Post Office lied and threatened BBC over Fujitsu dev whistleblower
bbc.co.uk
bbc.co.uk
It seems that some people there abused their power and need to cool down behind bars.
I, for one, don't believe her.
I think it would be fitting if a significant percentage of other people with CBEs started to return them with public statements about them not wanting to be associated with the likes of Paula Vennells.
Issuing Honours is something a Monarch does, but like declaring War or deciding what Laws should govern the country, they don't actually make decisions, that's a government problem.
So long as the general public were barely aware of a problem, this could skate along as not important for years, but now lots of people are angry because they saw a TV show and for once when they said "Hey this is terrible!" instead of "It's just a TV show it's not real you idiots" those of us who were paying attention are like "Yes, so what are you going to do about it?" which as we've seen puts pressure on government to actually do something.
It really depends on what Fujitsu told which PO manager.
https://www.bbc.co.uk/news/uk-england-lancashire-67921974
This a pattern we've seen before
1. "We aren't wrong, you are too involved to make an impartial decision. We need somebody independent to investigate"
2. "The independent investigation has finished, but we need to properly digest their report, so we can't tell you what they said yet"
3. "We've now realised the independent investigation was inadequate, everybody who worked on it was incompetent and its findings are useless so we've destroyed the report. We declare ourselves exonerated, we were right all along".
People tend to have this mistaken understanding of morality which assumes they're a good person and so therefore obviously what they did must be good (since they're a good person) and so they might need to uh, fix differences between the world as they've imagined it and the slightly less rosy reality.
For example sure, you know that stabbing Sarah in the throat resulted in Sarah becoming dead, but you had to do that, because you're a good person and Sarah was going to tell the Police that you'd stolen $18.5M from the business. You didn't steal that money! Sure, yes, you took the money and maybe you technically shouldn't have done that, but you had a 100% sure strategy for playing Blackjack and recovering the $800 000 you lost last month, except that you got a bit confused and lost all of the $18.5M, but that's not theft, that's just a minor mistake you will be able to soon fix, if only Sarah doesn't tell these lies about stealing and get you arrested. So you had to, it wasn't murder, it was really self defence. You're a Good Person!
A UK tradition!
> In 2009, the government came under fire when ACMD [Advisory Council on the Misuse of Drugs] chair David Nutt of Imperial College London was sacked for questioning government drug policy in public
https://www.chemistryworld.com/news/little-has-changed-in-uk...
From the CNN article it seems like the police is going to get involved in this, so at least some good news for the people wrongfully prosecuted by the people charge of the Post Office.
To be precise it is finally getting some of the attention it deserves, both from the public and from the government.
The miscarriages of justice date from 1999 until 2015, and the high court ruling (about the software being faulty) that finally stopped the flow of convictions dates from 2019, almost five years ago. Very little happened since then, and in particular no one has been held accountable.
If that delay sounds absolutely bonkers to you then yes, that is what everyone else thinks as well.
Even crazier. The Post Office just recently lowered(!) the amount of money they allocated for compensations: https://www.bbc.co.uk/news/business-67784706
They basically allocated a pot of money to pay the people they have harmed off. But these people had to actively go out and request their conviction to be overturned. Which of course many people were reluctant to do, since it means they would be upturning their life again, and going to court and finding lawyers and etc. They understandably have very little trust in the system. So Post Office just shrugged and decided they don't need to keep that much money around.
It's even worse: they're still fighting hard against the appeals, heaping more misery on the people trying to turn their lives around!
Not sure how the legal authorities work in the UK but people have to be held accountable, regardless of political party. One would think the government's legal authorities have to act on behalf of the citizens not just in holding persons criminally responsible but also compensating victims.
https://democracyforsale.substack.com/p/tory-donor-fujitsu-p...
Most people from the USA are probably familiar with the term “knighthood” or “being knighted” from the UK which is referring to the same award process but higher ranking. The two titles above CBE apparently are what knighthood refers to, known as KBE/DBE (Knight/Dame Commander of the Order of British Empire) and GBE (Knight/Dame Grand Cross of the Order of the British Empire, the highest honor). So CBE is essentially the third highest honor that can be granted in this fashion.
Related to the story, it seems like the CEO in question was forced to give up the CBE title two days ago in relation to this scandal
She didn't say she would give back the associated money she got.
The Order of St Michael & St George is also famous because it's how the "Yes, Minister" joke works: CMG stands for "Call Me God". And KCMG for "Kindly Call Me God" / What does GCMG stand for? / "God Calls Me God".
She was not yet "forced" to give it up, although that is likely the end result. These honours are notionally bestowed by the Monarch (so these days, Charlie) under advice, so a committee will decide that yup, Paula clearly shouldn't have this honour, take it away, and Charlie will sign the appropriate paperwork. What she's done so far is write asking that it be taken away, which is almost nothing.
I take this opportunity to reinforce the association of her name with the scandal in future web searches.
"Ordener hænger man paa Idioter,
Stjærner og Baand man kun Adelen gier,
men om de Mallinger, Suhmer og Rother,
man ej et Ord i Aviserne ser.
Dog, har man Hjærne,
kan man jo gjærne
undvære Orden og Stjærne."
There is a fair groundswell of opinion, already driven by the bad reputation that the RSPCA, another prolific private prosecutor, has garnered, against private prosecutions. The Horizon thing only serves to fuel this, and I wouldn't be surprised if there were not soon a proposal to do away with all private prosecutions on the back of these, despite the fact that Post Office Ltd and the RSPCA are institutional private prosecutors, and there's nowhere near as strong a case that personal private prosecutors are a problem.
