The Great Post Office Scandal: The Fight to Expose A Multimillion Pound Scandal Which Put Innocent People in Jail

PART 1

BUILDING AN EMPIRE

Clint parked up outside the lo-rise glass and concrete office block situated on the edge of Hanworth Park in Hounslow. He announced himself at reception and collected an ID pass. As he waited to be accompanied into the building, he reflected on what he’d been told about the project he would soon be getting a direct handle on.

He knew it was in trouble – that’s why he was there. How much trouble, he could not begin to imagine.

The late nineties were a good time to be in IT. The globally-connected future, foretold by wide-eyed seers and digital visionaries, was no longer the stuff of fantasy. The dot com boom was, well, booming, and the information super-highway, or World Wide Web, was becoming part of everyday life. Smartphones, Google and Facebook were still a while off, but dial-up modems, Netscape and email had worked their way into Britain’s businesses and homes.

Empires need construction workers, and jobs were easy to come by. The IT world was full of brilliant minds, but there were plenty of chancers talking themselves into jobs they weren’t qualified to do. Coders, testers, and systems and network engineers were all in demand, alongside the usual project managers, sales and marketing people. There were also plenty of middle-ranking execs with little understanding of what the young turks in their charge were up to, but had learned just about enough to bluff their way through.

Clint was no chancer. Clint was the real deal. He’d been working in IT development his entire career. He knew how to code a system and he knew how to manage a team.

After spending most of the nineties in Brussels developing complex financial systems for the European Parliament and European Commission, Clint had been called by a former colleague who was working on a project to automate the Post Office network. The project’s name was Horizon.

TRACY FELSTEAD

In November 1999, 17-year-old Tracy Felstead nervously stepped through the door of her local Crown Post Office¹ in Camberwell Green, South London. She was young, keen, just out of school and had been invited to an interview for the post of counter assistant. Luckily, Tracy had been recommended to the branch manager by a family friend, and the interview went well. She was offered and accepted the job.

Tracy was sent on a two day training course to learn her way round Horizon, the new computerised till system which hadn’t long been installed in the branch. Soon, Tracy was using it to serve customers.

There were 12 counter positions at Camberwell Green. Tracy was the youngest assistant, so she was taken under the wing of the experienced staff.

‘To be fair, everybody seemed lovely,’ she remembers. ‘Everybody seemed pretty much on the ball. If you needed any help, you could just ask.’

Each member of staff had their own login, allowing them to switch between counters, but the regime was lax. No one minded if you used somebody else’s login. If someone needed a break during a busy period, another member of staff would ‘jump on’ their Horizon terminal without going through the process of logging off and logging back in again. This ensured minimum disruption for customers, but it had obvious security implications.

Every day, after each shift, Tracy would cash up, checking the money in her till tray against the figures on the Horizon screen. She would then print off and sign a receipt displaying the till tray balance. One day, she found herself with a small deficit. Tracy said her manager was not in the least bit concerned.

‘I think because I was the baby, all of them mothered me. She said, Oh, it’s fine, it will rectify itself. I suppose I was a bit naïve, being 17, but I trusted her.’

Tracy was a happy girl and a popular employee. She flew through the hectic pre-Christmas period without any serious mishaps. Her understanding of her responsibilities – handling cash, handling Horizon and handling customers – was coming on in leaps and bounds. Outside work, Tracy was getting serious with her partner Jon, who worked as a reprographics manager in the City. They bought a house in Penge and were planning to get married. Life was all set.

Half way through 2000 Tracy suffered another spate of discrepancies. ‘I did a cash up at the end of the week and I had a £1,300 loss,’ she says. Again, her boss seemed relaxed. Tracy said the manager took over at the terminal, ‘did something’ and the loss went up to £1,800. ‘And then she said, Oh, leave it, I’ll sort it out. ’

Tracy did leave it, but she was concerned.

In February 2001 Tracy locked her till tray in the office safe and went on a family holiday. It was her parents’ 15th wedding anniversary, so they chose somewhere special – the Dominican Republic. While Tracy was away her cash tray could be used by someone else, so long as all the stock and cash was checked before and after each session, and the counter assistant entered the figures under their own login into Horizon.

The day before Tracy got back from holiday, a loss of £11,503.28 was found on her stock unit.² On her return to work, Tracy was questioned about the loss. Her manager’s demeanour was not motherly any more.

‘I’m looking at this woman like, What on earth is going on?, and she said, Oh, another member of staff used the till while you were away and found a discrepancy. ’

Tracy was asked if she knew how the discrepancy had come about. She remembers shaking her head and firmly telling her manager she had ‘no idea.’

