Post Office scandal: Public inquiry to examine wrongful convictions
bbc.co.uk
bbc.co.uk
It's astonishing. No money ever went missing. It merely _seemed_ to have, and that was the entire foundation for what happened.
Fujitsu should take no blame at all. Their software is crap. But so is everyone's. That's software. We know and accept that in the industry.
> The inquiry will look at whether the Post Office knew about faults in the IT system
It did, because hundreds of users reported them. It chose to attack those users and bullheadedly believe that the system could not be wrong. Once their position was entrenched it became about "How dare mere mortals challenge technology?"
It led to a staggering spectacle of bullying (through relentless legal threats, stone-walling, harassment, and wrongful prosecution) that caused many of the victims to suffer severe health effects or contemplate suicide.
> our first priority is that full, fair and final compensation is provided
Rubbish. This is about more than compensation. There is no _final_ to this. It needs dragging out into the sunlight.
Sure, people lost their livelihoods, marriages, homes and years of their lives over this. Deep pockets might cover it. But if mere compensation is allowed to cover-up this episode a travesty will have occurred.
The issue is about fundamental changes we need to make around our relation to technology that allows grave errors made by weak-minded people to hide behind it. As we put ever more trust in digital forensics, telemetry, algorithmic policing, face-recognition, automated fraud detection and so on, more innocent people will have their lives ruined because we are falling into abject snivelling surrender before technology, far beyond anything Ellul, Mumford, Freud or Weber foresaw.
This speaks to a fundamental error in _how_ technology is being used.
> lessons are learned so that such events can never happen again
Sadly, they will happen again and again and again, I think.
Really!?
Let's see what the inquiry brings up, shall we?
Whether they notified the Post Office or not though, the Post Office certainly knew. They not only shared emails about the problem within the organisation, they engaged in a cover up.
There’s a good BBC Panorama documentary on the scandal that was released more than a year ago.
And the issue is not just that the Post Office knew, but that they were also in charge of the prosecutions.
Private prosecution itself is on trial here, IMO (IANAL but this opinion would not be unusual among lawyers from what I have read)
Edit to add link:
https://www.computerweekly.com/news/252485328/MPs-to-examine...
The data that I can see shows that 76 subpostmasters were prosecuted in Scotland which doesn't seem completely wacky out of line with the rest of the UK.
Do we know how many Scottish prosecutions did not go forward with the fiscal?
The fundamental issue here is that it is likely that the Post Office on the one hand knew of the problems with the code and on the other still continued its prosecutions (based on its longstanding reputation). The fact that in England and Wales they could get away with that without systematic scrutiny surely only sways the chances of cases succeeding elsewhere. There was evidence from Horizon identifying the frauds, after all, and they had been successfully prosecuted.
I imagine much has changed; but I'm quite sure that the PO is still not an ordinary business, like a courier service. They are an arm of government.
The bit that is not "ordinary" is Royal Mail.
Remember that software is crap.
I would add that - particularly when money, or people's lives or reputations - are at risk, the "sensibility" of developers, assistance, etc. should be much higher than it is common today, besides the developers (that still largely insist to believe that their algorithms and implementation are perfect) there is the whole chain of people below that - when confronted with a bug/issue/inconsistency - still instinctively believe that the computer/program/app is right and that the human (customer/operator/etc.) is at fault.
The solution to failing/failed technology (which is anyway right/correct - say - 99% of the times) is to make the friction needed to solve the remaining 1% edge cases/bugs/etc. simpler via human intervention through a documented, transparent and fair process.
Before or later this 99% will (hopefully) go up to 99.99% but still the procedures to correct errors will be needed for the 0.01%.
To give a practical example, not completely unrelated, I recently had a look on the various "online bank cards" (like - only as examples - Revolut, N26, Monzo) on TrustPilot, and found that they have extremely poor customer satisfaction ratings, clearly due almost exclusively to people that for one reason or the other had one of these rare cases and support/assistance was not capable to solve problems or to solve them in a timely fashion.
Even if you look at the various complaints here and there on Hacker News about (say) Apple, Google (and their app stores), Facebook, etc. they mostly revolve (besides the privacy/monopoly related ones) to the total lack of assistance/support and/or the total lack of transparency in the (sometimes with relevant consequences) decisions they make.
Why? It's ok that 737 max crashed? Fujitsu should have taken appropriate measures to minimize errors, people lives got screwed because of lazy developers. I dislike the complacency in tech about bugs and bad quality because 99% of software have no impact on people, until it doesn't...