Historically, all prosecutions were private, and later, the police who investigated them carried them out.
Between 1999 and 2015, an estimated 3500 staff employed
by the state-owned Post Office service were accused of
fraud, theft or malicious accounting.
Almost 700 of them were convicted in courts and some 230
were jailed.
Most were legally compelled to repay the amounts they
were accused of fleecing, resulting in bankruptcies,
marriage failures, substance abuse and even suicides.
There was just one not-so-little problem – virtually all
of those people were innocent
Doesnt the UK have independent non-political bodies that watch the watchers? What about protections for whistleblowers who call these things out?
Frankly that sounds Banana-Republic-ish and not something you would find in a first-rate advanced economy.
[1] Inside the incredible and devastating postal service scandal that could bring down the UK government
https://www.news.com.au/finance/work/leaders/inside-the-incr...
The Crown Prosecution Service can take over any prosecution at the discretion of the Director of Public Prosecutions, but they didn't seem to know (and/or care) what the Post Office were doing.
Isn't this very similar to how the United States Postal Inspection Service works? (although I think they don't prosecute themselves, but refer matters to the prosecution.)
I heard they are quite formidable and not to be trifled with.
The UK justice system is not fit for purpose - unless the purpose is to let the upper classes get away with (almost literal) murder.
The royal mail had all sorts of powers, historically, as it was a royally sanctioned monopoly, with a charter. The process of privatization left some odd conventions around, such as that it was normal for Post Office Ltd to prosecute things privately, when this has been exceptional for most other entities.
The Post Office used to prosecute for television licence offences, for example, and that only went away relatively recently compared to some of its historic powers. Historically, it had a monopoly over telephones and telegraphy, and some of the powers that the Post Office had in the 19th century were things like compulsory purchase of anyone running private telephone or telegraph systems or prosecuting people for traffic offences on the highway just because there was a mail coach involved.
The Post Office Act 1953 granted the Postmaster General some very sweeping powers, and set the bar quite low for proving fraud against the Post Office: basically, the Postmaster General's say-so for some elements. The Postmaster General also had to give consent to all prosecutions of offences against the Post Office, effectively putting prosecutorial discretion in the hands of the Post Office. And the Postmaster General also had the power to collect the fines upon conviction.
And that's part of how we ended up with the situation at the start of the 21st century.
The idea that you need a license to own a television and receive broadcasts in the UK and that the government actively prosecutes people who watch TV without a license always boggled my mind. Surely there is a more economically efficient and less absurd way to fund the BBC.
https://en.wikipedia.org/wiki/Television_licensing_in_the_Un...
In Law and Order: Postal Inspectors Jerry Orbach is a Postal Inspector, Sam Waterston is the Federal Attorney, and the closest boss who intersects in their respective lines of authority is literally the President of the United States.
Consider that in Scotland, private prosecutions are much rarer and are only permitted in certain circumstances. The post office could not and did not do private prosecutions in Scotland. So, as a result, do we observe lower rates of prosecutions in Scotland than in the wider UK? Nope!
In fact, in Scotland there were 100 convictions, vs 700 in the UK as a whole. The conviction rate per capita, and hence injustice rate, was actually higher in the part of the UK doing public prosecutions, than in the part of the UK doing private prosecutions. Not exactly a vote of confidence.
This meant those that fought the charges and lost were then forced to "pay back" the money they "stole" and also pay the Post Office legal fees and being sent to prison. The scandal is sickening on literally every level you can imagine!
No one should share the role of prosecutor, jury and judge.
It still had very bad outcomes, and clearly with the prosecution not being independent enough, but it wasn’t an entirely closed process.
(More on which at https://news.ycombinator.com/item?id=38969076)
As I said in a related comment: if I looked hard enough, I imagine I'd also be able to find similar miscarriages of justice in the USA, too.
Whereas a generic prosecutor has a bunch of cases of reports from victims that are not related to them, and thus if a case is not sufficiently strong, they'd normally just pick another case where the evidence is strong. They also have the responsibility to independently review the evidence from victims and police. These procedural checks didn't apply in the post office cases.
The procedural checks I mentioned above aren't fool-proof, but they're something.
I know what they wrote.
> The procedural checks I mentioned above aren't fool-proof, but they're something.
I pointed out the CPS itself also prosecuted cases based on the bad evidence provided to them, so the procedural checks also did nothing.
Do note that the fact that CPS prosecuted cases does not mean the CPS didn't throw out dubious cases. We only know the ones they did prosecute, but we don't know how many (if any) they did not prosecute. As I said, this is speculation.
I also speculate that if you send hundreds of fraud cases to the CPS they might be suspicious why the rate of criminal fraud among the post office workers is so high.
I agree there's no evidence that the "private" prosecutions made things worse, but it surely didn't help, and deprived the system of an opportunity (whether it would have been taken or not) to prevent the miscarriages in the first place.
Clearly you do not, as I made no complaint; but merely pointed out how it wasn't quite the regular court process that tomalpha said it to be, and pointed out another thing that has been highlighted by the case. As it has been. A lot more people know this about Post Office Ltd than used to, and it is oft-discussed when the subject comes up.
