Between 2000 and 2015, more than 700 Post Office counter staff and branch Subpostmasters were convicted of theft, fraud and false accounting on fallacious evidence generated by the organisation’s Horizon IT system. Many of them were locked up, even though they did nothing wrong.
The Post Office refused to accept that what it proudly called ‘the largest non-military IT system in Europe’ was riddled with bugs and coding errors. It used the shaky electronic data from Horizon to wrongfully charge its own Subpostmasters with crimes that simply didn’t exist.
NICK WALIS, journalist/broadcaster, was there for every step of the campaign to uncover this huge injustice. He describes in the second excerpt of his new book The Great Post Office Scandal how the truth finally emerged from the Government-owned organization. . .
For the Post Office, switching to a modern IT system was always going to be a giant undertaking: 20,000 offices would need 40,000 new computers; 67,000 people would have to be trained to keep handing out £56 billion in benefits alone to their 28 million customers.
It would be able to process thousands of transactions each year.
Horizon would place a specially-built PC with Microsoft Windows running under each counter. It would connect to keyboards, barcode scanners, receipt printers, and touchscreens, all of which would rest on top. All the data collected by the branch would automatically be transferred to the central Post Office mainframe computer every night.
NICK WALLIS, a new author, writes that switching to an updated IT system for the Post Office would have been a massive undertaking.
Noel Thomas,71, former sub-postmaster who was convicted of false accounting
How did the Horizon computer system go wrong and what was it?
Hundreds of postmasters have been fired and prosecuted between 1999 and 2015. This was after it appeared that money had disappeared from their branches accounts. File image
The Post Office launched Horizon in 1999, an IT system created by Fujitsu.
This system could be used to do transactions, stocktaking and accounting. Subpostmasters raised concerns about the system’s shortcomings after reporting shortfalls, some which were thousands of pounds.
In an effort to rectify an error, some subpostmasters sought to close the gap by borrowing money or remortgaging houses.
Between 1999-2015, many subpostmasters were fired or tried for their role in the system’s glitches. Ex-workers claimed Horizon was the problem, while the Post Office said there were no problems.
Post Office forced postmasters to plead guilty in case after case to charges they didn’t commit.
Other people who were not convicted of the crime were also hounded from their jobs and forced to return thousands of pounds worth of “missing” money.
The Post Office spent £32million to deny any fault in their IT system, before capitulating.
The However, The scandal cost the lives of postmasters, postmistresses, and they were forced to learn how to handle it. With the consequences of a conviction or imprisonment, even if they are pregnant or have young children.
Courts have heard that many families believed the stress caused their marriages to fall apart.
To implement this was a huge task — but it was seen as a solution to the rampant fraud that bedevilled the benefits system, which in those days was administered in large part through the Post Office. Here was a silver bullet that would future-proof every postmaster’s business (and income) for decades.
However, there were serious problems from the start. Margaret Davison was among the pioneers to adopt Horizon. In 1999, she tried it out at her Tyneside village, West Boldon post office. The trial was conducted by a group of Post Office geeks.
‘There were so many faults in the system which you were expected to cope with, learning on your feet with a queue of customers in front of you . . . What I did not know is how I managed to keep my nervous breakdown from a 60-year old panic attack in a small, busy village Post Office. . . from day one the system was flawed,’ she declared.
Incredibly, two months before the project went live, an internal analysis had listed six ‘high severity’ hitches that were causing accounting discrepancies, lost transactions, system freezes and ‘lock-ups’, printer failures and general losses of accounting integrity.
It warned that there were ‘gaps in data’ which would ultimately be reflected in balance sheet accounts.
What’s more, Fujitsu — the global IT company that had won the contract to build the new system —did not yet understand the ‘root cause’ of the problems.
Recognizing these doubts regarding the security of the software, the Post Office Board refused to approve the project in September 1999. It gave its approval to launch the system a mere month later.
How Horizon’s major problems could be fixed to the satisfaction of the board so quickly (and conveniently) is a mystery. This document, the presentation, or written assurance which gave them comfort is not public.
The Board approved the motion and Horizon was soon to wreak havoc throughout the Post Office network.
Although the program was intended to be foolproof, IT makes it impossible. Complex systems on this scale require complex software, excellent hardware, flawless communication, ideal environments, and perfect software in order to achieve perfect results.
Because nothing is perfect there must always be some chance of malfunction or failure. More complex systems are likely to fail.
Clint, a whistleblower who I learned from about Horizon’s plight (not his real identity), was the one to tell me. Fujitsu hired him specifically to discover what was holding Horizon back and then fix it.
In his assessment, he was very blunt. ‘Everybody in the building knew it was a bag of s***,’ he told me. ‘It had gone through the test labs God knows how many times and the testers were raising bugs by the thousand, including Category As.’