Why would you assume it's the fault of the developers? For all you know they could have been lumped with a 2 month deadline for a 2 year task, no push back, and just did the best they could.
But consider this: say you were a licensed engineer, and writing shoddy code you would face the risk of losing said license and not being able to practice in the future. Yes, even if "your boss told you to do it". You are the engineer, you are the professional, it's your ass on the line if lives are lost or damaged. Then your choice is either pushing back and risk to get fired, or don't push back but risk to lose your license.
My point being that better software is not going to be written just because the people writing it is afraid of losing their license or being held liable, because in many circumstances that can already happen.
The problem here are not only the developers and the crappy code. Some people here put this thing in production knowing that it was faulty, or once they knew it didn't work as expected they did all they could to hide this for years, blaming others of their own mistakes.
And yes, I agree we need to be better. But it's very important to understand that many of the potential licensed software engineers that are already writing crappy software today and will continue to do so if licensed because they just don't know better.
I can't understand that logic.
Personally, I would and I have said no to work I find immoral. I was also fired, on the spot, for saying no to something that was illegal. The company then threatened to sue me. I threatened to sue them back and they backed down, and I found another job within days that paid more because, like most people in tech, I'm in demand. That company is now dead.
We can all afford to be more choosy.
If Google’s autocorrect mistakenly writes a falsely incriminating text that is inadvertently used as the sole evidence to convict, do we jail the autocorrect developers?
https://www.computerweekly.com/news/252509066/Fujitsu-escape...
Google is liable for defamatory autocomplete suggestions (in Australia) [1], so that's not such a stretch of the imagination.
[1] https://globalfreedomofexpression.columbia.edu/cases/trkulja...
I've been saying it for awhile that these kind of critical systems where lives, large sums of money or crucial infrastructure are on the line should fundamentally handle their software differently than the rest of the industry. The 737 Max crashed because the developers weren't held to the same standard as the aerospace engineers who built the plane. This account system failed because the developers weren't held to the same standard as accountants are. Why should developers get a free pass?
We need to stop treating all software with the same degree of validation and assurance. Some things are more important than others and should have legally codified practices and liability.
Eh, it's one thing if a PC game lets you fall out the world. Such bugs are low-stakes, thorough checks aren't possible for performance reasons, and nobody denies that bugs are widespread.
But for an accounting system to lose track of money? Which is extremely high-stakes? And they've got more than enough time to use things like SQL databases with transactions and constraints? And they ended up telling the courts they were certain enough about the system to jail people based on it?
Our standards aren't that low.
I think that should open them up to unlimited liability. How hard would it have been for them to audit a single problem site to find out their software was trash?
Is that actually something people from Fujitsu testified to in open court? I could not find that in the original article, so I presume you have a different source? I would be interested in that source!
Edit: lower down I found this article that might be your source? https://www.computerweekly.com/news/252509066/Fujitsu-escape...
https://www.private-eye.co.uk/special-reports/justice-lost-i...
If i as an individual who knew nothing about anything went to testify against 700 postmaster/postmistresses, would they ever be convicted? Why would a computer program have more credibility than me, a random bystander? Computers are just weird things manipulating bits, and noone should ever trust them for anything serious, especially to convict other people of wrongdoing.
My personal legal interpretation is that the judges failed (as they very often do) to uphold the legal standards of presumption of innocence and of examining the seriousness of claims produced in the tribunal. The fault rests with them.
EDIT: of course if fujitsu engineers testified that they would jail people based on data produced by their software, that makes them responsible. but the judge is equally responsible not to have independent experts (plural) verify those claims
The engineers would not have been testifying about sentencing, but about whether the system output was accurate. You yourself have just argued that all accounting systems have flaws, the engineers undoubtedly knew that, and if they testified to the accuracy of the output, then they would be culpable of making material claims that they knew had not been verified, and could be wrong.
> ...but the judge is equally responsible not to have independent experts (plural) verify those claims.
It is very obvious in retrospect that quite a few people should have been more suspicious, but that would do very little to absolve Fujitsu of the high moral and legal responsibility of telling the truth, the whole truth, and nothing but the truth if they were called upon to do so. "You should have checked what I said" is neither a legal nor a moral excuse for perjury.
Update:
"The data used in court has since been proved to be wrong and former Fujitsu members of staff are currently being investigated by the Metropolitan Police for potential perjury in the trials of subpostmasters that were blamed for unexplained losses."
https://www.computerweekly.com/news/252509066/Fujitsu-escape...
To be clear: None of the above in any way absolves the Post Office of its much greater responsibility.
