I had come to England like many, believing Britain was a place of Ramarajya which offered the opportunity to work, to thrive and to prosper.

In 2005, Davinder and I invested our own money in a Post Office branch and retail business. We were proud to have become part of such a famous British institution. When I was sentenced to prison on my eldest son’s tenth birthday, all our dreams and hopes were destroyed.

The Post Office did not quite get away with it. They almost did. It was reassuring and comforting to know that others believed something had gone wrong. They have kept the story alive when the Post Office very much wanted the story to die.

Throughout our journey, we have made many wonderful friends who have been like lights in the darkness. Some have helped to restore a bit of faith in English justice. They never believed, even for one moment, that I was a thief.

Reading this book made me cry. Nick brings to life what the Post Office did to me and to my family in a way that makes reading it feel like re-living it. It is a story which broke my heart.

You may think it could never happen to you – or to someone you love. This book shows that you would be wrong. It happened to me.

Seema Misra, former West Byfleet Subpostmaster, July 2021

INTRODUCTION

Seema Misra was sacked as Subpostmaster at the West Byfleet Post Office in Surrey and then charged with theft. A jury at Guildford Crown Court found her guilty of stealing £74,000 from her own Post Office. As Seema says in her foreword to this book, she was sentenced to jail for a crime she didn’t commit, on her eldest son’s tenth birthday.

When I met Davinder Misra, Seema’s husband, his wife was still in prison. Davinder was adamant the case against her was wholly false. Seema, he told me, had been convicted on the basis of evidence from a faulty computer system called Horizon. It took more than ten years for Davinder to be proved right.

The Misras were not alone. In the first decade of this century, accounting evidence generated by the IT system at the heart of the Post Office branch network was being used to bring private prosecutions against counter staff and branch Subpostmasters on an industrial scale. Between 2000 and 2015, more than 700 people were given criminal convictions.

Yet the ‘largest non-military IT system in Europe,’ as Horizon was proudly described, was riddled with bugs and coding errors. The Post Office – a government-owned company – was using the shaky electronic data produced by Horizon to wrongfully charge its own Subpostmasters with crimes which simply did not exist.

Even if Horizon worked as it should, the sheer number of Post Office-led prosecutions during this fifteen year period (more than one a week) should have raised eyebrows. But no one in the justice system or government seemed to be aware of what was going on. Worse still, when the Post Office realised it might have been responsible for unsafe prosecutions, it orchestrated a cover-up, hiding crucial information from MPs and campaigners.

By 2020, enough details had come to light for the MP Julian Lewis to describe the affair in parliament as ‘one of the worst disasters in public life since the infected blood scandal.’

Despite this, no one has been held responsible. Not a single person has been officially censured or blamed for the misery heaped on so many lives.

Over the last decade or so I’ve spoken to countless Subpostmasters, Post Office workers, politicians, union officials, lawyers, IT experts, accountants and fraud investigators. I’ve spent hundreds of hours digging through transcripts, parliamentary inquiry evidence, audit reports and court documents. I’ve also met dozens of innocent people who were criminally prosecuted by the Post Office, some of whom – like Seema – were sent to prison. They were put at the mercy of an organisation stuffed with managerial incompetents, who exercised their responsibilities with a toxic mixture of prejudice and indifference.

The Great Post Office Scandal is an attempt to unravel exactly what went wrong, and determine who is to blame. It also documents the heroics of those who fought long and hard against a powerful and well-resourced opponent to get the truth into the public domain.

It’s quite a story.

‘When we came to office, there was probably no greater shambles than the Horizon project.’

Tony Blair, Prime Minister’s Questions, 12 April 2000.

PART 1

BUILDING AN EMPIRE

Clint parked up outside the lo-rise glass and concrete office block situated on the edge of Hanworth Park in Hounslow. He announced himself at reception and collected an ID pass. As he waited to be accompanied into the building, he reflected on what he’d been told about the project he would soon be getting a direct handle on.

He knew it was in trouble – that’s why he was there. How much trouble, he could not begin to imagine.

The late nineties were a good time to be in IT. The globally-connected future, foretold by wide-eyed seers and digital visionaries, was no longer the stuff of fantasy. The dot com boom was, well, booming, and the information super-highway, or World Wide Web, was becoming part of everyday life. Smartphones, Google and Facebook were still a while off, but dial-up modems, Netscape and email had worked their way into Britain’s businesses and homes.

Empires need construction workers, and jobs were easy to come by. The IT world was full of brilliant minds, but there were plenty of chancers talking themselves into jobs they weren’t qualified to do. Coders, testers, and systems and network engineers were all in demand, alongside the usual project managers, sales and marketing people. There were also plenty of middle-ranking execs with little understanding of what the young turks in their charge were up to, but had learned just about enough to bluff their way through.

Clint was no chancer. Clint was the real deal. He’d been working in IT development his entire career. He knew how to code a system and he knew how to manage a team.

After spending most of the nineties in Brussels developing complex financial systems for the European Parliament and European Commission, Clint had been called by a former colleague who was working on a project to automate the Post Office network. The project’s name was Horizon.