More on which, again, at https://news.ycombinator.com/item?id=38969076. And more on the expected consequences of this coming to widespread public attention, and another private organization that is a prolific private prosecutor, at https://news.ycombinator.com/item?id=38969548.
Any private citizen or business in the UK has a right to prosecute crimes. It just costs a lot of money, so you can imagine how it's used (spoiler: large companies/wealthy individuals against poor people).
There were a (relatively) small number of prosecutions from the CPS as well, which suffered from the same problem: the Post Office investigators gave the same bad evidence, which they used to convince a jury to convict.
I don't see how separation of powers helps here. I'm sure if I looked, I'd find cases in the USA where the police and/or prosecutors told a pack of lies based on dodgy evidence to secure convictions of serious crimes, too.
It's not a foolproof system, but I think most of the cases you'd find about 'dodgy evidence' would also mention a 'overly close relationship between police and prosecutors' - because fully independent prosecutors should be rejecting cases with dodgy evidence. The police can get a bit grumpy with CPS for being quite strict at times - but it holds them to work their next case properly.
The PO clearly managed to convince the CPS in a number of cases, but had they had to do that for all there would have been a lot less cases prosecuted in total, and I think there would have been questions about their system a lot sooner.
It might not have avoided the problem, but it would have been much needed additional oversight into what they were doing.
So the separation of powers isn’t a magic solution to the problem then.
The lie came from the fact they weren’t looking into their own evidence and realising something was up when they were prosecuting hundreds of sub-postmasters.
https://www.theguardian.com/news/audio/2024/jan/08/revisited...
https://www.theguardian.com/uk-news/audio/2024/jan/08/revisi...
Also some Private Eye podcast episodes:
Jail. The people who knowingly lied and sent people to prison need to be jailed. Not fined, not given a handie, not allowed to simply retire. J.A.I.L.
They callously wrecked people's lives, including some that committed suicide.
It's not about sadism. It's about people getting deserved consequences for actions that greatly harmed a large number of people.
Me? I'm just tired of watching it all.
Treat people reasonably, and not be a Snidely Whiplash level of asshat or you get the pool cue.
From https://www.theguardian.com/uk-news/2024/jan/09/how-the-post...:
> One [bug]...would see the screen freeze as the user was attempting to confirm receipt of cash. Each time the user pressed “enter” on the frozen screen, it would silently update the record. In Dalmellington, that bug created a £24,000 discrepancy, which the Post Office tried to hold the post office operator responsible for.
The fact that this is even possible, apart from the sheer incompetency of a software design that permits it, means that no person can reasonably be accused of stealing cash if that accusation is based on records from this system.
Consider the shittiest homegrown shopping portal probably doesn't do that and any commercial point of sale system absolutely won't do that either. The system has to be such a POS internally that no other vendor will take the liability for it.
Reminds me of the Therac-25 that killed people. This thing probably killed more people than that.
I've been following this story for years, I know BBC's Panorama covered it in 2015, and was really surprised there wasn't more of an outcry in the UK about such blatant unfairness, guess technical cases like this are really helped by a TV drama with quality actors making it easily accessible to the general population, as soon as ITV aired the miniseries, the petition to have Vennall's CBE stripped jumped from 7K signatures to 700K+, and she said she would return it. (not the golden handshakes and "performance" bonuses though lol)
I just can't believe that no-one has been held criminally accountable (yet) for the sheer (to quote the judges in the civil case) affront to justice that this represented - whether it was Post Office Limited (POL) misleading (well, lying to) the courts, or Fujitsu employees lying in prosecutions, or POL deliberately withholding evidence in their role as a prosecutor (wild that this power to prosecute as transferred from Royal Mail to the spun off entity), and some of the cynically legalistic games they played (like asking the judge to recuse himself for being biased against them, to further delay the outcome of the civil suit).
And the crap they pulled with the Second Sight independent analysis that they commissioned themselves...
I was just reading the Clarke Advice(s), and god-damn, I can't see how any former POL executives can claim "we honestly believed all that stuff we said in court, honest", after their own goddamn independent legal advice told them "stop these prosecutions, like now, your expert witness is full of shit" The 2nd Clarke Advice is a great read too, basically "STOP TRYING TO HIDE EVIDENCE, JESUS CHRIST".
Oh, and some of the code that turned up from Horizon in an internal Fujitsus report is egregiously bad (how do I turn x into -x or -x into x? What's -(-x)? nevermind, I got this), from what I've read, the team that wrote Fujitsus was considered low skilled and mocked by other groups within Fujitsu as basically a group of clowns merely lacking a circus.
Clarke Advice 1: https://www.postofficescandal.uk/wp-content/uploads/2022/10/...
Clarke Advice 2: https://www.postofficescandal.uk/wp-content/uploads/2022/10/...
Fujitsu report: https://www.postofficehorizoninquiry.org.uk/sites/default/fi...
Discussion of recusal application by Court of Appeal: https://taxpolicy.org.uk/assets/recusal_judgment.pdf
>not sure if it was a bug or someone remotely changed the account records
It seems to me that determining whether this was a bug or a deliberate backdoor that allowed someone connected to Fujitsu to change account values should have been one of the first priorities of the investigation. The CNN article I read before the BBC article didn't even mention this, it seemed to just imply that this was all a mistake or at worst the government/Fujitsu trying to coverup the fact that the software was shoddy.
Also, strange seeing my hometown mentioned on here!