This is more about the organization literally driving people to suicide over believing that the software has a bug, but if they handled it correctly - i.e. not tell people that it couldn't be their software and the people must've stolen the money. - that isn't Fujitsu's fault.
What standards? We accept more failure from software than pretty much any other product. If your car’s engine broke down as much as windows you’d never buy from that company again.
Crap software has trained us to accept complete random crashes, and if you look at most code written today you’ll realize it’s only getting worse.
Sorry you're right. I don't mean to dump on my fellow coders. I've actually done some safety critical stuff in my time and still have nightmares 20 years later as to how its running in production.
I guess what I'm trying to say is that the distance between what we understand as the probable correctness of code, and the fantasies of regular folk in management or politics is enormous and widening.
The difference between our informed standards, and most uninformed expectations, is dangerous.
The PO's requirements for the counter-mech project consisted of three yards of requirement documents, in ring-binders. I spent several months in a room with no windows, working through those requirements. They were mainly forms, supposedly describing inputs, outputs, reports, and screens. MOST OF THEM WERE BLANK.
I wasn't with Fujitsu; this was an earlier iteration of the project. But I have no reason to believe that a step-change occurred in the way the PO handles IT projects, between when I worked on it and when Fujitsu picked it up.
If you're prepared to pay for a solution that actually fits your business and you have tight coupling of good software developers and intelligent people who will be using it you can get good results, but people either want something for nothing (won't pay for it) or are mentally incapable of constraining what they want. Some firms simply do not have the staff nor culture to do things well, unfortunately.
You might be onto something re:business fit - the system was designed to process benefits payments and, when the Post Office lost this work, was repurposed into an all-functioning EPOS (which it wasn't originally designed for).
I get the distinct impression that, from the offset, the Post Office might have been more concerned with saving face and justifying the amount spent on the system, and this lead to a culture where none of the system's flaws (or poor fit) could be properly acknowledged or addressed.
Four post masters actually did it - https://www.standard.co.uk/news/uk/post-office-scandal-worke...
> Fujitsu should take no blame at all. Their software is crap. But so is everyone's. That's software. We know and accept that in the industry.
Here's the problem at the end of your post you said this:
> Sadly, they will happen again and again and again, I think.
So if Jailing people is supposed to stop (deter) others from murdering people, then why does it not follow that jailing programmers does not deter them from making coding errors. We are, after all, paid more than ANYONE else in the world for trade work.
Should we just start letting the murderers go?
While the PO definitely takes a lot of the blame (arguably the majority), if people at Fujitsu were claiming perfection when they should know better, especially if that formed part of the prosecution case, then they too deserve to be thoroughly investigated.
There is plenty of blame to go around in this case. It's a shocking, and tragic misscarriage that has ruined thousands of lives. Unfortunately I will be shocked if those responsible see anything remotely close to the kind of strong justice and significant punishment they so clearly deserve. This will be one of those cases like that of Jean Charles de Menezes, where the collective spreads the blame thinly enough that somehow no one is held responsible. I hope I'm proved wrong.
The principles that the Government Digital Service tried to instill/make departments adopt should prevent that
I think that kind of behaviour was endemic among outsourcing companies around that time and they acted with impunity on government contracts.
Sky outsourced a contract to EDS. EDS had delivery problems. It all ended in court:
https://www.pinsentmasons.com/out-law/guides/bskyb-v-eds
What won it for Sky seemed to be the fundamental dishonesty of a single individual at EDS who claimed they had worked on an MBA that anybody could buy via an "internet university". The Sky lawyer bought a degree for the dog named Rover.
The could have gotten away with incompetence but when the liar doubled down on lying that was the end.
A software error needs to be calculated for. This is technical reality that cannot be changed as of today. Of course that also implicates other industries like banking.
I don't think the UK government has enough money to compensate the people it wrongfully convicted. It is harrowing mismanagement that the software wasn't tested immediately before any conviction. Everyone failed here aside from the postmasters themselves.
Not against the software developer? Let's wait and see whether they did due dilligence, shall we?
This happened over a very very long period of time.
People committed suicide over these false charges. Ruling out prosecuting the developer if it can be proved that they knew, did nothing, colluded in silence, etc., would be insane.
FWIW, I don't think "public prosecutors" in the conventional sense (Crown, CPS etc.) were even involved here. The Royal Mail is (like until recently the RSPCA) one of the few entities in the UK entitled to bring its own prosecutions. The Royal Mail pretty much invented the concept of formal investigation and prosecution. This is the Post Office acting with the assumed prosecutorial power of the state; the CPS may not ever have been involved.