TRACY FELSTEAD

In November 1999, 17-year-old Tracy Felstead nervously stepped through the door of her local Crown Post Office1 in Camberwell Green, South London. She was young, keen, just out of school and had been invited to an interview for the post of counter assistant. Luckily, Tracy had been recommended to the branch manager by a family friend, and the interview went well. She was offered and accepted the job.

Tracy was sent on a two day training course to learn her way round Horizon, the new computerised till system which hadn’t long been installed in the branch. Soon, Tracy was using it to serve customers.

There were 12 counter positions at Camberwell Green. Tracy was the youngest assistant, so she was taken under the wing of the experienced staff.

‘To be fair, everybody seemed lovely,’ she remembers. ‘Everybody seemed pretty much on the ball. If you needed any help, you could just ask.’

Each member of staff had their own login, allowing them to switch between counters, but the regime was lax. No one minded if you used somebody else’s login. If someone needed a break during a busy period, another member of staff would ‘jump on’ their Horizon terminal without going through the process of logging off and logging back in again. This ensured minimum disruption for customers, but it had obvious security implications.

Every day, after each shift, Tracy would cash up, checking the money in her till tray against the figures on the Horizon screen. She would then print off and sign a receipt displaying the till tray balance. One day, she found herself with a small deficit. Tracy said her manager was not in the least bit concerned.

‘I think because I was the baby, all of them mothered me. She said, “Oh, it’s fine, it will rectify itself.” I suppose I was a bit naïve, being 17, but I trusted her.’

Tracy was a happy girl and a popular employee. She flew through the hectic pre-Christmas period without any serious mishaps. Her understanding of her responsibilities – handling cash, handling Horizon and handling customers – was coming on in leaps and bounds. Outside work, Tracy was getting serious with her partner Jon, who worked as a reprographics manager in the City. They bought a house in Penge and were planning to get married. Life was all set.

Half way through 2000 Tracy suffered another spate of discrepancies. ‘I did a cash up at the end of the week and I had a £1,300 loss,’ she says. Again, her boss seemed relaxed. Tracy said the manager took over at the terminal, ‘did something’ and the loss went up to £1,800. ‘And then she said, “Oh, leave it, I’ll sort it out.” ’

Tracy did leave it, but she was concerned.

In February 2001 Tracy locked her till tray in the office safe and went on a family holiday. It was her parents’ 15th wedding anniversary, so they chose somewhere special – the Dominican Republic. While Tracy was away her cash tray could be used by someone else, so long as all the stock and cash was checked before and after each session, and the counter assistant entered the figures under their own login into Horizon.

The day before Tracy got back from holiday, a loss of £11,503.28 was found on her stock unit.2 On her return to work, Tracy was questioned about the loss. Her manager’s demeanour was not motherly any more.

‘I’m looking at this woman like, “What on earth is going on?,” and she said, “Oh, another member of staff used the till while you were away and found a discrepancy.” ’

Tracy was asked if she knew how the discrepancy had come about. She remembers shaking her head and firmly telling her manager she had ‘no idea.’

The next day, Tracy cashed up and signed off her stock unit with the £11,503.28 discrepancy still outstanding.

There appeared to be a serious amount of money missing from Tracy’s till position, but as nothing more was said, she put it to the back of her mind. Tracy continued serving customers, but the atmosphere had changed. Two weeks later she walked into work and was given a shock.

‘I’ve got two strapping, great big guys sitting there waiting for me, and they want to interview me. And I said, “Okay, that’s absolutely fine.” They asked whether I wanted legal representation and I told them, “No, I haven’t done anything wrong, so I don’t need anybody. Happy to be interviewed. Not a problem.” ’

The two strapping guys were from the Post Office’s internal security unit. Tracy’s interview turned into an interrogation. ‘They were constantly asking, “What did you spend the money on?” And I remember looking at them and saying, “Seriously, I haven’t taken any money. You can have access to anything you want. Bank accounts … whatever. I haven’t taken any money.” ’

Tracy was suspended. ‘They said they needed to do some more investigation. I was distraught, absolutely distraught. But part of me actually thought – well, they’ll get me sorted because I haven’t stolen any money. So they’ll fix this.’

Three weeks later, at 8am, the same Post Office investigators knocked on the door of Jon’s parents’ home in Peckham, where Tracy was staying. The investigators were accompanied by two police officers.

‘The police told me they were there to keep the peace. What they thought I was going to do, I’m not quite sure. I’m only 5'3'' and small, you know, a size 10. And I’m not gonna … these men are massive, intimidating, huge men. And they said, “Could you escort us down to the police station for interviewing?” And I said, “Yeah, fine.” ’

On this occasion Tracy did ask for a solicitor.

_______________________________

1   Crown Post Offices – usually shortened to Crown Offices – are directly owned and managed by the Post Office.

2   Stock units are usually related to, and the responsibility of, individual Horizon users. A counter assistant or Subpostmaster will log in to a Horizon terminal and assign themselves, or be assigned to, a stock unit (usually lettered AA, AB etc). The stock unit will relate to a physical till tray containing cash and stamps. Horizon registers electronic transactions and transfers in, out and through stock units over the course of the day. So, if I take a book of stamps out of my till tray and you pay for it by card, my till tray and my stock unit is down one book of stamps, and the amount of electronic money in my stock unit is up by the cost of a book of stamps (even though there is nothing physical in my till tray). If you give me a £50 note and I change it for 5 x £10 notes from my till tray I would also have to manually register that physical transfer electronically on Horizon, so that the physical cash denominations in my stock unit match those in my till tray.

