Post Office IT system was allowed to wreak havoc on innocent lives

IT system that should ‘never have seen the light of day’: Part two of a devastating new book on the betrayal of our Subpostmasters reveals the shocking truth of how deeply-flawed technology was allowed to wreak havoc on innocent lives

Between 2000 and 2015, more than 700 Post Office counter staff and branch Subpostmasters were convicted of theft, fraud and false accounting on fallacious evidence generated by the organisation’s Horizon IT system. Many were jailed, although they had done nothing wrong.

The Post Office refused to accept that what it proudly called ‘the largest non-military IT system in Europe’ was riddled with bugs and coding errors. It used the shaky electronic data from Horizon to wrongfully charge its own Subpostmasters with crimes that simply didn’t exist.

For a decade, journalist and broadcaster NICK WALLIS followed every move in the campaign to bring this massive injustice to light. In the second extract from his shocking and insightful new book, The Great Post Office Scandal, he describes how the truth was finally dragged out of the Government-owned organisation . . .

For the Post Office, switching to a modern IT system was always going to be a giant undertaking: 20,000 offices would need 40,000 new computers; 67,000 people would have to be trained to keep handing out £56 billion in benefits alone to their 28 million customers.

The software would process millions of transactions every year.

With the Horizon system, a custom-specced PC running Microsoft Windows would sit under every counter, each one connected to a keyboard, a barcode scanner, a receipts printer and a touchscreen, which would sit on top of the counter. Every night, all the information collected from the branch would be uploaded to a central Post Office mainframe computer.

For the Post Office, switching to a modern IT system was always going to be a giant undertaking NICK WALLIS writes in his new book 

Noel Thomas,71, former sub-postmaster who was convicted of false accounting

Horizon, an IT system developed by the Japanese company Fujitsu, was rolled out by the Post Office from 1999.

The system was used for tasks such as transactions, accounting and stocktaking. However, subpostmasters complained about defects after it reported shortfalls – some of which amounted to thousands of pounds.  

Some subpostmasters attempted to plug the gap with their own money, even remortgaging their homes, in an attempt to correct an error.

Between 1999 and 2015, hundreds of subpostmasters were sacked or prosecuted due to the glitches. The ex-workers blamed flaws in the IT system, Horizon, but the Post Office denied there was a problem.

In case after case the Post Office bullied postmasters into pleading guilty to crimes they knew they had not committed.

Many others who were not convicted were hounded out of their jobs or forced to pay back thousands of pounds of ‘missing’ money.

The Post Office spent £32million to deny any fault in their IT system, before capitulating. 

However, the postmasters and postmistresses said the scandal ruined their lives as they had to cope with the impact of a conviction and imprisonment, some while they had been pregnant or had young children.

Marriages broke down, and courts have heard how some families believe the stress led to health conditions, addiction and premature deaths.

To implement this was a huge task — but it was seen as a solution to the rampant fraud that bedevilled the benefits system, which in those days was administered in large part through the Post Office. Here was a silver bullet that would future-proof every postmaster’s business (and income) for decades.

But from the outset there were major problems. Margaret Davison was one of the first to use Horizon, in a live trial in 1999 at her tiny post office in the Tyneside village of West Boldon, supervised by a team of Post Office computer geeks.

‘There were so many faults in the system which you were expected to cope with, learning on your feet with a queue of customers in front of you . . . how I avoided a nervous breakdown at the age of 60 in a one-position, very busy little village Post Office, I do not know . . . from day one the system was flawed,’ she declared.

Incredibly, two months before the project went live, an internal analysis had listed six ‘high severity’ hitches that were causing accounting discrepancies, lost transactions, system freezes and ‘lock-ups’, printer failures and general losses of accounting integrity.

It warned that there were ‘gaps in data’ which would ultimately be reflected in balance sheet accounts.

What’s more, Fujitsu — the global IT company that had won the contract to build the new system —did not yet understand the ‘root cause’ of the problems.

Acknowledging these serious doubts about the reliability of the software, in September 1999 the Post Office board refused to sign off the project. Yet just a month later, it gave the go-ahead to roll out the system.