Private Eye were one of the few people reporting on this regularly. I've been reading about it in there for close on ten years, and am still astonished that it's taken this long to really hit home what happened to these individuals. Bravo to the makers of the recent show that's brought it back into the spotlight. It's truly shocking what the Post Office and Fujitsu did, and one can only hope prosecutions arise from this.
For anyone working in IT, there are lessons to be learned here about what impact software can have on individuals' lives, and bravo to any whistleblower that came forward to speak out.
A friendly yet rueful amendment.
Fujitsu acted like thugs not just to save face, but because important shareholders would lose money if the truth came out.
Also, this kind of thing:
https://www.opendemocracy.net/en/fujitsu-post-office-scandal...
The PM's father in law is the head of Infosys. The PM's wife still has significant holdings in Infosys. Infosys and Fujitsu have a close partnership.
And so on. It's corrupt from top to bottom. The UK government is effectively the marketing wing of the huge public sector corporates, who invariably seem to have senior Tories and Tory donors on their boards.
I’m sure that you already know about it, but the bit that gets me is the Russian oligarchs and their money, honours, property and influence.
Assignations, poisoning etc and still the situation is tolerated.
https://www.private-eye.co.uk/special-reports/looting-with-p...
Rishi Sunak -> Wife (Met 2004, Married 2009) -> Father -> InfoSys -> Fujitsu
Add up to any proof or even suggestion of corruption - just rich people know other rich people.
Every big business has dozens if not hundreds of "partnerships".
I dont think someone at Fujitsu managing a big account like the UK post office would go out of their way to screw something up or cover something up because a partner company's co-founder happens to be F-I-L of the UK PM? Like what's the incentive here?
I mean how in the world can you accuse and convict someone of theft when there is zero evidence outside of the IT system. And how in the world was the IT system never scrutinized?
I personally think the prosecutions were a sign of the times when people were still far too trusting of computer systems. I feel like these days, everyone would realize that there would be at least reasonable doubt as to the accuracy of the system, yet when these prosecutions were mostly taking place it feels like everyone just assumed the system was perfect.
(I have the same feelings as mhh__ in https://news.ycombinator.com/item?id=38967529. Just a remarkable and extremely slow miscarriage of justice.)
Agreed. For those more audio inclined, I linked to these in another comment but I originally discovered their reporting on this via their "Page 94" podcast:
But this was at least a deliberate, criminal cover up at the expense of hundreds of innocent people, maybe worse, implemented with tools intended for fighting serious crime. It seems unbelievable that this could happen in a civilized country.
https://www.theguardian.com/technology/2007/apr/26/comment.s...
https://insidetime.org/newsround/massive-miscarriage-of-just...
These "honours" (knighthoods, peerages etc.) should now be referred to as "disgraces". Liz Truss handed out an honour for roughly each four days of her incumbency as Prime Minister, nearly all to crazies from the extreme right of the Conservative Party. We already have way more peers than can actually be stuffed into the House Of Lords.
Boris Johnston’s attempts to knight his father and Russian oligarchs donating money to the conservatives for titles are examples of this.
Another one today:
https://www.theguardian.com/uk-news/2024/jan/12/british-cond...
"A director can be found to be personally liable for a company offence if they consented or connived in an illegal activity, or caused it through neglect of their duties."
https://www.girlings.com/latest/when-does-a-director-assume-...
so she either knows about this or is negligent - either way jail time should be given
A quick search shows me 371 different matching acronyms, ranging from the "Calgary Board of Education", to "current best estimate", to "Central Bank of Egypt".
For example, their Supreme Court finally moved out of the House of Lords in 2009... (so much for "separation of powers" before that, even though they were joined only in name...)
Even the Law Lords (as they were typically called when the exact same body existed as notionally part of the House of Lords prior to becoming the UK's Supreme Court) were way more independent than that. A Government minister can say "No" to the pick of the committee which independently chooses candidates for this job, but they can't pick for themselves, the committee can just give them the same name again until (inevitably) the minister gets replaced with one who doesn't say "No".
It would in theory be easier for a British government to abolish their Supreme Court than for the US government, but in reality in both cases it would cause a constitutional crisis. The UK is quite capable of having a constitutional crisis, you don't need to write your constitution down to do that, but it isn't very likely.
The levels of the order (which is the only one used on a regular basis, post-WW2) are MBE/OBE/CBE/KBE/GBE.
"Rolling on the floor laughing" should properly be "ROTFL" but usually is "ROFL", and that example is nothing to do with Britain or the honours system. "Member of Parliament" is "MP" not "MOP". "Batchelor of Science" is not "BOSc." but is "BSc.". And so on.
I suspect that "Lord of the Rings" is only "LOTR" because the sort of people who use "ROTFL" are the sort of people who even read the appendices to Tolkein and got there first. (-:
(Btw in the '90s, when it mattered, ROTFL was ROTFL and that was that... Now get off my lawn.)
So you can see how its value might be diluted by this instance.
[0]: https://en.wikipedia.org/wiki/Order_of_the_British_Empire
The CBE in particular: Commander of the Most Excellent Order of the British Empire (CBE)
Yes, the UK still refers to the British Empire.
It's important enough that you can write it on like headed notepaper without seeming like a complete jerk. If I see somebody sent me a letter from "A Smith CBE" that seems reasonable I guess they have a CBE, how about that - if they write "A Smith BA(Hons)" I know they're a terrible person - who cares that you have a fucking undergraduate degree? Am I supposed to be impressed?