THE MAGIC BULLET

The full automation of Post Office systems was set in motion in 1992, initially as part of a solution to rampant fraud.

In those days benefits were paid at the Post Office by exchanging vouchers from social security order books for cash. Between 1991 and 1992, £230m worth of order books were lost, of which £85m had been found to be fraudulently cashed. A further £16m was lost through fraudulent encashment of girocheques. The paper system was vulnerable, and needed upgrading.

After a few experiments with barcoded order books, the Department of Social Security decided it wanted to use a magnetic-strip swipe-card as a vehicle for dispensing benefits payments. The cards would be given to claimants, who would have their use of the card electronically registered at a central database each time they were swiped at a Post Office. This ensured each card could only be used once a week, and deactivated if lost. Swipe-cards were an established technology. The problem was, the Post Office had nowhere to swipe them.

For decades the Post Office had been the place where British citizens did their admin with the state. Each day millions of people would visit their local branch to buy stamps, tax discs, traveller’s cheques, premium bonds or TV licences. They would cash benefits and pensions, or make utility bill payments, National Savings Bank account withdrawals or deposits, or apply for passports or driving, fishing or game licences or any number of other permits and services.1

Important documents were stamped, signed, shown or submitted, and cash would be paid or received accordingly. These transactions, made in their millions every day, gave the Post Office a multi-billion pound annual turnover. It was an established system and it worked, but it was costly. Although attempts had been made to automate various parts of the network, by the mid-nineties most village and suburban branches were still handing over paper forms, stamping dockets, transferring physical cash and generally operating more or less along the same lines they had in Queen Victoria’s day. Especially when it came to filing branch accounts.

At the end of each trading week, every Subpostmaster would fill out a giant paper spreadsheet, recording their transactions in the relevant, designated column. The sheet would be signed, folded and posted back to the Post Office’s financial HQ in Chesterfield.

By the 1990s this antiquated system was in need of an overhaul. With the race for digitisation happening everywhere, the Post Office, government and many Subpostmasters felt that automating the Post Office network was a nettle which needed to be grasped. The DSS swipe-card idea provided the impetus for starting to wrestle with the eye-watering cost and logistics of doing so. The eventual solution was a £1bn PFI contract. This was tendered in 1994 by both the DSS-owned Benefits Agency and the Post Office. It would deliver the swipe-card scheme and automate the front and back end of Britain’s twenty thousand Post Offices – a transformative project.

The candidates were whittled down to a shortlist of three. In May 1996, the winner was announced. Pathway, a consortium owned almost entirely by a company called International Computers Ltd – better known as ICL – got the gig. ICL once saw itself as Britain’s answer to the American computing giant IBM, but its glory days were long gone. In 1990, the Japanese tech corp Fujitsu had taken an 80% stake in ICL with a view to outright ownership. Whilst Pathway was being tendered, Fujitsu was in the process of swallowing ICL whole.

Pathway managed to come bottom in eight of the 11 scoring criteria drawn up to quantify the strengths of each bid, but it was the cheapest in terms of its cost to the government. Fujitsu’s business model for Pathway saw it shouldering almost all the project’s commercial risk by paying for its development and rollout. In return Pathway would get a transaction fee every time a shiny new Benefits Agency card was swiped through a shiny new Post Office card-swiper, for a guaranteed period of eight years. If all went according to plan, Project Pathway would deliver automation of the Post Office and vast sums of cash to Fujitsu, without any risk to the public purse. As an incentive to get things operational as soon as possible, the eight year guaranteed transaction fee period would start the moment the PFI deal was signed.

Almost as soon as the ink on the contract was dry, Pathway ran into difficulties. Serious, big-picture difficulties. It seemed everyone had badly underestimated the complexity of automating 20,000 geographically isolated and disparate Post Offices carrying out multiple (and sometimes region-specific2) transactions which were many times more complicated than the average bank.

The logistics of building, testing and installing a bespoke IT system of this size was uncharted territory for the government, and Fujitsu. 20,000 Post Offices would need 40,000 terminals. 67,000 people with variable technical skills would have to be trained to successfully keep handing out £56 billion in benefits alone to their 28 million annual customers.

The hardware would have to be robust. The software would have to process millions of transactions a year. Training and support would have to be first rate. Fujitsu had bid for IT’s Operation Moonshot by undercutting the competition. Having won the contract, they were realising how complex and expensive moonshots can be.

Conceptually, Horizon was relatively straightforward. The front-end terminals would be custom-specced PCs running Microsoft’s Windows NT operating system. These would sit in a box under each Post Office counter window. Each PC would be connected to a custom keyboard, a barcode scanner, a 3.5 inch receipts printer and a touchscreen, which would sit on top of the counter. Running bespoke Horizon software, each counter PC would write both manually- and barcode-inputted transactions into the branch accounts. Every night all the information collected from the branch would be uploaded via ISDN or (in some cases) satellite to a centrally-located Post Office mainframe.