This should also include developers doing code review of the code in topic, but also all related code, all testers/QAs and product owner. There isn't one developer that missed that bug.
What I do think is that anyone who pretended there wasn't a mistake, downplayed it when they knew it could be causing the prosecutions or even significant reconciliation issues, should be looked at.
First and foremost, in the UK, Fujitsu itself can (and I think should) be prosecuted for corporate manslaughter here if there is any evidence that Fujitsu executives conspired with the Post Office to keep this quiet, ever.
If anyone ever ordered a developer not to go public with their complaints, threatened a whistleblower, deleted evidence, that should crush Fujitsu for good.
But yes, individual executives should be at risk (the corporate veil can be pierced to include directors), and it's difficult to see how it is possible to rule out right now that there is real liability down the chain.
The situation at the Royal Mail is likely to be dramatically more serious, because there's a significant chance they were both covering up serious failings and knowingly directly prosecuting people to do so.
I worked in a highly regulated company, we were under supervision of FDA, EMA and German EMA. We once missed a bug in database migration where a boolean field was false by default in java (non-nullabe), but it could be null in database column. It apparently broke a few reports (NOT running software, just pdf reports) for pharmacological clinics, 2 developers, 2 testers, our PO and out CTO had "disciplinary" actions (don't remember what it was really called) and their actions were under supervision from external consultants our company had to pay for.
It's crazy we don't have such rules in finance, food, data processing and publishing industries.
> The situation at the Royal Mail is likely to be dramatically more serious, because there's a significant chance they were both covering up serious failings and knowingly directly prosecuting people to do so.
Yes, RM decided to start internal investigation that lasted a few years, instead immediately contacting police, this is why it lasted so long and were so many victims.
Yes, but the distinction here is not actually as useful here as you might think.
In this situation, Royal Mail _are_ the police (the USPS has its own police too). But Royal Mail are also the prosecutors in court (they have/had prosecutorial power).
They didn't really delay sending it to the police because they never would have. It wasn't a police matter because definitively it was a Royal Mail matter. (The Royal Mail has had the power to investigate and prosecute since before there even were police.)
Edit to add: it is now a "Post Office" matter as well because they are distinct businesses as of 2013, and Post Office Ltd is an ordinary company. But the key period concerns a time when they were one and the same
It is a longstanding power the Royal Mail had, in fact.
But yes, private prosecutions are protected by law and Royal Mail now prosecutes using the right of an individual RM employee to bring the charge.
So the bit I want to read up on later is exactly who the individuals were in each prosecution. Is it the chief executive?
Any kind of certification in this space have you have the following for developing core functionality regarding financial data:
* Proper definition of hard requirements and acceptance tests. * Developers have to develop and write tests against this specification. * Another developer have to perform a review and sign off that this code indeed lives up to this specification. * QA will run tests that verify the specification is met, and sign off that it met specification.
That is a PM/PO that have responsibility for the specification. At least two developers and a QA person that have verified that the specification was met. A bug like this only goes live due to impossible to meet deadline or incompetency on multiple levels.
The only remotely acceptable explanation would be that this is the result of some really weird edge case or possibly race condition. But in that case we're back to incompetency, since no experienced developers should design financial software without well known patterns and technologies for the core of the application.
In this particular domain there is zero excuse for a bug like this.
The question is how those people who discovered the bug or managed the components in which it exists handled themselves.
There is no way that Fujitsu (or even individual Fujitsu employees and directors) should be considered off the hook just because software is only software, which is the defence I am seeing here and elsewhere. It should depend on how they acted.
The way developers can be at fault here is if they managed to conspire with QA or testing to hide the existence of the bug from their management and continue to deny it when asked. Which implies a pretty toxic workplace, but, then again, Japanese conglomerates are not famous for sunshine and daisies.
And sure enough, that's the claim: https://www.computerweekly.com/news/252496560/Fujitsu-bosses...
No, the ability to bring a private prosecution is not restricted to specific entities - it is a right everyone has (though some offenses can only be prosecuted with the consent of the DPP, and the DPP can choose to take over a private prosecution) [1]. For example, a woman tried to crowdfund a private prosecution for rape [2].
From [1]:
> There are a number of organisations that regularly prosecute cases before the courts of England and Wales but they do so as private individuals, using the right of any individual to bring a private prosecution. One example is the RSPCA.
[1]: https://www.cps.gov.uk/legal-guidance/private-prosecutions
Though strictly speaking, before the concept of the "private prosecution" was formalised in law, the Royal Mail already had prosecutorial powers; it has always had prosecutorial powers. (The Royal Mail basically invented investigation-backed prosecution in the 17th century).