One more notch up makes you a knight. So, if you're collecting and this is early in your career that's a good sign you could get there. For example when I was a research student 20+ years ago, my Head of Department was looking to get herself some Honours, and these days she's Dame Wendy.
But like, it doesn't come with a heap of money or anything as far as I know. You briefly get to meet Charlie I guess, but I met his previous wife once (when I was a kid) and she was just some woman, so I doubt he's any different.
Certainly Paula Vennells should absolutely be in prison for her oversight and deliberate destruction of people's lives.
This doesn't help.
The poverty levels are extreme in some parts of the U.K. that are far away from London and the high population density belt that goes through Birmingham to Manchester, lower than in some of the places in the E.U. that one thinks of as the poorer places in Europe. And the infrastructure gets almost zero attention and lip service from London-centric thinking. (Remember the cancellation of the northern parts of HS2?)
But some things are the same as London. I'd mention some, but they would be highly ironic given the subject headlined. (-:
I think the idea that complex systems are assumed to always be correct is... dicey at the best of times and even more so when it's critical to a criminal case.
Definitely ought to be open source.
I wonder whether the black boxes insurance companies like to push would provide the evidence required?
I’m not sure this is workable: if the owner had control, there’d be a cottage industry of people offering to fake evidence against camera tickets. If the owner doesn’t, it’d get requested by police and insurance routinely and since most drivers regularly break local traffic laws that’d have a big negative impact on the owners, which makes me think it’s politically infeasible. Insurance companies might try to mandate that but I imagine they are very careful about changes which could shift customers.
The more likely model is that the insurance companies own and provide the black boxes in return for reduced premiums from the owner.
The current situation is that some drivers run their own dashcams and can choose to provide video evidence, but that could be open to abuse if someone very carefully edits the video and no-one spots it.
I agree that the drivers shouldn't be forced to self-incriminate - the police should be using their own evidence which could well be from other drivers submitting their own driving data/video.
proof of stake blockchains don't have those issues
It's either that or it's vulnerable to 50%+1 attacks.
..absent evidence to the contrary. But in the Post Office case, the Post Office had all the evidence, and refused to disclose it. As far as I'm aware, failure to disclose evidence that might help the defence is perverting the course of justice. I don't know why no manager's been charged.
I shudder at how many scandals never come to light as the process to clear things up and get the truth out is an uphill battle. Oh and my local MP is Ed Davey, who is deeply linked to this PO scandal, though in fairness, he does seem to be singled out over all the others who did less on their watch.
I somehow wonder if society is on a path of race to the bottom at times and amazed how it works with all the flaws that just seem to grow.
Heck whilst typing this I get an email from police about some bail I never attended and yet again, it's the wrong person and has nothing to do with me beyond causing me more grief and stress. I don't even have a criminal record and due to do jury duty later this year, which is unlikely as being driven to wits end.
But hard to really deal with it due to PTSD of it all and decade of abusive neighbours who literally tried to get me killed and not only proof of that ignored but made out the other way around when it is clear as crystal with evidence submitted that is not only untrue but downright blatant lie. Police ignored that and more so, much more in past that it is a history of pure and utter failings and criminal.
Glad I have video and audio recordings proving it and that includes meetings in which police and housing lie and damming as hell. Yet, you would think somebody would care, but dam as I'm not alone in these situations. But look at Post Office scandal - how many people died over that and efforts to get to light. Then the pressure to pursue the truth and effort when others died trying.
It is scary how often things get covered up. There again, I used to work for the BBC and mindful how things can get swept under carpets and ignored like Jimmy.
Because… that’s just not really true, is it. It’s hyperbole, like most of your comment.
Not to say that you are not going through bad things, but blowing a potentially minor thing up into someone literally trying to have you killed isn’t going to get people to take you seriously.
They continue to honour one of their very earliest columnists with "The Private Eye Paul Foot Award for Investigative and Campaigning Journalism". It's a big part of the magazine.
Satirical papers aren't always about fun and jokes -- the good ones often break important stories before the serious papers.
They often use code to write things they would otherwise be sued for:
Bureaucracies don't scale well.
As long as it is logged in some system, you’re golden. This is somewhat enforced through regular publicly disclosed audits. I suppose that’s what Ernst and Young did when they noted in an audit that Fujitsu has unrestricted access to modify accounts without the postmasters knowledge, and this poses risk.
What strikes me as bizarre is that no regulatory body took any action on that report. Maybe the report was private, I’m not sure - I don’t know how things work in the UK. In any case, this really takes your trust away from public institutions. You’re left to wonder, if this was possible, what else might still be possible?
One of the features that the customer desired was essentially an overriding, free-form, editor for the recorded information, as part of the "get all of the information for a case to be submitted to the court" bit.
We didn't do it, because the entire development team thought it was ridiculous, and the person requesting it retired before issue boiled over.
https://en.m.wikipedia.org/wiki/British_Post_Office_scandal#....
That the British public is not motivated by a BBC Panorama documentary in 2015 or by ten years of Private Eye coverage or by 15 years of Computer World coverage, but only finally by a dramatization by ITV; says much the same as the fact that politicians believe that people will swallow the mud slinging that the Director of Public Prosecutions or the Parliamentary Under-Secretary of State for Business are responsible for private prosecutions pursued by Post Office Ltd itself, not by the CPS and not by a government ministry for (by then privatized) business affairs.
And it failed multiple times.
Note that Scotland has its own legal system and it is generally saner. Not sure if any sub-postmasters were prosecuted in Scotland.