That was the theory. Writing the code to make this system work reliably appeared to be completely beyond Fujitsu. Despite burning through £10m a month, by the middle of 1997, Fujitsu was not able to deliver an (already renegotiated) contractual obligation to demonstrate Horizon’s ‘satisfactory, sustained’ operation. Even in a controlled environment, they simply could not get it to work.

Fujitsu was not helped by its clients, two state-owned entities with different and sometimes competing priorities. Goalposts for the project were constantly being moved. Fujitsu would later tell parliament that over three years, Pathway’s 366 original contractual requirements had been subject to 323 formal change requests by the Post Office and the Benefits Agency. This was exacerbated, it said, by numerous informal changes and ‘clarifications’ which necessitated ‘significant system re-design.’

Frustrated with the delays, in May 1998, the DSS served Fujitsu with a formal notice of breach of contract. Fujitsu, fed up with the way it was being treated, refused to accept the notice. It then upped the ante by threatening to stop work on the Horizon project altogether unless it received a guaranteed hike in the fee it was going to get from each swipe of the DSS benefits card.

The stand-off turned critical when the Benefits Agency responded by announcing it no longer wished to use swipe-cards to dispense benefits payments. Instead, it was going to encourage claimants to have their benefits delivered direct to their bank accounts. In one swoop, Fujitsu’s potential income from the project had been reduced to zero. On top of that, the Post Office was looking at losing a third of its customer base overnight.

In January 1998, serious consideration was given to abandoning Horizon altogether, but the project limped on. Despite a shifting brief and its lack of operability, there was a feeling in Whitehall that Horizon had become too expensive to kill. Someone was going to have to find a way through, because the fallout caused by cancelling the project would be politically disastrous.

_______________________________

1   A recent request to a Postmasters’ online forum about the extent of permits and services available through a Post Office in the early nineties returned a wealth of information, for which I am grateful. The following were available: TV savings stamps, general savings stamps, milk tokens, Red Star parcels, Canadian money order encashment, Littlewoods pools, flowers and chocolates by post, WH Smith, Kingfisher and Boots gift vouchers, electoral register applications, viewing of public telephone directories, viewing of the London Gazette (to see premium bond winners), National Railcards, National Savings Certificates, film developing by post, Transcash payments abroad, prescription charge exemption forms and no doubt much, much more…!

2   For example: local authority rent and council tax services, local authority home care services, parking permits, market trader permits.

LEAPING ANTELOPES

When Clint joined Fujitsu in April 1998, he was vaguely aware of the political wrangling going on around the Horizon project, but it was of no real concern to him. His job was to find out what was stopping Horizon from working and fix it. More than twenty years later, after a couple of lengthy telephone conversations, I travelled to meet Clint for lunch at The Grand Hotel in York. Clint had got in touch with me using a messaging app, but was something of a terse communicator when it came to email. I was keen to ensure that before I made the trip he understood the terms on which we were meeting – to record an interview about his experiences at Fujitsu. I also needed some documentation from him. He seemed cagey, but genuine. I was prepared to take a punt. I got on a commuter train to London, crossed the city to Kings Cross and then travelled to York in a near-empty train carriage, a tiny bit unsure as to whether Clint was going to turn up. I needn’t have worried. Clint arrived bang on time and produced enough paperwork to prove he was indeed who he said he was.1 I found him to be a blunt-speaking individual who is keen to keep his identity private. Over lunch he opened up about his experience of working on Horizon.

Clint, as you may have already guessed, is not his real name.

‘Everybody in the building by the time I got there knew it was a bag of shit,’ he told me. ‘Everybody. Because it had gone through the test labs God knows how many times, and the testers were raising bugs by the thousand, including category As.’

Software code is written by human beings who make mistakes. Computer bugs are errors mistakenly written by developers into the lines of software code which tell electronic devices what to do. One misplaced character can make a computer do the wrong thing, or set off a chain of routines and sub-routines which could lead to something very serious happening. This is why software code needs to be tested in a variety of different environments, almost to destruction, before it can be let loose in the wild. If it is not properly written or properly tested your computer will crash, and sometimes, in extreme circumstances, so will the planes reliant on it.

During testing and operation, the problems bugs create are traditionally classified according to severity. Category C is okay, Category B is serious and Category A means the system might be unusable. Clint told me Horizon, when he first encountered it, was infested.

‘There were thousands, thousands of bugs in the system. You could not see for leaping antelopes, and a lot of them were As and Bs.’

Clint’s initial role was undefined.

‘My manager knew enough about computers to realise he was in the shit, so when he saw I came from a technical background and how much experience I had, he just said, “Go in there and find out what the developers are doing.” ’

Clint said what he saw was not pretty. ‘They had a team of eight developers who were some of the worst people I’ve ever seen. There were a couple of good lads in there who knew how to code properly and were interested in learning and having a properly structured development project, but the rest … it was just … it was like kindergarten. They didn’t know, they weren’t interested in knowing and it was just about filling their pockets with money and going home at the end of the day.’