How Horizon’s major problems could be fixed to the satisfaction of the board so quickly (and conveniently) is a mystery. The document, presentation or written assurance that gave them this comfort has not yet been made public.

Nevertheless, the board signed it off and Horizon would soon be wreaking its havoc across the Post Office network.

The program was supposed to be foolproof but with IT, nothing is. Computers on this scale are complex live systems which rely on perfect humans, perfect hardware, perfect communication pathways, perfect environments and perfect software to ensure perfect outcomes.

As nothing is perfect, some level of failure or malfunction must be an expected outcome. The larger and more complex the system, the more likely the failure.

But I learnt from a whistleblower, Clint (not his real name), just how bad Horizon was. He had been specifically hired by Fujitsu to find out what was stopping Horizon from working and fix it.

He was blunt in his appraisal. ‘Everybody in the building knew it was a bag of s***,’ he told me. ‘It had gone through the test labs God knows how many times and the testers were raising bugs by the thousand, including Category As.’

Computer bugs are errors mistakenly written by the developers into the software codes that tell electronic devices what to do. One misplaced character can make a computer do the wrong thing. Category A means the system might be unusable.

‘They had a team of eight system developers who were some of the worst people I’ve ever seen. A couple of good lads knew how to code properly but, as for the rest, it was just like kindergarten.’

The Appeal Court overturned the convictions of stealing of 39 ex-subpostmasters, who were sacked, some bankrupted and others even jailed, earlier this year

Former post office worker Wendy Buffrey (left), from Cheltenham, celebrates outside the Royal Courts of Justice, London, after having her conviction overturned by the Court of Appeal

Clint was aghast. ‘There were no specs getting written, no development controls going on, no design written down, nothing.’

The biggest problem was with something called a message store, which contained some of the computer’s fundamental operating instructions. This was a recipe for disaster, particularly for the Cash Account — a programme which crawled through every transaction on each Horizon terminal at the end of every day to come up with a figure which was supposed to correspond exactly with the amount of cash on the premises.

Thanks to poor coding, this crucial piece of software could crash, send the wrong information to the wrong place or cause numbers to halve, double or multiply. The software had no integrity. It was unreliable.

Clint told his bosses at Fujitsu the Cash Account had to be scrapped and rebuilt from scratch. They refused, saying it would take too long and cost too much. He was told to repair it and did his best until he was moved to a different job.

I listened to him with mounting alarm as he summed up Horizon. ‘It was a prototype that had been bloated and hacked together afterwards for several years, and then pushed screaming and kicking out of the door. It should never have seen the light of day. Never.’

The Post Office persisted in maintaining the fiction that Horizon was, to all intents and purposes, faultless according to NICK WALLIS

From wrongful imprisonment to strokes and even suicide: How the Horizon IT scandal devastated victims’ lives 

Welsh postmaster jailed for nine months ‘fell off the ladder’ after conviction – before picking himself up and seeking challenge to Post Office prosecution

Noel Thomas was jailed for nine months in 2006 after he was accused of stealing £48,000 while he was working for the Post Office in Gaerwen on Anglesey.

He told the BBC that he admitted to the charge because he never reported discrepancies he noticed, but insisted he did not take the money and blamed the Horizon computer system.

‘I want everyone to have their name cleared and to get to the bottom of what has happened and where the money has gone to,’ Mr Thomas told BBC Newyddion 9.

‘Thirteen years after jail, I must admit it was hard but I gradually got my confidence back through family, friends and work colleagues.

‘Yes, I do feel bitter, and not just for myself – the Post Office have been coming and telling people that they have taken money, that they are a thief.’

Family of postmaster who killed himself after being wrongly accused of theft demand Post Office bosses are held accountable

Martin Griffiths, 59, took his own life in 2013 after he was falsely suspected of stealing money from Post Office

Father-of-two Martin Griffiths, 59, took his own life in 2013 after he was falsely suspected of stealing money from a Post Office in Ellesmere Port, where he had worked for around 20 years. 

Mr Griffiths was one of hundreds of postmasters who were suspected of false accounting and theft, with some fired or wrongfully convicted, after amounts appeared to vanish from their tills.  