The Royal Mail is for sure one of the only major organisations to do it at scale too -- though the RSPCA did. The RSPCA have announced that they will no longer do it at all (not least because they have a terrible record of poorly founded and abusive prosecutions and had their arses handed to them in the High Court).
The point I was making here is that this investigation would never have gone to the police, because they have always reserved and widely wielded this power to investigate and prosecute. The Royal Mail even prosecute dog owners whose dogs bite postmen.
[0] which if you think about it presumably now imperils some individuals in a way that is distinct even from the extent to which Royal Mail (and Post Office Ltd) are vulnerable corporately.
https://www.computerweekly.com/news/252498245/Post-Office-st...
According to one interview I heard, part of the problem is that the level of compensation that's actually required in this case is enough to render the Post Office insolvent.
Yes. And some families cannot be made whole; people killed themselves over this.
(Just as they did over false prosecutions from "erroneous transfers" due to technical card fraud, which a researcher once alleged in The Register was propagated by the IT staff of a British bank)
From a legal perspective that shouldn't be a problem, and isn't a good argument for lesser compensation. Either Post Office Ltd can get a loan, get bought or go bankrupt, like any private company. If it's the last one that will obviously create political fallout, but resolving that isn't the job of the justice system.
That would be good IMHO. Some people will disagree, but the post office going bust, and then nationalised would be a good outcome. It should never have been allowed to be privatised, it’s a national service, a place for providing contact to many different essential national provisions.
True it needed to cut costs, moving into smaller premises does that. Even the partnership with WH Smith’s and village news agents are sensible. But it should fundamentally be a government provision.
And while they are at it nationalise Royal Mail, and properly split Open Reach from BT and nationalise that too.
The Royal Mail was founded as a public service in 1516 by Charles I and was privatised in 2010.
The Post Office was founded as a public service by Charles II in 1660 and I believed privatised in 1969.
The Royal Mail are the people moving the post around, and the post office is where you go to post something if you're not going to put it in a post box, as well as do a lot of other things like renew your passport, change money into different currencies and you can even bank cash there.
The Post Office retail chain was split into a subsidiary of the Post Office corporation called Post Office Counters Ltd in 1987, which was renamed to Post Office Ltd in 2001.
When Royal Mail Group was privatised in 2013, the loss making Post Office Ltd retail business was retained by the government.
[1] AFAICT the prominent use of "Royal Mail" for the postage side of the business seems to be fairly recent, post-GPO era thing as well?
the only shareholder is the secretary of state for business, energy and industry (which you can see in its accounts)
I strongly disagree. This mismanagement was going on long before the PO was privatised. In fact I'd argue that it was never really privatised.
We don't need a national postal carrier; a lot of post is now carried by private competitors. The Parcels operation is overpriced. Telecom has been hived off, long ago. What remains is a delivery service; and a network of Post Offices and pillar-boxes. I would instead (a) privatise the carrier service; and (b) nationalise the network of drop-off points, and make that available for use by any carrier. The PO shouldn't be things like a bank, a travel agent, or a delivery system for Social Security.
BT has similar problems, being the other graft from the same stock. I don't agree that OpenReach should be nationalised; OpenReach needs to be exposed to the bracing breeze of competition. It's currently effectively a monopoly.
1) the justice system will not easily go against any government organization (because government has decreed that individual government workers carry responsibility "by default" for what the government does, unless the employee can prove the government maliciously caused the mistake (just causing the mistake, for example with bad info, is not enough), as opposed to the private sector, where businesses are "by default" responsible for mistakes, unless the business can prove an employee to be malicious) This means in a lot of cases judges have a choice when the government causes damage: destroy an employee's career AND giving them a very large fine, to be paid personally, or do nothing. Going after the individual is so unfair this is rarely done. That is probably exactly the intention.
2) government organizations, all of them, have legislative power to some extent (sometimes only over their own internal procedures. However, generally, it goes further. For example, the NHS can refuse care to an individual at their own judgement. Private MD's, by contrast, cannot refuse "basic" care, and can certainly not make that judgement themselves)
3) the justice system will only move against it's own people with extreme reluctance. Certainly mistakes won't be punished (they do this while repeating "how much responsibility they need to shoulder" at every turn. Asking how much responsibility it really is if there's no personal or even organizational consequences when they screw up is not appreciated. They have about the same level of responsibility as the player does in GTA5)
So, you don't do business with local governments as a consultant ("other" governmental organizations, from National Government over ATC to NAVO offices, are fine)
1) The justice system will not go easily against any large organisation unless they believe there is a case to answer. It isn't about whether something bad happened, it is whether somebody could be guilt in law. Governments blame their workers by default? Based on what? Going after the individual is so unfair? Again, that is simply not true. If an individual breaks the law, they will be prosecuted if there is a good chance of a conviction. The reason they don't always is because incompetence is not illegal.