It seemed to Clint that some managers didn’t know the difference between a good developer and a bad developer, because they weren’t developers themselves. This included the former Post Office man who’d been put in charge of developing Horizon’s Electronic Point of Sale (EPoS) system – the front-end terminal which would sit inside each Post Office branch, recording the transactions. Clint was aghast.

‘He didn’t have any experience, to my knowledge, in running a development team, writing code, how to make sure the guys knew what they were doing, recruiting the right people, putting them in the right place, system testing, volume testing, any of this stuff that you really need to be doing in a development team.’

He was, according to Clint, in the wrong job.

‘He was a Post Office guy. He should have been there as a business advisor, and they should have had a proper development manager in charge of running that development team. There were no specs getting written, there were no development controls going on, there was no design written down, there was nothing.’

Clint told me that after spending a few weeks trying to properly understand the project, he had a decent handle on most of the problems. He reckoned Horizon’s third-party touchscreen interface software worked well, but the code behind the touchscreen buttons (written in a mixture of three programming languages: Visual Basic, C and C++), was not good. The biggest problem, however, was the information being written to something called a message store.

The Riposte message store was a powerful piece of third-party software within the Horizon system, containing some of its fundamental operating instructions. Riposte also functioned to ensure the important financial data being inputted was safely transferred and duplicated to off-site mainframe storage computers.

‘The first thing that you should always do with a system like that,’ said Clint, ‘is design and agree a data dictionary and a message library repository, basically to say, “These are the messages that are allowed to be written to the message store and they all provide the following function… ” ’

Clint continued, ‘It’s almost like an API – a programming interface2 – so that you have a list of allowed messages, agreed messages, which can all be written to the correct format with the correct content. You should also have a layer of software that lies on top of the message store which checks any application above it that’s trying to write a message conforms to the agreed data dictionary. Otherwise, you can just write freestyle to the message store, which is what they were doing. There was no application interface in there, no agreed data catalogue or anything.’

According to Clint, Horizon’s developers had spent the last couple of years ‘firing any old shit’ into the message store as they changed and developed the product. Clint explained that this was a recipe for disaster. If a message was given a new data field, but this wasn’t retrospectively applied, the counter software could retrieve an old message with what it would now perceive to be a missing data field. The reaction of the application would be unpredictable. It could crash. It could send the wrong information to the wrong place, unnoticed. It could cause the wrong values to be applied to a transaction. It could cause values to halve, or double, or multiply.

Knowing exactly what code is in your system is essential. ‘If the application’s not checking that the contents are correct, which they weren’t because they weren’t writing them properly, then the message store is completely corrupted with garbage,’ Clint told me. This meant the software had no integrity. It was unreliable.

I wondered how this could have happened. It was a question Clint was asking himself at the time. He said that from talking to people around the project he gathered the Horizon software at the EPoS end was originally written by a small nucleus of people as a prototype, to show what a Riposte-based counter system might look like. It was this which won them the contract.

‘And what you should do when you get the contract,’ Clint said, ‘is throw the prototype away and start from the beginning, because all that prototype is, is proof of concept – the architect’s cardboard model. You don’t start putting roof tiles on the cardboard building – which is what they were doing.’

Having reviewed the whole EPoS side of the Horizon project, and tested his theories with some developers he trusted, Clint says he went back to his bosses with a few home truths.

‘I broke it down and said, “You can keep these bits at a push if you have to. But that bit in the middle, these bits of the engine, the gearbox, you need to throw them away and rebuild them. Starting with the cash account. You’ve got to throw the cash account away and you’ve got to rewrite it.” ’

The cash account wasn’t an account in the traditional sense of the word. It was a program which crawled through every transaction on each Horizon terminal in each branch at the end of the day’s trading. It then came up with a figure which should correspond exactly with the amount of physical cash on the premises. That figure was then automatically uploaded to the Post Office’s central servers overnight. It is a relatively simple task to describe, but not necessarily to execute. Given its central importance to the financial integrity of the Horizon system, it had to be bullet-proof. It wasn’t. The code was not good enough.

Clint told his bosses at Fujitsu the cash account had to be completely scrapped and rebuilt from scratch. They refused his request, saying it would take too long and cost too much. He was told to repair it. Clint told me he convened and ran a team of hand-picked developers who did what they could, before internal politics saw him shifted to working on the back-end of the Horizon project.

I listened to Clint with rising levels of alarm. When he had finished, I asked him to sum Horizon up. Without hesitation, he replied:

‘It was a prototype that had been bloated and hacked together afterwards for several years, and then pushed screaming and kicking out of the door. It should never have seen the light of day. Never.’

Over the first six months of 1999, whilst Clint was still there, Horizon’s PFI contract was reorganised once more. The Benefits Agency, having almost fatally holed the project with its decision to take swipe-cards off the table, walked away completely. The government decided Horizon would become the Post Office’s baby. Fujitsu (which had written off £180m on the project and hadn’t yet worked out how it was going to get it back) would continue to develop Horizon on a fixed payment basis. A subsequent National Audit Office report estimated the botched procurement had wasted half a billion pounds of government money. So much for Fujitsu shouldering nearly all of the risk.