The family of Mr Griffiths said he delved into his own savings and those of his parents to pay back around £60,000 he was wrongly suspected of taking from the branch.

The turmoil lasted for four years, between 2009 and 2013, and had a huge impact on the father-of-two’s physical and mental health, his family said.  

In 2013, Mr Griffiths parked his car on the A41 in Ellesmere Port after leaving a note for his loved ones and took his own life. 

His family have called for a stricter line of review from the Government and asked for a judge-led enquiry to get to the bottom of the injustices behind the scandal. 

Postmaster caught up in major IT scandal which saw many falsely accused of accounting fraud suffered a STROKE after he was hounded for £65,000

Peter Murray said he suffered a series of breakdowns and a stroke after he was hounded for £65,000

Peter Murray said he suffered a series of breakdowns and a stroke after he was hounded for £65,000. The 53-year-old, from Wallasey in Merseyside, has been diagnosed with post-traumatic stress disorder.

He said he was suspended without pay and forced to take out loans and borrow from friends to make monthly repayments to the Post Office. 

He paid £1,000 a month before learning that he was among many sub-postmasters to face false accusations.

‘It left me completely devastated,’ added the father of three. ‘It caused absolute havoc for my family, I have had several nervous breakdowns. It made me feel like a convict, but I’m not going to let it beat me.’

Wife finally clears name of her postmaster husband after he died while still facing false Post Office claim he had stolen £46,000

Marion Holmes, 78, won justice for her late husband, Peter Holmes, who was a respected postmaster in Jesmond, Newcastle, before the Post Office Horizon scandal ‘destroyed’ his good name

Marion Holmes, 78, won justice for her husband, Peter, who was a respected postmaster before the Post Office Horizon scandal ‘destroyed’ his good name. 

Ex-police officer Peter Holmes had successfully run a sub Post Office in Jesmond, Newcastle, for 13 years, before his world came crashing down due to issues with the Horizon computer system.

When more than £46,000 went missing from his books in 2008, Peter found police at his door and shocking criminal accusations made against him.

He was forced to admit four counts of false accounting in order to for prosecutors to drop charges of theft of the money, which could have seen him sent to prison.

In fact, Peter was one of a number of people wrongly prosecuted by the Post Office over errors its own system had made.

Family of one postmaster said he died a broken man after being forced to clean graves as punishment for a crime he did not commit

Julian Wilson (pictured with his wife Karen) was shattered by injustice and exhausted by his attempts to clear his name

Julian Wilson was shattered by injustice and exhausted by his attempts to clear his name, they said. He died in 2016, at the age of 67, of bowel cancer. His wife Karen says the disease had it roots in the trauma he endured and the all-consuming campaign for redemption.

For years the Post Office had stubbornly insisted its IT systems – called Horizon and designed by a company called Fujitsu – never lied, calling them ‘robust’.

Last year, following a court case brought by 557 postmasters, Mr Justice Fraser branded Horizon not ‘remotely robust’.

He added: ‘This approach by the Post Office has amounted, in reality, to bare assertions and denials that ignore what has actually occurred.

‘It amounts to the 21st century equivalent of maintaining that the earth is flat.’


As it was, about 30 or 40 people at Fujitsu were working full-time on catching, spotting and correcting errors. Every week, multiple upgrades and software patches were written and released to fix, enhance or protect elements of the network.

These were being introduced by imperfect humans who would sometimes miss or misdiagnose the errors, or apply badly-written solutions.

These upgrades could change the data on the system, where it was being sent and what happened when it interacted with something else. Not all the upgrades and fixes were fully tested before being released. To do so would be too expensive.

Yet the Post Office persisted in maintaining the fiction that Horizon was, to all intents and purposes, faultless. Its standard claim to anyone who queried it was that it was ‘dependable’, with no ‘technological failing’.

It claimed that in a court case the system was ‘proved to be faultless’ so there was ‘no cause for concern’.

Internally, it fostered a cultural belief among its staff that Horizon was not capable of being the source of an accounting error.