The next day, Tracy cashed up and signed off her stock unit with the £11,503.28 discrepancy still outstanding.

There appeared to be a serious amount of money missing from Tracy’s till position, but as nothing more was said, she put it to the back of her mind. Tracy continued serving customers, but the atmosphere had changed. Two weeks later she walked into work and was given a shock.

‘I’ve got two strapping, great big guys sitting there waiting for me, and they want to interview me. And I said, Okay, that’s absolutely fine. They asked whether I wanted legal representation and I told them, No, I haven’t done anything wrong, so I don’t need anybody. Happy to be interviewed. Not a problem. ’

The two strapping guys were from the Post Office’s internal security unit. Tracy’s interview turned into an interrogation. ‘They were constantly asking, What did you spend the money on? And I remember looking at them and saying, Seriously, I haven’t taken any money. You can have access to anything you want. Bank accounts … whatever. I haven’t taken any money. ’

Tracy was suspended. ‘They said they needed to do some more investigation. I was distraught, absolutely distraught. But part of me actually thought – well, they’ll get me sorted because I haven’t stolen any money. So they’ll fix this.’

Three weeks later, at 8am, the same Post Office investigators knocked on the door of Jon’s parents’ home in Peckham, where Tracy was staying. The investigators were accompanied by two police officers.

‘The police told me they were there to keep the peace. What they thought I was going to do, I’m not quite sure. I’m only 5'3'' and small, you know, a size 10. And I’m not gonna … these men are massive, intimidating, huge men. And they said, Could you escort us down to the police station for interviewing? And I said, Yeah, fine. ’

On this occasion Tracy did ask for a solicitor.

_______________________________

¹   Crown Post Offices – usually shortened to Crown Offices – are directly owned and managed by the Post Office.

²   Stock units are usually related to, and the responsibility of, individual Horizon users. A counter assistant or Subpostmaster will log in to a Horizon terminal and assign themselves, or be assigned to, a stock unit (usually lettered AA, AB etc). The stock unit will relate to a physical till tray containing cash and stamps. Horizon registers electronic transactions and transfers in, out and through stock units over the course of the day. So, if I take a book of stamps out of my till tray and you pay for it by card, my till tray and my stock unit is down one book of stamps, and the amount of electronic money in my stock unit is up by the cost of a book of stamps (even though there is nothing physical in my till tray). If you give me a £50 note and I change it for 5 x £10 notes from my till tray I would also have to manually register that physical transfer electronically on Horizon, so that the physical cash denominations in my stock unit match those in my till tray.

THE MAGIC BULLET

The full automation of Post Office systems was set in motion in 1992, initially as part of a solution to rampant fraud.

In those days benefits were paid at the Post Office by exchanging vouchers from social security order books for cash. Between 1991 and 1992, £230m worth of order books were lost, of which £85m had been found to be fraudulently cashed. A further £16m was lost through fraudulent encashment of girocheques. The paper system was vulnerable, and needed upgrading.

After a few experiments with barcoded order books, the Department of Social Security decided it wanted to use a magnetic-strip swipe-card as a vehicle for dispensing benefits payments. The cards would be given to claimants, who would have their use of the card electronically registered at a central database each time they were swiped at a Post Office. This ensured each card could only be used once a week, and deactivated if lost. Swipe-cards were an established technology. The problem was, the Post Office had nowhere to swipe them.

For decades the Post Office had been the place where British citizens did their admin with the state. Each day millions of people would visit their local branch to buy stamps, tax discs, traveller’s cheques, premium bonds or TV licences. They would cash benefits and pensions, or make utility bill payments, National Savings Bank account withdrawals or deposits, or apply for passports or driving, fishing or game licences or any number of other permits and services.¹

Important documents were stamped, signed, shown or submitted, and cash would be paid or received accordingly. These transactions, made in their millions every day, gave the Post Office a multi-billion pound annual turnover. It was an established system and it worked, but it was costly. Although attempts had been made to automate various parts of the network, by the mid-nineties most village and suburban branches were still handing over paper forms, stamping dockets, transferring physical cash and generally operating more or less along the same lines they had in Queen Victoria’s day. Especially when it came to filing branch accounts.

At the end of each trading week, every Subpostmaster would fill out a giant paper spreadsheet, recording their transactions in the relevant, designated column. The sheet would be signed, folded and posted back to the Post Office’s financial HQ in Chesterfield.