Once the decision had been made by government, the Post Office’s IT and business impact teams were understandably concerned about taking responsibility for Horizon. They wanted the opportunity to test it properly before it went anywhere near the Post Office estate.3

On 4 March 1999, the Post Office’s Horizon Programme Board examined the risks associated with the project. It scored them up to 25, multiplying their ‘impact value’ by their ‘probability value’, and graded them green, amber and red. Anything over 15 was a red. The first five risks listed were red. All of them were scored at the maximum 25. The authors wrote:

‘Due to lack of adequate visibility of the ICL Pathway [read: Horizon] design, and the lack of support from the contract to leverage this visibility, we have been unable to gain a high level of assurance in the adequacy or suitability of the service.’

Under ‘Action’ it rather desperately states:

‘All other approaches having failed – final entreaty has been made for cooperation from Pathway [read: Fujitsu] to make available appropriate level of documentation.’

Fujitsu saw this concern from their clients as yet more interference, which could lead to yet more changes and yet more cost. Also, they still couldn’t get Horizon to work. Fujitsu put up a shield of commercial confidentiality, citing the terms of the PFI project, and shut everyone out.

Behind that shield, Fujitsu’s developers, testers and engineers feverishly bashed their new IT system into something that looked like it might work.

Although Horizon was clearly not ready to go live, in July 1999 the government announced the Post Office would start its switch to full automation in October the same year. A joint Working Group was convened. Base units, touchscreens and keyboards were bought and specced up. Teams were hired. A live trial began.

Margaret Davison’s Post Office in West Boldon was one of the branches selected for the trial. In a short, but vivid memoir, written long after her retirement in 2006, Margaret describes what it was like:

‘The installation took place over some days when a constant stream of electricians, Post Office staff and computer geeks climbed or sat all around my office whilst I tried to keep my counter and business running. Looking back I wonder how I retained my sanity or my strength… There were so many faults in the system which you were expected to cope with, learning on your feet with a queue of customers in front of you … not to mention helpline staff so inexperienced and under pressure it often took over an hour to get a call to them answered. How I avoided a nervous breakdown at the age of 60 in a one-position very busy little village Post Office, I do not know. From day one the system was flawed.’4

In August 1999, two months before the project would go live, a Post Office ‘business impact analysis’ of Horizon listed six high severity problems, including, ‘TIP [Transaction Information Processing] derived cash account not equal to electronic cash account received by TIP.’

In other words, the cash account Clint was so exercised about still didn’t work.

Under ‘Business Impact’, the report’s authors wrote that the Post Office ‘has not seen a detailed description of the faults creating the missing data, neither has it seen any description of how and when these faults will be fixed.’

The effect was clear: ‘These gaps in data will ultimately be reflected in balance sheet accounts.’

The seriousness of the situation was underscored by the startling revelation that Fujitsu had admitted to the report’s authors that they ‘do not yet understand the root cause of the problem.’

Other high severity problems included back-end data losses causing accounting discrepancies, transactions being lost before they could even be written to the cash account, system freezes and ‘lock ups,’ printer failures, and general losses of accounting integrity.

It is perhaps no surprise that in September 1999 the Post Office board refused to sign off the project, noting ‘serious doubts’ over the reliability of the software.

Yet, a month later, in October 1999, the minutes note, ‘Following remedial work around two issues which had previously prevented acceptance … the system had now been accepted with implementation proceeding at a rate of 200 offices per week.’

How Horizon’s serious system problems could be fixed to the satisfaction of the Post Office board so quickly (and conveniently) is a mystery. The document, presentation or written assurance which gave them this comfort has not yet been made public. Nevertheless, the board had signed it off, rollout was underway, and Horizon would soon be wreaking its havoc across the Post Office network.

_______________________________

1   Which I then had independently corroborated, checking out his job roles and the technical accuracy of his allegations with other computer experts.

2   Literally, an Application Programming Interface, a set of definitions and protocols for building and integrating application software. APIs allow two applications to talk to each other.

3   A word regularly used to describe either the Post Office systems networks and/or its physical estate (including Crown and sub-Post Offices and its administrative buildings).

4   As published on former Subpostmaster Tim McCormack’s blog, Problems with POL.

THE FIRST GOVERNMENT AGENCY

To understand how the Horizon scandal could happen, it’s worth trying to understand what the Post Office actually is.

If you have spent any time in the UK, you are likely to have some sort of concept of the Post Office. Depending on where you live, and possibly how old you are, that concept will vary. The image of a middle-aged husband and wife team running a village branch as their last job before retirement still just about holds true; but the network has changed significantly over the last 20 years. There are now hundreds of busy suburban outlets in the hands of limited companies, or entrepreneurial Subpostmasters with multiple branches seeking profit in economies of scale. In recent years the Post Office has also retreated from many of its imposing city-centre Crown Office buildings, and chosen instead to inhabit the basements and back ends of newsagents and stationery chains.

Unfortunately, a down-at-heel shabbiness characterises many Post Offices. In 2018, the journalist Patrick Collinson wrote an article for The Guardian entitled: ‘How did we allow our Post Offices to become so grotty?’ You only have to drive by a few urban branches in large cities to see what he means.