They were, though through the usual public mechanism by the Procurator Fiscal
Scotland's legal system prosecuted and jailed Craig Murray. It also prosecuted Alex Salmond, who was unanimously acquitted by a jury; but Craig didn't benefit from a jury. The chief prosecutor is a member of the government, and controls police investigations.
In the case of a political prosecution, I wouldn't describe the Scottish system as "saner".
What did you expect to happen?
I was reading his blog while all this was going on. Despite my curiosity, I was unable to get any clues about who the letter-women were. But I'm not Scottish, I'm not involved with the Scottish National Party, and I don't hang around with SNP politicians (or any politicians).
Perhaps someone who mixed in those circles could have found clues; I understand that several Sottish journalists published pieces from which a knowledgeable reader could deduce who was being referred to. But I believe Murray was pretty scrupulous in avoiding violating the judge's order.
I think it's obvious he was persecuted for his trenchant support of Alex Salmond.
https://en.wikipedia.org/wiki/Tommy_Robinson_(far-right_acti...
And even if he did -- there is something wrong with a justice system that would let that lead to these guys going free:
https://en.wikipedia.org/wiki/Huddersfield_grooming_gang
Reading the dates (years!) relevant to the case is enough to make anyone shutter -- first complaint taken seriously (allegedly) was in 2011 and the arrests didn't happen until 2017.
Some cases seem to be more about politics than about the law (let alone justice).
---
Do I have to say it? I probably do. I think Robinson is an idiot. A football hooligan who seems to have oppositional defiant disorder.
He is also right that there is a problem with Muslim crime in the UK -- and their grooming gangs seem to be a huge problem and there has indisputably been a cover up of it.
He didn't. His reporting included facts that the police and judge claimed could be used to identify people. Many of these facts were also public knowledge anyone following the case likely already knew. These were the same police who brought the failed charges against Salmond. The entire case stinks of corruption and many people including Noam Chomsky have publically backed Murray.
[0] https://www.thenational.scot/news/18486299.global-figures-in...
I mean, they had expert witnesses and stuff. But I've been reading about this in Private Eye for years, and as an IT person you read it and think 'yes those people are totally being fucked over because the organisation is hiding the bugs that obviously lurk in their enterprisey system' whereas for non-technical people it was less obvious.
If there were duplicated entries, they would have stuck out like a sore thumb.
So even before the system came into question, basic accounting should have been used.
If the computer says "You took £x thousand and only banked £Y thousand", the first thing to do is audit the receipts and (unless there were fraudulent entries being made, while noting this was allegedly not possible) as the first rule of forensic accounting is 'follow the money'.
What's so bad here is that the executives of a well respected UK institution acted purely from a profit/reputational motive, and dug themselves deeper and deeper into the hole as a result.
More scarey part of this is that it's Minority Report - "Computer says you're guilty, end of story". Positive take would be the courts are less likely to believe the 'computers are infallible' line in the future.
The balancing. Perhaps because more was cash, but I would have expected some logging to have shown "at 4pm, the account had cash on hand of X pounds. at 4:08pm, the account had 2300 pounds less". Would that not have been useful? But watching (yes, it was a dramatization, but it didn't seem like much), it seems like PO did not want to admit any fault, ever, at all, and just kept sticking to that far beyond the time when they could have just cut their loss, held up their hands, and said "hey - problem identified, we'll fix it".
If I sold 5000 pounds of stuff, and should have received 5000 pounds, and... I have 5000 pounds on hand, but the computer says I have a shortfall 1000 pounds... how is that defensible?
Where did the money 'go'? If I had 4000 pounds on hand, but the computer then said I should have 6000, and I'm short 2000 pounds... why wasn't that discpreancy noted?
Also.. what was the motivation behind all the changes? The whistleblower seemed to indicate this was remote people at horizon "fixing" things by hand. Were these all just 'accidents' no one owned up to? The drama seemed to indicate there was some intentional retaliation against some people, but it couldn't have been intentional in all cases. But also... it doesn't sound like anyone at Horizon stole that money, they were just changing figures in a system.
These were _incredibly obvious_ duplicate entry errors when the Post Office investigated but they blindly took the system as perfect and automatically assumed criminality on the part of the postmaster.
NOTHING about this makes any sense if you assume people on the Post Office/Fujitsu side were acting in good faith.
They did not blindly take the system as perfect, but instead they were well aware of the errors and instead decided to bully the sub postmasters and gain bonuses for successful prosecution. They knew exactly what they were doing and took pains to hide any evidence of the shortcomings of Horizon.
This system works well enough that it can be done with pen and paper. Perhaps consolidating some stuff from time to time (but keeping the calculations for X years).
As far as I can tell Horizon wasn't playing by the rules, either because of bugs or because of badly designed secret admin access (maybe to fix those bugs, but you can guess how well that goes).
I'd equate that to torture.
For context, it led to (sometimes huge) discrepancies in what it thought should be in the till based on sales data from the day.
I don't build systems anything like Horizon, so this is probably a massive over simplification, but surely tracking stock and cash in tills should be really simple? Does anyone know if there are public details on what exactly the technical bug was?
I have only skimmed this so far but it seems there were many bugs.
Also this stood out to me.
> 4. Fujitsu inserted transactions. These are injected into branch accounts by Fujitsu. They may be performed in order to ‘balance’ a discrepancy. These do NOT require acceptance by SPMs in the same manner as TCs and TAs.