It also had a working relationship with Fujitsu which functioned as an echo-chamber. Fujitsu had a vested interest in telling the Post Office that Horizon was working fine, and the Post Office had a vested interest in believing it. When individual Subpostmasters jumped up and down loud and long enough about computer issues in their branches, Fujitsu would quietly fix them.

Between 1999 and 2019, Fujitsu changed the Horizon software code on 19,842 separate occasions, roughly equivalent to a thousand changes per year.

The result? In essence, Subpostmasters were using a slightly different computer system almost every time they logged in, which might react to the same button-pushes in slightly different ways.

But the Fujitsu/Post Office echo-chamber maintained that all problems were caught almost as soon as they arose, and that structural or technical fail-safes ensured no Subpostmasters could be held responsible for errors which weren’t their fault.

It was a belief system that relied on no one looking too closely at what was actually happening.

One bug that appeared in Horizon, which became known as the Reversal Bug, involved an incorrect sign in the software code. Instead of the minus sign it was supposed to be, it was a plus sign.

This meant that on some occasions, ‘reversing’ a transaction — that is, cancelling it — had the opposite effect. Instead of cancelling the transaction, the system doubled it instead.

It was discovered by Fujitsu after Subpostmasters complained about the growing amount of non- existent money Horizon calculated as being in their accounts at the end of the week. The bug was fixed (although it took two goes).

But, crucially, the fact it had happened was not publicly acknowledged by the Post Office. It stuck to its mantra that Horizon was flawless. Behind their counters, thousands of bewildered Subpostmasters were left to fill in discrepancies from their own pockets.

At his Post Office on Anglesey, Noel Thomas’s screen would regularly freeze in mid-transaction. Sometimes the freeze became a crash, necessitating a remote reboot. Even when Horizon was working as it should, it was laggy and slow.

And even when the hardware was working, Noel had a tough time balancing his books. He would eventually end up with a £48,000 discrepancy and be unfairly jailed for false accounting.

When they were in difficulties, there was a Helpline (or, as it became known, a ‘Hell-line’) that Subpostmasters could call — as Noel did, frequently — but too often this only added to the chaos. It was understaffed (which made it difficult to get through to) and the staff were under-trained.

Sometimes a Helpline operator made suggestions that made the situation worse by increasing a discrepancy instead of cancelling it, leaving the Subpostmaster responsible for the now larger loss.

Another common helpline nugget was telling Subpostmasters ‘not to worry’ because the problem would ‘sort itself out’. Sometimes this advice came with a suggestion to ‘balance to zero’ — in other words, to accept the Horizon discrepancy as an accurate record of cash and stock on hand, despite this not being the case — and wait for an error notice or transaction correction to rectify the discrepancy.

For a Helpline operator to tell a Subpostmaster that everything would probably ‘sort itself out’ was not just negligent but dangerous.

One of the Post Office’s crucial claims was that the system was a closed one. No one could get into Horizon and interfere with the data. ‘There is no question of remote access,’ said one senior executive. ‘It’s impossible. We know it can’t happen.’

It was another whistleblower, a former Fujitsu engineer called Richard Roll, who gave the lie to that notion. In 2011, I broadcast the results of my investigation so far on a television news programme. Roll was watching at his home in Reading and, eventually, we were put in contact.

What he had to tell me opened a window into the reality of keeping Europe’s largest non-military computer network functioning on a day-to-day basis.

He had worked in the software support centre at Fujitsu’s HQ in Bracknell, Berkshire, a secure area with about 30 to 40 staff. They had one mission: to keep the Horizon network going by any means necessary. While extremely capable, to all intents and purposes they were a law unto themselves, with constant on-the-go repairs, updates, patches, bug-fixes and sometimes complete coding rewrites.

The scale of the network, the infrastructure it was using, the number of different products it was processing and the coding errors inadvertently programmed into the system meant this was a full-time shift operation.

Fixes would be written, tested and rolled out across 40,000 machines overnight, or at weekends when the terminals were not in use.

It was common practice for these specialist Fujitsu engineers to take control of Subpostmasters’ individual terminals and remotely investigate a problem. This could be done without any identifying log-in trail.