Yet the Post Office still holds (and undoubtedly trades off) a unique position in the British psyche. In the alleyway behind my house there is a wooden telegraph pole. Carved into the pole at just about head height are the initials ‘GPO.’ This stands for General Post Office – a brand which pre-dates the industrial revolution, the British Empire, and, indeed, Britain itself.1

There has been a Master of the Post since Henry VIII’s time, and in 1660, Charles II approved an ‘Act for Erecting and Establishing a Post Office,’ which created the role of Postmaster General, and ‘one Generall Post Office … soe that speedy and safe dispatches may be had.’

The General Post Office formally survived as a directly-controlled government department until 1969. But the Post Office isn’t just old, it is everywhere.

During the eighteen hundreds, the Post Office’s activities grew exponentially on the back of huge railway expansion, democratising long-distance communication and accelerating Britain’s capacity to conduct business between its great cities. Nineteenth and twentieth century developments in telecommunications – telegrams, and then telephones – were monopolised by the GPO, which required thousands of operators and engineers to keep these new technologies going. By 1936, the Post Office (along with its glamorous, liveried sub-brand, the Royal Mail) was the largest employer in the country, with a quarter of a million staff.

The Post Office as a concept is therefore more than just a retail presence on the High Street. It can legitimately be said to be the oldest government agency, and at least until recently, the main physical interface between the British state and its citizens. Even now, Post Office paraphernalia retains certain romantic associations which are bound up with concepts of national identity. Think about images of Penny Blacks, post boxes, mail trains, switchboard operators, postcards and telegrams. The apparatus of the networked state has been lionised in poetry, literature, film and television. More often than not, they were presented as symbols of British greatness, representing notions of trust, efficiency, stability and security.

But the Post Office’s eternal presence has been preserved by something with an altogether more sinister edge. As well as being part of the fabric of the nation, the efficient and secure operation of the Post Office is protected by its proximity to power. Interrupting or defrauding Post Office business comes with severe penalties.

For most of the last three centuries, the Post Office has maintained a specialised investigative unit. This unit has direct access to the criminal justice system through the Post Office’s in-house prosecutors. In fact, the Post Office Investigation Branch (known by the start of the twentieth century as ‘IB’) is the oldest recognised criminal investigation force in the world. It pre-dates the police. In the eighteenth and nineteenth centuries, postal workers caught stealing from the mail could expect to be hanged. The Post Office Museum website proudly states that the Investigation Branch ‘has worked to detect offences against the post and prosecute the perpetrators.’ These could be highwaymen, robbers, clerks or delivery boys. Or even spies.

During the twentieth century IB personnel worked with the security services to identify mail sent by internal subversives. When suspicious letters reached Royal Mail sorting offices, they would be picked up by IB security staff and taken to the first floor of the Post Office’s Headquarters in St Martin’s-le-Grand, near St Paul’s Cathedral. Here, technicians would carefully open the letters to photograph the contents. The photographs were passed to government spooks. The letters were carefully re-sealed and dropped back into the system with their intended recipients none the wiser. In addition, whilst the GPO had responsibility for the nation’s phone lines, the Post Office Investigation Branch supplied the security services with phone-taps.

This creepy element to the Post Office’s activities wound down as perceived post-war and cold-war threats to the internal stability of the nation dissipated. In 1969, the office of Postmaster General was abolished and the GPO ceased to exist as a brand, though the Post Office and Royal Mail remained state-owned, with a monopoly on the business of shifting letters from one part of the country to another.

In the latter half of the twentieth century IB went through various reorganisations (first becoming an Investigations Division, then a Department). By the eighties it had largely ceded its external investigative activities to the police and was focusing its attention and resources on the internal activities of Royal Mail, Post Office and Parcelforce staff. There were thousands of people within the Post Office network who came into daily contact with large volumes of mail and tempting wads of notes at sorting offices, cash centres and Post Office branches around the country. They needed to be watched.

By all accounts the Post Office Investigations Department (with more than its fair share of burly ex-coppers), was something of a law unto itself. POID2 had the authority to interview staff under caution. As with its historical predecessors, if POID believed a criminal offence had taken place, instead of handing everything over to the police, or the newly-formed Crown Prosecution Service, Post Office investigators passed their evidence to the Post Office’s own in-house prosecutors, who would bring charges directly. In the 1990s the department was renamed POSIS – Post Office Security and Investigation Services – and then, finally, Security Group.

By 2010, when the Post Office’s prosecution frenzy was still in full swing, Royal Mail Group (which had turned the tables on its older sibling and now counted the Post Office as one of its sub-brands) employed 287 investigators and security managers. A five page document informing the public about the activities of RMG Security stated bluntly, ‘Those who steal must expect to be detected and prosecuted.’

The process of calling in the heavies when suspicions were raised about nefarious activities at a Post Office branch varied. In a Crown Office it was relatively straightforward. A branch manager would spot or be informed about suspected criminal activity and refer that information directly to the Security team. Things were a little different when it came to the Post Office’s network of Subpostmasters.

This is because Subpostmasters are not, and never have been, Post Office staff. They are small business owners, acting as agents for the Post Office.