They inserted transactions for corrections of discrepancies where you could not see they were authored by them; it was just assumed the postmaster did.
They did not let postmasters know about this; probably an order by the post office.
These corrections where incorrect, and caused discrepancies to increase; they mixed plus and minus sign quite often.
They added lines of code to the system running on the counter in the local post office.
They used the message store system like wild west without defining a data schema.
Then prosecuted the postmasters for inserting transactions, because "only the postmaster can insert transactions".
Two bugs are detailed here: https://www.theguardian.com/uk-news/2024/jan/09/how-the-post...
> One, named the “Dalmellington Bug”, after the village in Scotland where a post office operator first fell prey to it, would see the screen freeze as the user was attempting to confirm receipt of cash. Each time the user pressed “enter” on the frozen screen, it would silently update the record. In Dalmellington, that bug created a £24,000 discrepancy, which the Post Office tried to hold the post office operator responsible for.
> Another bug, called the Callendar Square bug – again named after the first branch found to have been affected by it – created duplicate transactions due to an error in the database underpinning the system: despite being clear duplicates, the post office operator was again held responsible for the errors.
There weren't just bugs, either Fujitsu had the ability of modifying or adding transactional records remotely, but always denied they had the ability to do so, as did the Post Office.
It was not only the bugs but also the UX and the overall process that made things worse.
The system did things that the postmaster was either unaware of, or did not intend to do. When there was a customer session and a session time-out occurred it was changed into an actual transaction without the postmaster intending it; like you have a shopping cart on an e-commerce site and it transforms the shopping cart automatically into a sale after timeout.
There were screen freezes and when the postmaster pressed enter while the screen freeze happend, it multiplied the amount of money, without the screen being updated.
Postmasters are responsible for discrepancies, and when they called the telephone support they were occasionally told "not to worry, it will sort itself out". There were corrections from the outside and postmasters sometimes waited for weeks and even months for these corrections to happen to resolve the discrepancies. Sometimes they never happened.
We're trying to figure out the architecture over on this other thread - https://news.ycombinator.com/item?id=38954516
But basically it was based on a sortof replicated XML database that sent text files back and forth, so the basics of synchronisation and consensus were just not covered properly. e.g. if someone kept pressing a key when the screen was frozen, duplicate transactions got created. Or if they turned their machine off earlier than 5pm, end-of-day processes did not get run properly. Or if their node was trying to synchronise with the central node a bit later than normal and the central node was doing a 'reindexing' operation, their messages got lost. Lots of edge case synronisation bugs basically.
edit: also here's a good computerphile video about the bugs https://www.youtube.com/watch?v=hBJm9ZYqL10
You'd think so, except they wanted a custom system built at incredible expense.
I understand this whole thing is not just a software development failure. But it also feels as if the Fujitsu developers had done a better job we wouldn't be having the whole debacle.
So what are the best practices with a system like this? Are there good and practical books for example on the topic?
"Any software with nf certification must not allow any concealment of data essential for VAT assessment. It must be equipped with a system for identification and tracing of all processes and information relating to collections.
Concerning the registration, the security is done by electronic signature. All information recorded in the cash register system cannot be modified or deleted. Errors and returns are automatically considered as new transactions.
As regards the retention of data, the minimum period imposed by the standard is six years. Furthermore, during a tax audit, an archiving system must facilitate the interventions of the tax authorities, by quickly restoring the data necessary for the calculation of VAT.
Note that archiving is systematic before any purging procedure. This rule ensures that the data is available at each intervention of the administration’s agents."
It's perhaps a bit more like signed git commits than blockchain; the requirement is that every transaction be signed and immutable. If "corrections" are required, the correction has to be appended to the log leaving the original in place. I believe there's also a requirement to feed all this receipt data to the tax authorities.
https://www.postofficehorizoninquiry.org.uk/evidence/pol0002...
An interesting incidence/problem report is in [2] at 1h:03m:00s, where an replication error in their Riposte message store system is described. After a defect counter hardware was replaced, it will fill its empty store with messages from other counters.
[1] "Technical Appendix to Judgment (No.6) “Horizon Issues”", https://www.judiciary.uk/wp-content/uploads/2022/07/bates-v-...
[2] "Alvin Finch - Richard Coleman - Day 54 AM (17 May 2023) - Post Office Horizon IT Inquiry", https://www.youtube.com/watch?v=H0_-ebCVU5k&t=3780
[3] Steven Murdoch: "What went wrong with Horizon: learning from the Post Office Trial", https://www.benthamsgaze.org/2021/07/15/what-went-wrong-with...
Inquiry website https://www.postofficehorizoninquiry.org.uk
Jeez, as I'm betting almost all readers of HN know, if it's connected to the internet, it's not always secure. I'd suggest this is a blatant lie, the truth of which could have easily been verified by asking their in-house tech. After being told by Fujitsu about remote access possibilities, they didn't want believe them?
>Is Horizon still being used? >Yes. There have been several versions of Horizon since its introduction in 1999 and the current version of the system, introduced from 2017, was found in the group litigation to be robust, relative to comparable systems. But we are not complacent about that and are continuing to work, together with our postmasters, to make improvements. We will be moving away from Horizon to a new IT cloud-based system that will be more user-friendly and easier to adapt for new products and services. This is currently being developed with the involvement of our Postmasters.
via: https://corporate.postoffice.co.uk/en/horizon-scandal-pages/...