Software bugs can be errors that developers have made into software code to tell computers what they should do. Computers can be made to do something wrong by one misplaced character. If the system is in category A, it might not be usable.
‘They had a team of eight system developers who were some of the worst people I’ve ever seen. A couple of good lads knew how to code properly but, as for the rest, it was just like kindergarten.’
Appeal Court overturned convictions of 39 ex-subpostmasters for theft. Some were bankrupted while others were even sent to jail.
Wendy Buffrey, a former post office worker, from Cheltenham celebrates in front of the Royal Courts of Justice London after her conviction was overturned by Court of Appeal
Clint looked shocked. ‘There were no specs getting written, no development controls going on, no design written down, nothing.’
The biggest problem was with something called a message store, which contained some of the computer’s fundamental operating instructions. This was a recipe for disaster, particularly for the Cash Account — a programme which crawled through every transaction on each Horizon terminal at the end of every day to come up with a figure which was supposed to correspond exactly with the amount of cash on the premises.
Poor coding could cause this critical piece of software to crash or send incorrect information to the wrong places or make numbers multiply, double, or halve. Software was corrupt. The software was unstable.
Clint explained to Fujitsu his bosses about the need for the Cash Account to be scrapped. They would have to rebuild it from scratch. The bosses at Fujitsu refused to do it, saying that it would be too costly and take too long. He was instructed to fix it, and he did so until he got transferred to another job.
As he described Horizon, I was filled with alarm. ‘It was a prototype that had been bloated and hacked together afterwards for several years, and then pushed screaming and kicking out of the door. This prototype should not have been allowed to see the light of day. Never.’
NICK WALLIS said that Horizon, as far as the Post Office was concerned, maintained its fiction.
Unlawful imprisonment, strokes and even death: The Horizon IT scandal has devastated the lives of many victims
Welsh postmaster jailed for nine months ‘fell off the ladder’ after conviction – before picking himself up and seeking challenge to Post Office prosecution
Noel Thomas was jailed for nine months in 2006 after he was accused of stealing £48,000 while he was working for the Post Office in Gaerwen on Anglesey.
According to him, the BBC said he was sorry for the offense because he hadn’t reported any discrepancies that he saw. But he claimed he didn’t accept the money and blamed Horizon.
Mr Thomas said that he wanted everyone’s name to be clear and for him to investigate the facts and find out where the money was going.
“Thirteen Years after being in jail, it was difficult, but my confidence grew through the support of family, friends, and coworkers.
“Yes, I feel bitter. And not only for me, but the Post Office has been coming to people and saying that they took money and that they were a thief.”
Post Office bosses should be held responsible for the death of a postmaster who was wrongly accused of theft.
Martin Griffiths (59) took his life after being falsely accused of taking money from the Post Office.
Martin Griffiths was a father of two and took his life after being falsely suspect of stealing money at a Post Office located in Ellesmere Port. He had been working there for about 20 years.
Mr Griffiths was one of hundreds of postmasters who were suspected of false accounting and theft, with some fired or wrongfully convicted, after amounts appeared to vanish from their tills.
The family of Mr Griffiths said he delved into his own savings and those of his parents to pay back around £60,000 he was wrongly suspected of taking from the branch.
According to his family, the turmoil, which lasted four years between 2009-2013, had an enormous impact on the mental and physical health of the father-of-2.
2013: Mr Griffiths, after leaving a love note, parked his car at the A41 in Ellesmere Port and took his own lives.
His relatives demanded a more rigorous review by the Government, and requested a judge-led inquiry to find the truth behind the scandal.
Postmaster caught up in major IT scandal which saw many falsely accused of accounting fraud suffered a STROKE after he was hounded for £65,000
Peter Murray said he suffered a series of breakdowns and a stroke after he was hounded for £65,000
Peter Murray said he suffered a series of breakdowns and a stroke after he was hounded for £65,000. From Wallasey, Merseyside at 53 years old, Murray was diagnosed with post-traumatic Stress Disorder.
According to him, he was placed on administrative leave without pay. He had to get loans from friends in order to repay the Post Office monthly.
He paid £1,000 a month before learning that he was among many sub-postmasters to face false accusations.
According to the father of his three children, “It has left me totally devastated.” It was a disaster for me and my family. I had nervous breakdowns. It made me feel like an inmate, but it’s not my fault.
Wife finally clears name of her postmaster husband after he died while still facing false Post Office claim he had stolen £46,000
Marion Holmes (78), won justice in her husband’s name for Peter Holmes. He was an eminent postmaster in Jesmond before the Post Office Horizon scandal “destroyed” his reputation.
Marion Holmes, now 78, was awarded justice in her husband’s name for Peter. He had been a well-respected postmaster until the Post Office Horizon scandal “destroyed” his reputation.
Peter Holmes, an ex-police officer, had managed a subpost office in Jesmond (Ne Newcastle) for thirteen years before his life was shattered by problems with the Horizon computer network.