A Subpostmaster would be told to leave an unwell terminal switched on, so an engineer could dive in and start making remote fixes. Sometimes the team didn’t feel the need to ask permission — if a terminal was switched on and not being used, or it was out of hours, they would just get to work on it.

Later, Roll would tell a court of law in no uncertain terms how he was able to go into a Subpostmaster’s branch terminal — using the Subpostmaster’s login — and change the transaction data without that Subpostmaster’s knowledge.

He and his colleagues had the power to hack a branch terminal and roam around inside it without the Subpostmaster having any idea they were there or what they were doing.

No one is suggesting these engineers maliciously changed anything, but they were only human and mistakes could happen. Here was a way in which alterations in the system could be made without those at the front end ever being aware of it.

It didn’t help that Fujitsu had a service contract with the Post Office which triggered fines when there were problems. This system of financial penalties for breakdowns meant Fujitsu did not have an incentive to keep the Post Office fully informed about every problem as it manifested itself.

And this is what rankled. The Subpostmasters who were calling in the problems — and whose livelihoods depended on Horizon functioning properly — did not appear to feature much in Fujitsu’s corporate thinking. The Post Office was the client, not the Subpostmasters, and Horizon was the golden goose.

This meant bugs and errors could be misdiagnosed, ignored or quietly fixed without the Post Office or Subpostmasters being any the wiser.

So long as Horizon gave the appearance of functioning as it should, the client was going to be happy. What they didn’t know couldn’t hurt them.

This contractual environment created a dangerous situation. It was cheaper and easier for all concerned to blame a Subpostmaster (and then go after them for a discrepancy with threats), rather than spend time and money digging into allegedly dodgy computer code.

I asked Richard directly if there was any doubt in his mind that some Subpostmasters had been put at a material disadvantage by errors within the Horizon system. ‘No,’ he said instantly. ‘No doubt at all.’

In his view, given what was going on, given the scale of the system and the nature of the problems they were dealing with, the probability that a Subpostmaster would be left out of pocket by a Horizon error was inevitable.

Richard agreed to appear on a BBC Panorama current affairs programme I was working on as a producer — and beforehand we gave senior Post Office executives a chance to have their say.

When we put to them what he had said about remote access to Horizon, the executives denied it was possible.

The producer pressed the point: ‘So it is not now, and never has been, possible for anybody from the Post Office or Fujitsu to interfere with transactions without the clear knowledge of the Subpostmaster?’

Former subpostmasters Janet Skinner, Seema Misra and Tracy Felstead outside the Royal Courts of Justice in March this year

The reply came back: ‘It is 100 per cent true to say we can’t change, alter or modify existing transaction data, so the integrity is 100 per cent preserved.’

We double-double-checked: ‘And that’s true now, and has been for the duration of the system?’ The answer was an unequivocal ‘Yes’. This was incorrect.

The Post Office’s insistence on the infallibility of its computer system was beginning to unravel, though it would take a long time yet before its management would concede the point and admit that Horizon was fallible and the Subpostmasters had been disgracefully treated.

An insider at the Post Office who was appalled at what was going on told me: ‘What was crazy about the Post Office was that there was almost this mentality of refusing to admit that there is a problem.’

Instead, it retreated even farther into corporate denial — and got nasty.

But when the matter reached the Court of Appeal, the judges were adamant. ‘The Post Office knew there were problems with Horizon,’ they ruled. ‘It knew Subpostmasters around the country had complained of inexplicable discrepancies. It knew there were serious issues about the reliability of Horizon.’

It consistently failed to be open and honest, and effectively steamrolled over any postmaster who sought to challenge its accuracy.

The judge presiding over the independent Horizon trial was equally scathing about the Post Office’s ‘bare assertions and denials that ignore what has actually occurred’.

It amounted, he said, to ‘the 21st-century equivalent of maintaining that the Earth is flat.’

Adapted from The Great Post Office Scandal, by Nick Wallis, published by Bath Publishing at £25. © Nick Wallis 2021. To order a copy for £22.50 (offer valid to 28/11/21; UK P&P free), visit or call 020 3176 2937.

Source: Read Full Article