A new four-part dramatisation about the Horizon scandal aired from January 1st - 4th in the UK.
As a result, the scandal became a popular topic for discussion publically and in the media, as well as introducing the issue to a whole bunch of people who were unaware
I was a bit confused myself as to why this was getting coverage out of the blue until I learned about the ITV series yesterday
I have some relatives who tried out ITVX for the first time especially to watch the drama, which they didn't catch as it was broadcast. They reported that ITVX was almost unusable, and also that the app crashed their telly and caused it to lose the ability to output sound until they rebooted the telly and let it go through an update cycle. "BBC iPlayer is much better." came the grumble down the telephone. (-:
I told them that it was ITV, which has 4 channels and is almost bound to repeat it.
>Post Office Scandal Explained https://www.youtube.com/watch?v=LdQQib3rmkE
How could that happen outside of the Post Office? ICL/Fujitsu had remote access to all the remote boxes and could add/amend records without any audit trail and without knowledge of the sub postmasters, but I can't see how they could get money to go into their own pockets unless they entered into a deal with the sub postmaster operating the branch. Hypothetically, they could delete some transactions and then the sub postmaster would have more money in their till than accounted for and could split the proceeds. (I don't think this ever happened).
https://www.bbc.co.uk/sounds/brand/m000jf7j
Check that out to see how the U.K. establishment works.
News like that make me very angry.
From the little I find to read, looks like it would take a 'basic' IT Auditor could in a few days figure out (and fail) basic ITGCs.
And it amazes me when I hear the term "DevOps" (cringe). But hey, I get it.. we need to make money, A LOT of money, and we need to make it FAST because of reasons (competition, greed, lack of talent, timing, etc.). Who has time and money to spend on Dev/Staging/Prod? Only stupid highly regulated environments need to be stupid enough to do this..
Going back to the story, THIS happens, people go to prison, people die. I have (in my IT Audit years) discovered/uncovered SO MANY tragic things.
And what scares me.. when I see YC 'offsprings' hiring and 99.9% of jobs are "stuff-building/money-making". Zero audit roles. And I am not angry because "damn - please hire me".. it's that how many of these places have an experience, IT savvy auditor? Not someone's cousin that is an accountant.. (no disrespect - it will take a CPA 10+ years to not be tricked).
And with that, I leave you with a friendly note on IT Auditors find and hire one with strong IT knowledge/background. They are worth their weight in Latinum!!
Indeed, they were the exact opposite: huge multinationals with presumably gigantic legal, infosec and HR policy departments who could probably jump through the various compliance hurdles required by this procurement process in their sleep.
By comparison the startups you're complaining about usually take years to reach sufficient maturity to take part in large public sector procurement processes like this.
Clearly in this case maturity and scale were not a bulwark against incompetence, opacity and mendacity. Indeed the opposite - as I type this the Post Office's lawyers Herbert Smith Freehills are making mealy mouthed justifications for witholding reams of technical evidence from the public enquiry for months. It's disgusting, and as someone running a small business and endlessly having to justify our commitment to information security, data privacy and transparency I find the hypocrisy infuriating.
On the world of RACI, the client is always the A. I don't expect the guy who gets paid to be honest. I expect the payer to do their checks.
And stuff like that could have been picked up but an ITGC audit, Project Audit (reqs), SOX, any type of break/smoke test.. and so on..
Somebody dropped the ball - hard. This could have been prevented and/or detected and/or corrected.
Having served as Internal Audit for many many years, I get angry because I/someone in my line of work should have caught this.
Now.. WTF was the internal audit of Royal Mail/Post Office? Why isn't the CAE brought in for questioning and what was the scope of their audits?
Yes, definitely NOT YC company. But I don't see any YC companies hiring auditors, only engineers ;)
It's become very clear as the public enquiry has progressed [1] that Fujitsu were:
- aware of several bugs - including ones they'd fully understood the cause and mechanics of - that would induce double-counting of transactions
- aware that criminal prosecutions were underway against users of the system in which just such double-counted transactions would clearly have had a material impact on the case and the evidence aduced
- failed to raise the above in a timely manner, either to the Post Office who had directly requested audit logs, to external auditors, or to the justice system itself
[1] https://www.theguardian.com/uk-news/2024/jan/17/post-office-...
These changes via remote access were not logged.
There was also a point in the drama where the Fujitsu support staff talked a subpostmaster through fixing the errors herself; that is, accounts could be tampered with without using remote access.
I suppose all this unaudited frigging with balances was enabled to cover up the fact that Horizon had serious bugs.
What I'm waiting to find out is why the Post Office managers were so desperate to protect the reputation of Horizon, that they were willing to risk being charged with perverting the course of justice.
They received bonuses for each successful prosecution and it would be career suicide for any of them to blow the whistle.
What I haven't learned yet, is why senior management wanted so much to exhonerate Horizon, that they would hand out bonuses to investigators, and to inquiry witnesses who gave "the right" testimony. The Post Office doesn't have a lot of money; it only broke profit in about 2014.
It can't be that the senior management were responsible for commissioning it, and screwed up; most of the people who did the comissioning will have retired. Similarly, the system was comissioned under a Labour government, and nobody from that era is still around. So I suspect it's the civil service, whose policies and cultures can outlive any human.
If I were to hazard a guess, you haven't chosen to read the article, and have no motivation to actually substantiate your distrust for them past a vague "it's bullshit".