2) The government organisations do NOT have legislative power. The NHS doesn't make up the laws, they abide by the laws of the land. They have some latitude within law but they are (and often are) still subjected to legal action both personally and corporately.
3) The reluctance is not against "it's own people", the judiciary is not the government in the UK. Again, there are laws which protect politicians from certain decisions but they are not above the law.
Of course, there is always the potential for hidden pressure to make problems go away etc. but most of what you say seems to be inferred from prejudice, not from facts.
1) For example, read https://www.civilservant.org.uk/ethics-no_minister.html (skip to the section on liability, if you must, but ideally don't)
For a more practical story, read, for example: https://www.noblesolicitors.co.uk/about/indepth-misfeasance....
That points out government workers, in particular police officers, can be held personally and even criminally liable for illegal actions, while at work. Illegal actions, of course, mostly constitute mistakes. But, this is law ... "not knowing the law is no excuse". Whereas not reading the employee handbook can get you fired, but it can never result in liability, never mind criminal persecution. If, in the private sector, your boss orders you to do something illegally, for example drive away with a car the company doesn't own, you are not liable, even if you knew that it was a crime.
In the private sector, it is up to the public prosecutor to prove you maliciously committed a crime while at work. For instance, if you stole a car, a prosecutor will have to prove that you personally benefitted and not just your employer to get a conviction.
By contrast, there is no such requirement for police misfeasance. If a police officer impounds your car for what turns out NOT to be a crime, he cannot avoid personal liability by, even correctly, claim he did not know X is legal.
The police force, or the ministry of Justice is NOT liable, by contrast, unless the public servant involved can prove he was given malicious instructions. In other words: in order to make the police force liable the individual officer has to prove he was given illegal orders at least.
See the turnaround? In the private sector companies are liable "by default". In the public sector "public servants", individuals, are liable "by default". The burden to prove it was someone else's fault shifts.
It's not just police officers, some very famous cases involve doctors being held personally liable for mistakes that are clearly the consequence of an understaffed emergency department. It was NOT the fault of the hospital, or the NHS, that wasn't even seriously discussed.
2) Google "Hierarchy of law". Law is not the exclusive domain of parliament (or rather: in many, many cases parliament has left implementation to government organisations that internally decide many aspects of law)
Specifically, Secondary (or "delegated") legislation in England includes:
Statutory instruments and ministerial orders By-laws of metropolitan boroughs, county councils, and town councils
https://www.lexisnexis.co.uk/legal/guidance/secondary-or-del...
City hall is one example that definitely has (limited, but even parliament is limited) power to create laws. What many people don't realise: so does the BBC, the NHS, ATC, airports and the phone company.
Generally, most government organisations have their own statutes that are special in the sense that they don't affect just their own organisation (like anything in the private sector), but everyone in society. They are law, and you can be convicted in a court of law for violating them. So yes, most government organisations write their own laws.
3) While technically true, how do you think it works in practice? The Judiciary is, more or less, "middle management" of the police force. Perhaps a bit higher than a line manager, but for example a public prosecutor gives orders to police officers, in any specific case (they decide which actions are taken when a theft is investigated, as opposed to where a traffic cop goes), and they get orders from judges in various capacities (e.g. investigatory judge). They work in the same offices, in the same building. Recently on a documentary there was a case of a police officer being 100% assigned to a particular prosecutor, not to do police work, but as a clerk of sorts for fraud cases.
There is not "the potential for pressure" here. The people that tell police officers what to do have a right of sorts called "prosecutorial discretion": they can, legally, forgive crimes of someone else (subject to some limits, but the only significant limits are geographical and that it doesn't include first degree murder).
When right above you in the management chain management there is someone that has the power to make specific instances of crime legal. What exactly do you think the "workers" will be demanding?
The problem is that, unlike forensic analyses and other scientific methods, the likelihood and nature of software errors is totally unpredictable.
Most regular people would expect an accounting software to maybe have UI bugs, or being occasionally unavailable, or any other number of annoying, but ultimately insignificant issues. They wouldn't expect it to mess up accounting.
Software is only "eating the world" because people trust its usefulness. At some point I wonder if we as an industry are not about to teach the world that software is not to be trusted, at least not for high-stakes situations. This is not the only example, think also about e.g. the Equifax security breach or the Boeing 737 Max disaster.