By the 1990s this antiquated system was in need of an overhaul. With the race for digitisation happening everywhere, the Post Office, government and many Subpostmasters felt that automating the Post Office network was a nettle which needed to be grasped. The DSS swipe-card idea provided the impetus for starting to wrestle with the eye-watering cost and logistics of doing so. The eventual solution was a £1bn PFI contract. This was tendered in 1994 by both the DSS-owned Benefits Agency and the Post Office. It would deliver the swipe-card scheme and automate the front and back end of Britain’s twenty thousand Post Offices – a transformative project.

The candidates were whittled down to a shortlist of three. In May 1996, the winner was announced. Pathway, a consortium owned almost entirely by a company called International Computers Ltd – better known as ICL – got the gig. ICL once saw itself as Britain’s answer to the American computing giant IBM, but its glory days were long gone. In 1990, the Japanese tech corp Fujitsu had taken an 80% stake in ICL with a view to outright ownership. Whilst Pathway was being tendered, Fujitsu was in the process of swallowing ICL whole.

Pathway managed to come bottom in eight of the 11 scoring criteria drawn up to quantify the strengths of each bid, but it was the cheapest in terms of its cost to the government. Fujitsu’s business model for Pathway saw it shouldering almost all the project’s commercial risk by paying for its development and rollout. In return Pathway would get a transaction fee every time a shiny new Benefits Agency card was swiped through a shiny new Post Office card-swiper, for a guaranteed period of eight years. If all went according to plan, Project Pathway would deliver automation of the Post Office and vast sums of cash to Fujitsu, without any risk to the public purse. As an incentive to get things operational as soon as possible, the eight year guaranteed transaction fee period would start the moment the PFI deal was signed.

Almost as soon as the ink on the contract was dry, Pathway ran into difficulties. Serious, big-picture difficulties. It seemed everyone had badly underestimated the complexity of automating 20,000 geographically isolated and disparate Post Offices carrying out multiple (and sometimes region-specific²) transactions which were many times more complicated than the average bank.

The logistics of building, testing and installing a bespoke IT system of this size was uncharted territory for the government, and Fujitsu. 20,000 Post Offices would need 40,000 terminals. 67,000 people with variable technical skills would have to be trained to successfully keep handing out £56 billion in benefits alone to their 28 million annual customers.

The hardware would have to be robust. The software would have to process millions of transactions a year. Training and support would have to be first rate. Fujitsu had bid for IT’s Operation Moonshot by undercutting the competition. Having won the contract, they were realising how complex and expensive moonshots can be.

Conceptually, Horizon was relatively straightforward. The front-end terminals would be custom-specced PCs running Microsoft’s Windows NT operating system. These would sit in a box under each Post Office counter window. Each PC would be connected to a custom keyboard, a barcode scanner, a 3.5 inch receipts printer and a touchscreen, which would sit on top of the counter. Running bespoke Horizon software, each counter PC would write both manually- and barcode-inputted transactions into the branch accounts. Every night all the information collected from the branch would be uploaded via ISDN or (in some cases) satellite to a centrally-located Post Office mainframe.

That was the theory. Writing the code to make this system work reliably appeared to be completely beyond Fujitsu. Despite burning through £10m a month, by the middle of 1997, Fujitsu was not able to deliver an (already renegotiated) contractual obligation to demonstrate Horizon’s ‘satisfactory, sustained’ operation. Even in a controlled environment, they simply could not get it to work.

Fujitsu was not helped by its clients, two state-owned entities with different and sometimes competing priorities. Goalposts for the project were constantly being moved. Fujitsu would later tell parliament that over three years, Pathway’s 366 original contractual requirements had been subject to 323 formal change requests by the Post Office and the Benefits Agency. This was exacerbated, it said, by numerous informal changes and ‘clarifications’ which necessitated ‘significant system re-design.’

Frustrated with the delays, in May 1998, the DSS served Fujitsu with a formal notice of breach of contract. Fujitsu, fed up with the way it was being treated, refused to accept the notice. It then upped the ante by threatening to stop work on the Horizon project altogether unless it received a guaranteed hike in the fee it was going to get from each swipe of the DSS benefits card.

The stand-off turned critical when the Benefits Agency responded by announcing it no longer wished to use swipe-cards to dispense benefits payments. Instead, it was going to encourage claimants to have their benefits delivered direct to their bank accounts. In one swoop, Fujitsu’s potential income from the project had been reduced to zero. On top of that, the Post Office was looking at losing a third of its customer base overnight.

In January 1998, serious consideration was given to abandoning Horizon altogether, but the project limped on. Despite a shifting brief and its lack of operability, there was a feeling in Whitehall that Horizon had become too expensive to kill. Someone was going to have to find a way through, because the fallout caused by cancelling the project would be politically disastrous.