When more than £46,000 went missing from his books in 2008, Peter found police at his door and shocking criminal accusations made against him.
To allow prosecutors to drop the charges of theft, he was required to confess to four counts of falsified accounting. This could have led to him being sent to prison.
Peter was in fact wrongly charged by the Post Office for errors made within its system.
One postmaster’s family claims that he was a troubled man who had to clear graves in punishment for an offense he didn’t commit.
Julian Wilson (pictured together with Karen), was devastated by injustice, and exhausted by all his efforts to clear his name.
According to them, Julian Wilson felt shattered and tired by the injustices that he faced. In 2016, he died from bowel cancer at the age 67. Karen, his wife, believes the cause of the disease was the horrific experiences he had and the relentless search for redemption.
For years the Post Office had stubbornly insisted its IT systems – called Horizon and designed by a company called Fujitsu – never lied, calling them ‘robust’.
Following a case by 557 postmasters in court, Justice Fraser said Horizon was not’remotely solid’ last year.
He said, “This Post Office approach has been reduced to mere assertions and denials, which ignore the factual events.”
“It is the 21st-century equivalent to maintaining the earth’s flatness.”
Fujitsu had around 40 to 50 people working full time on correcting, finding, and spotting errors. Numerous software patches and updates were created every week in order to protect and enhance elements of the network.
They were introduced by human imperfections who sometimes misdiagnosed or applied poorly-written solutions.
The data in these upgrades can be altered, including where the data was sent and how it interacted when it interacts with another system. All the fixes and upgrades were not tested properly before they were released. This would require too high a cost.
But the Post Office insisted on maintaining that Horizon was, for all intents, perfect. Its standard claim to anyone who queried it was that it was ‘dependable’, with no ‘technological failing’.
It claimed that in a court case the system was ‘proved to be faultless’ so there was ‘no cause for concern’.
It fostered an internal belief that Horizon could not be the cause of accounting errors.
Fujitsu also shared a working relationship, which was used as an echo-chamber. Fujitsu believed Horizon worked fine and had an vested right to tell the Post Office. Fujitsu quietly fixed computer problems in branches when Subpostmasters complained loudly and for too long.
Fujitsu made approximately a thousand software changes annually between 1999 and 2019.
What did the result look like? The result?
But the Fujitsu/Post Office echo-chamber maintained that all problems were caught almost as soon as they arose, and that structural or technical fail-safes ensured no Subpostmasters could be held responsible for errors which weren’t their fault.
The belief system relied on everyone not looking at the actual events.
Horizon was affected by a bug known as “The Reversal Bug”. It involved an error in the code. It was not the minus sign that it should have been, but a plus sign.
This meant that on some occasions, ‘reversing’ a transaction — that is, cancelling it — had the opposite effect. Instead of cancelling a transaction, it was doubled by the system.
Fujitsu found the bug in response to Subpostmasters complaining about how much Horizon had been calculating as being in their account at the end each week. Although it was a two-step process, the bug was eventually fixed.
Importantly, however, the Post Office didn’t publicly acknowledge the incident. The Post Office remained true to the belief that Horizon was perfect. Hinter their counters, Subpostmasters left thousands bewildered to cover up discrepancies with their own pocketbooks.
At his Post Office on Anglesey, Noel Thomas’s screen would regularly freeze in mid-transaction. Sometimes, the freeze would become a crash and require a remote reboot. Horizon wasn’t working properly, so it became slow and laggy.
Noel struggled to balance his books even though hardware was functioning. He would eventually end up with a £48,000 discrepancy and be unfairly jailed for false accounting.
When they were in difficulties, there was a Helpline (or, as it became known, a ‘Hell-line’) that Subpostmasters could call — as Noel did, frequently — but too often this only added to the chaos. They were short-staffed which made it harder to contact them and also the staff weren’t well-trained.
Sometimes Helpline operators made suggestions that worsened the situation. They suggested increasing the discrepancy, instead of cancelling the existing one. Subpostmaster was then responsible for this larger loss.
Another common helpline nugget was telling Subpostmasters ‘not to worry’ because the problem would ‘sort itself out’. Sometimes this advice came with a suggestion to ‘balance to zero’ — in other words, to accept the Horizon discrepancy as an accurate record of cash and stock on hand, despite this not being the case — and wait for an error notice or transaction correction to rectify the discrepancy.
For a Helpline operator to tell a Subpostmaster that everything would probably ‘sort itself out’ was not just negligent but dangerous.
One of the Post Office’s crucial claims was that the system was a closed one. Horizon was secure and no one can access it to alter the data. ‘There is no question of remote access,’ said one senior executive. ‘It’s impossible. We know it can’t happen.’