Poor taste to conflate a nothingburger with the deaths of 346 people.
This is often repeated by developers and it reeks of hypocrisy. Of course management must be implicated, but so must be the developers. Innocent developers are not simply helpless cogs in the machine coerced by management.
This blameless attitude held by many developers permeates the software industry. Whether it's the Volkswagen emissions scandal, ad-tech, or widespread online tracking - these were conceived, built and implemented by developers. And yet developers think they stand apart blameless from the consequences of their shoddy practices.
I wonder if the Fujitsi developers, far removed from the Post Office staff, have ever stopped to consider that the software they wrote ruined the lives of so many people.
They may not even be aware that they worked on this. Or they may have relayed concerns about schedule pressure making errors inevitable, or may be working in an environment where no such concerns can ever be raised.
It seems likely that they're working in the before-testing times which correlates strongly with risk of the above.
I wonder about the procurement process that lead to Fujitsu supplying the UK post office. This might be an instance of the public sector picking the cheapest from N bids then looking surprised when cheapest turns out to mean crap.
Those aren't bugs. The first was a fraud that developers actively participated in.
Yet how many times do we hear a senior manager or politician claim they "take full responsibility" but not resign, and then attempt to carry on as before?
"Taking responsibility" has become a meaningless phrase.
And yes, developers are pretty regularly "cogs in the machine" when it comes to define the development conditions. Especially in large corporations like Fujitsu.
The reason for this is quite simply because it's impossible to develop bug free code. The process needs to reflect this, and if it doesn't it's not the individual developers fault.
What actually happened here is that some people dared to question the hierarchy. Since that was unpossible - underlings can never be allowed to question hierarchy - it turned into a political circus where the authorities spent insane amounts of time and money trying to maintain an established order that was in fact broken.
If this seems extreme, consider that in a functional system someone would have said "Wait, that looks wrong, we'd better fix that." There would have been some inconvenience and expense and possibly some awkward questions. But it was essentially a trivial issue, and the cost-to-fix would have been far lower than it will be now.
Dysfunctional hierarchies are defined by this kind of refusal to deal with reality when inconvenient facts are presented by those who are considered subordinate.
It literally becomes more important to punish those who challenge authority than to fix the real problem.
I don't think judges would be implicated here. the court relies on expert witnesses to explain what to do with a piece of evidence.
For example, if someone is convicted based on DNA evidence, you would have an expert in DNA matching explain the probability of this happening by chance.
If a supposed expert in the software testified that this is impossible to happen unless money actually went missing, and that witness appeared credible, then what can you do?
Unless these cases were tried without juries, then the judge's responsibility is restricted to ensuring the case is conducted properly; that both prosecution and defence evidence is heard, and that only permitted evidence gets presented to the jury. It's not the judge's fault if some witness lies to the jury.
I can't remember the exact specifics, but Fujitsu are absolutely to blame in this. They knew about software bugs that caused these issues since 1999.
Private Eye had a great report on this whole saga: https://www.private-eye.co.uk/special-reports/justice-lost-i... (you can download the report as a PDF on that site).
This is the second major scandal in recent decades where Computer Weekly, a trade rag, have doggedly held truth to power. The other case I'm thinking of is the Mull of Kintyre crash and the terrible state of the firmware in the helicopters.
I guess it is hard since it happened over such a long time, it is easy to assume that the levels look legit, a few 10s of people per year or whatever. Sounds really scary though.
Edit: My ire may be misplaced - the BBC article is titled differently to the Hacker News description.
While there is additional commentary on the testimony given on each bug, and the time it was in effect, along with the legal relevance e.t.c., this does seem like a very buggy piece of software.
The system was such a failure that the government ended up wiping all the debts incurred under the scheme, and refunding those who had made repayments.
It's also hugely embarrassing to the justice system of course. In a way it's the fault of societies near blind assumption that expert=truthful. The Fujitsu people need to go to jail because they repeatedly assured the courts that the software couldn't be at fault even though they had a bug tracker full of loss-of-transactionality bugs. And the legal system just said, well, they're the experts, so if they said it, it's true.
They also had incredibly awkward bugs like "the touch screen hardware we deployed had a bad manufacturing batch that caused a subset to start submitting random button presses 12 months after deployment". It took them a while to realize that the actions weren't genuinely being made by the post masters, etc.