Every Subpostmaster is security-checked before being appointed. They are, as a rule, unlikely to be dishonest. But there are thousands of Subpostmasters, employing tens of thousands of counter assistants. Billions of pounds in cash wash through the Post Office network on a monthly basis. Criminal activity at some level, by someone, is a given. Detecting and stopping it is another matter altogether. Pre-Horizon, once a tranche of cash had been received by a branch from a Post Office cash centre, the Post Office essentially lost sight of it, becoming wholly reliant on the weekly filed accounts to know where it had gone. Close monitoring of what was happening in any one of the Post Office’s 20,000+ branches was impossible. There was no CCTV or electronic data collection. Almost everything was done on trust.

The only way of knowing if a Subpostmaster’s filed accounts had any bearing on reality was by paying them a visit. This was done by the Post Office’s UK-wide squad of ‘auditors’ who would descend on a branch without warning, lock the door and conduct a full stock-take and cash count, with the Subpostmaster present. Auditors chose which branch to visit either at random, on the basis of a tip off, or if someone in Chesterfield had flagged something alarming. If everything was in order, the auditors would leave and the branch could reopen. If a small amount of money was missing, the Subpostmaster would be required to make it good before being allowed to reopen. Some kind of warning might be issued. If a large amount of money was missing, the Subpostmaster would be suspended by their local contract manager and the Security team’s feared investigators would be summoned. It was a rather agricultural approach, but right up until the end of the twentieth century, it was all the Post Office had.

Horizon was going to be the Post Office’s Big Bang. Instead of being in the dark about what was going on in their thousands of branches, every transaction put through every Post Office till in the country would now be recorded and downloaded onto the Post Office’s central servers every night. A window onto the activities of Subpostmasters and their assistants had been opened. The lights had come on.

_______________________________

1   Established in 1707 with the Acts of Union between Scotland and England.

2   Pronounced ‘pee-oh-eye-dee,’ not ‘poyed.’

ROLLING OUT HORIZON

Sio Lohrasb is a former technical lead at Fujitsu, responsible for the live rollout of Horizon. I found his details on social media and thought it was worth chancing my arm to see if he was willing to be interviewed for this book. Being an amiable chap, he saw no reason why not. It was fascinating to have a lengthy chat with someone who had the job of introducing Horizon to hundreds of Subpostmasters across the country. Unfortunately, due to the coronavirus pandemic, we couldn’t meet in person.

‘I thought Horizon was state of the art,’ Sio told me, when we finally got our Zoom link working. ‘I actually really liked the solution, and the hardware we were delivering was quite high spec. I mean, it didn’t run so well, but that’s because it was being asked to do so much. But it was very forward-thinking.’

It was Sio’s job to help Subpostmasters make sense of Horizon, both as a piece of kit and as a concept. ‘It was really daunting to the older generation,’ Sio told me. ‘Some of them just weren’t ready for it. One guy was selling postcards in his shop, and I said to him, “You see all these individual postcards? Each one of these could be a holiday, that you could sell through Horizon.” But he couldn’t grasp it. He called it a sledgehammer to crack a nut.’

Sio had a team of installers who would help Subpostmasters switch from paper accounts to touchscreen data entry, working with them to patiently input their existing figures into Horizon, and holding their hands as they came to terms with this brave new world. There were plenty of Subpostmasters who welcomed the arrival of the new IT system, but a few found it genuinely terrifying.

Sio recalled ‘one old dear’ who went to press her new Horizon touchscreen ‘with her finger shaking, bless her. I really felt sorry for her. But we never rushed anybody. We gave her as much time as she needed to make her comfortable and make sure she was all right.’

Even so, Sio admits there was a problem from the start. ‘Yeah, there was incompatibility there with the older generation.’

WHAT IS A SUBPOSTMASTER?

Today, the terms Postmaster and Subpostmaster are used interchangeably. They describe exactly the same job. This is a recent conflation. The role of Head Postmaster, distinct from a Subpostmaster, survived well into the 1980s. In the nineteenth century, there was a clear hierarchical divide between the two. Head Postmasters were regional appointees of the Postmaster General, responsible for the receipt and distribution of the entire mail operation in a given area. Subpostmasters were an altogether less fortunate breed.

Unlike Head Postmasters, Subpostmasters were not employed by the Post Office. Their role attracted no pension, holiday or sick pay. They were self-employed, and on their appointment were expected to install their Post Office counter and telegraph communications fixtures at their own expense. In Queen Victoria’s time, they received no extra allowance for working Sundays – or up to twelve hours on Christmas Day – and often found the cost of running a branch outweighed its income. In short, Postmasters – full time members of Post Office staff – were the haves; Subpostmasters were the have nots.

There was also a not-so-subtle class distinction at work. Within the Post Office, Postmasters were seen and treated as, maybe not quite gentlemen (after all, they worked for a living), but an altogether better sort of person, going about the Queen’s business in service of their country and Empire. Subpostmasters were traders, shopkeepers – lower-middle class sorts opportunistically seeking to improve their social standing by association with a national institution. Subpostmasters were accepted by the Post Office hierarchy on sufferance, mainly because their contribution to a functioning network was essential, but they were never quite trusted or embraced.

In 1896, Joseph Ramms, a stationer living in Wakefield, wrote,

‘I was desirous of the appointment as Subpostmaster, in the belief that to have employment from the Government was a direct road to success in commercial life.’