Richard Roll (a former Fujitsu engineer) was the whistleblower who disproved that idea. The results of my investigations so far were broadcast on television in 2011. Roll was in Reading watching and eventually we got in touch.
What he had to tell me opened a window into the reality of keeping Europe’s largest non-military computer network functioning on a day-to-day basis.
He had worked in the software support centre at Fujitsu’s HQ in Bracknell, Berkshire, a secure area with about 30 to 40 staff. The mission of the team was to ensure that Horizon’s network continued functioning by using all available means. Although they are highly capable, they were still a law to themselves. They provided constant updates, fixes, bugs-fixes, and even complete code rewrites.
This was an entire shift because of the scale and infrastructure of the network it used, as well as the variety of products processed by it.
Fixed would be written and tested on over 40,000 machines, either overnight or during weekends, when terminals weren’t in use.
It was common practice for these specialist Fujitsu engineers to take control of Subpostmasters’ individual terminals and remotely investigate a problem. Without any log-in records, this could be accomplished.
An engineer would jump in to fix remote terminals and a Subpostmaster would tell him. Sometimes the team didn’t feel the need to ask permission — if a terminal was switched on and not being used, or it was out of hours, they would just get to work on it.
Later, Roll would tell a court of law in no uncertain terms how he was able to go into a Subpostmaster’s branch terminal — using the Subpostmaster’s login — and change the transaction data without that Subpostmaster’s knowledge.
The Subpostmaster didn’t know that he and his team had access to the branch terminal hacking software and could see what their activities were.
While no one believes these engineers deliberately changed anything, it is possible for them to make mistakes. There was an easy way to make changes in the system without anyone at the top being aware.
It didn’t help that Fujitsu had a service contract with the Post Office which triggered fines when there were problems. Fujitsu was not motivated to inform the Post Office about any problem that arose because of this system.
This is the thing that irritated. The Subpostmasters who were calling in the problems — and whose livelihoods depended on Horizon functioning properly — did not appear to feature much in Fujitsu’s corporate thinking. Horizon was Horizon’s golden goose, the Post Office was not their client.
Bugs and other errors were therefore easily misdiagnosed, overlooked or silently fixed by the Post Office without any warning to Subpostmasters or the Post Office.
Horizon had to appear as normal in order for the client to be satisfied. What they didn’t know couldn’t hurt them.
The contractual situation created dangerous circumstances. It was much cheaper and more convenient for everyone involved to blame the Subpostmaster and then chase them with threats for discrepancies, rather than invest time or money looking into computer code.
Richard was direct when I asked him if he had any doubts that certain Subpostmasters were being put at disadvantage because of errors in the Horizon system. ‘No,’ he said instantly. ‘No doubt at all.’
He believed that given what was happening, and given the size of the system, as well as the nature of their problems, it was impossible for a Subpostmaster to be out pocketed by Horizon errors.
Richard agreed to appear on a BBC Panorama current affairs programme I was working on as a producer — and beforehand we gave senior Post Office executives a chance to have their say.
The executives refused to believe that remote access to Horizon was possible, even though we asked him about it.
The producer pressed the point: ‘So it is not now, and never has been, possible for anybody from the Post Office or Fujitsu to interfere with transactions without the clear knowledge of the Subpostmaster?’
Former subpostmasters Janet Skinner, Seema Misra and Tracy Felstead outside the Royal Courts of Justice in March this year
The reply came back: ‘It is 100 per cent true to say we can’t change, alter or modify existing transaction data, so the integrity is 100 per cent preserved.’
We double-double-checked: ‘And that’s true now, and has been for the duration of the system?’ The answer was an unequivocal ‘Yes’. This was false.
The Post Office’s insistence on the infallibility of its computer system was beginning to unravel, though it would take a long time yet before its management would concede the point and admit that Horizon was fallible and the Subpostmasters had been disgracefully treated.
An insider at the Post Office who was appalled at what was going on told me: ‘What was crazy about the Post Office was that there was almost this mentality of refusing to admit that there is a problem.’
Instead, it retreated even farther into corporate denial — and got nasty.
However, when the Court of Appeal heard the matter, they were determined. ‘The Post Office knew there were problems with Horizon,’ they ruled. ‘It knew Subpostmasters around the country had complained of inexplicable discrepancies. It knew there were serious issues about the reliability of Horizon.’
It was a failure to be honest and open, and it effectively stomped over postmasters who tried to question its accuracy.
The judge presiding over the independent Horizon trial was equally scathing about the Post Office’s ‘bare assertions and denials that ignore what has actually occurred’.
It amounted, he said, to ‘the 21st-century equivalent of maintaining that the Earth is flat.’
Adapted from The Great Post Office Scandal, by Nick Wallis, published by Bath Publishing at £25. © Nick Wallis 2021. To order a copy for £22.50 (offer valid to 28/11/21; UK P&P free), visit mailshop.co.uk/books or call 020 3176 2937.