And yeah, iirc they lied to the court. Courts are supposed to anticipate this of course, but unfortunately defense teams near universally didn't push them on this or try to uncover their lies. Like I said, our culture has a severe problem with assuming experts are always honest and trustworthy. It's a totally flawed assumption and it resulted in hundreds of lives being destroyed in this case, but literally, nobody in the legal system including the defense really tried to probe whether the software really did work as the authors said it did. They just accepted the assurances made that it was perfect.
Again, leaving innocent citizens with a record cannot be excused on any level after the problem has become known.
The set of people convicted for stealing from the Post Office could include someone who was caught red-handed with an open till, wearing a stripey shirt and a Zorro mask and carrying a large sack with SWAG written on it in bold letters. Obviously this hypothetical thief shouldn't be acquitted with all the innocent people.
IANAL
Since 2010 there have been large cuts to the police, the courts, the pay of barristers and to legal aid [2]. The result is a massive backlog in cases and covid came on top of that. So it currently takes years to get anything done in the British legal system. There is a lot more broken that just this particular piece of software.
[1] I don't know if the response to these appeals is the duty of the Crown Prosecution Service or the Post Office. The costs will ultimately be borne by the public purse in either case, the PO is financially obliterated by it's liabilities.
[2] The system for paying the legal costs of individuals in court in the UK. Very little of it is left now.
Edit: I don't think anyone is still prison for these convictions. Most sentences were for less than three years and the whole process has been dragging on for a long time.
These decisions, made over and over again, must surely come close to criminal negligence.
This will be a case study in the future, it's just awful how these post masters were treated.
In my opinion, someone between the prosecutor or the one that took the decision to sue should be sentenced to at least the same thing so that they could realize what they did.
Imagine at the original trial when the prosecutor probably did not have enough wrong words to justify how this person was a thief and a liar and should have an "exemplary" punishment...
As a result of that experience, I am predisposed to conclude that the system failings were not Fujitsu's fault, but the Post Office's. The PO doesn't have a sparkling record in IT procurement.
That the PO went after postmasters, knowing that the system they were required to use was reporting false numbers, is appalling, and I hope some executives get jailed. But I don't hold out much hope; the culprits have probably already retired, and figuring out exactly who (among the many people that must have known) to hold responsible looks like the devil of a task.
"Between 2000 and 2014, more than 700 sub-postmasters were wrongly accused of theft, fraud and false"
We have to institute processes that make sure that business software is scrutinized first before blaming any humans. B2B software in large corporations and governments is almost always buggy. At least as a developer I've only seen horrific software in the B2B space. It's simple to see why. Governments and large corporations usually buy stuff centrally. So the users of the software are almost never involved in buying decisions. This leads to software being bought with a list of demands to be ticked off on a checklist.
Counterintuitive UX? Constant crashes? One wrong click corrupting the database? This is almost the standard, and there's no incentive for these companies to improve. The buyers did their thing, you have to deal with it.
I am glad the title was de-clickbaited :)
I bought a prepaid SIM card from Vodafone which was supposed to be 45Gb for 2 years for £45 in August 2021, it’s for a tablet and I don’t use it off wifi very often. The data just stopped working recently, I complained and they told me the plan was activated in 2020 and had expired. I said that was impossible and I had the receipts to prove it and they were supposed to have fixed it but haven’t done so. I think they are just betting that I won’t bother to follow it up any more. It just so happens that I don’t need a lot of mobile data and that setup is convenient for me but I wonder how many people on low incomes who use prepaid SIMs are being swindled out of their money by Vodafone. I’m tempted to take it to small claims court just on principal, but I don’t know if I can find the time or the energy to do it right now.
Also, before software can be used as evidence in court it should have to pass some sort of verification process and maybe it should have to be open sourced too.
Many people living on government allowances had been paid too much. Instead of admitting their mistake government officials decided to retrieve the money and sue for fraud.
The result is that many people struggling with poverty had to repay a lot of money, pay for their legal defense and pay fines. Because they had been labeled fraudulent they could often not reapply to any government allowance. Children were taken away from their ‘criminal parents’ and many of them burnt out, relapsed into previous psychological illness or had to live in poverty for years.
It is lazy to blame this on the software. Nobody bothered to check their story or owned up for there mistake.
What was happening on the process side that enabled these bugs to persist undetected for so long? How were the bugs discovered and proven? Why is the CFO or controller's role in these failures not mentioned?
I think she made a terrible decision; but she didn't literally give the order.
This sounds like a failure on so-many levels. The defence should easily have thrown this out.
Presumably if Fujitsu sent their own witness to say the software was not broken, they committed perjury since it sounds like a fair number of people knew about bugs.