_______________________________

¹   A recent request to a Postmasters’ online forum about the extent of permits and services available through a Post Office in the early nineties returned a wealth of information, for which I am grateful. The following were available: TV savings stamps, general savings stamps, milk tokens, Red Star parcels, Canadian money order encashment, Littlewoods pools, flowers and chocolates by post, WH Smith, Kingfisher and Boots gift vouchers, electoral register applications, viewing of public telephone directories, viewing of the London Gazette (to see premium bond winners), National Railcards, National Savings Certificates, film developing by post, Transcash payments abroad, prescription charge exemption forms and no doubt much, much more…!

²   For example: local authority rent and council tax services, local authority home care services, parking permits, market trader permits.

LEAPING ANTELOPES

When Clint joined Fujitsu in April 1998, he was vaguely aware of the political wrangling going on around the Horizon project, but it was of no real concern to him. His job was to find out what was stopping Horizon from working and fix it. More than twenty years later, after a couple of lengthy telephone conversations, I travelled to meet Clint for lunch at The Grand Hotel in York. Clint had got in touch with me using a messaging app, but was something of a terse communicator when it came to email. I was keen to ensure that before I made the trip he understood the terms on which we were meeting – to record an interview about his experiences at Fujitsu. I also needed some documentation from him. He seemed cagey, but genuine. I was prepared to take a punt. I got on a commuter train to London, crossed the city to Kings Cross and then travelled to York in a near-empty train carriage, a tiny bit unsure as to whether Clint was going to turn up. I needn’t have worried. Clint arrived bang on time and produced enough paperwork to prove he was indeed who he said he was.¹ I found him to be a blunt-speaking individual who is keen to keep his identity private. Over lunch he opened up about his experience of working on Horizon.

Clint, as you may have already guessed, is not his real name.

‘Everybody in the building by the time I got there knew it was a bag of shit,’ he told me. ‘Everybody. Because it had gone through the test labs God knows how many times, and the testers were raising bugs by the thousand, including category As.’

Software code is written by human beings who make mistakes. Computer bugs are errors mistakenly written by developers into the lines of software code which tell electronic devices what to do. One misplaced character can make a computer do the wrong thing, or set off a chain of routines and sub-routines which could lead to something very serious happening. This is why software code needs to be tested in a variety of different environments, almost to destruction, before it can be let loose in the wild. If it is not properly written or properly tested your computer will crash, and sometimes, in extreme circumstances, so will the planes reliant on it.

During testing and operation, the problems bugs create are traditionally classified according to severity. Category C is okay, Category B is serious and Category A means the system might be unusable. Clint told me Horizon, when he first encountered it, was infested.

‘There were thousands, thousands of bugs in the system. You could not see for leaping antelopes, and a lot of them were As and Bs.’

Clint’s initial role was undefined.

‘My manager knew enough about computers to realise he was in the shit, so when he saw I came from a technical background and how much experience I had, he just said, Go in there and find out what the developers are doing. ’

Clint said what he saw was not pretty. ‘They had a team of eight developers who were some of the worst people I’ve ever seen. There were a couple of good lads in there who knew how to code properly and were interested in learning and having a properly structured development project, but the rest … it was just … it was like kindergarten. They didn’t know, they weren’t interested in knowing and it was just about filling their pockets with money and going home at the end of the day.’

It seemed to Clint that some managers didn’t know the difference between a good developer and a bad developer, because they weren’t developers themselves. This included the former Post Office man who’d been put in charge of developing Horizon’s Electronic Point of Sale (EPoS) system – the front-end terminal which would sit inside each Post Office branch, recording the transactions. Clint was aghast.

‘He didn’t have any experience, to my knowledge, in running a development team, writing code, how to make sure the guys knew what they were doing, recruiting the right people, putting them in the right place, system testing, volume testing, any of this stuff that you really need to be doing in a development team.’

He was, according to Clint, in the wrong job.

‘He was a Post Office guy. He should have been there as a business advisor, and they should have had a proper development manager in charge of running that development team. There were no specs getting written, there were no development controls going on, there was no design written down, there was nothing.’

Clint told me that after spending a few weeks trying to properly understand the project, he had a decent handle on most of the problems. He reckoned Horizon’s third-party touchscreen interface software worked well, but the code behind the touchscreen buttons (written in a mixture of three programming languages: Visual Basic, C and C++), was not good. The biggest problem, however, was the information being written to something called a message store.

The Riposte message store was a powerful piece of third-party software within the Horizon system, containing some of its fundamental operating instructions. Riposte also functioned to ensure the important financial data being inputted was safely transferred and duplicated to off-site mainframe storage computers.

‘The first thing that you should always do with a system like that,’ said Clint, ‘is design and agree a data dictionary and a message library repository, basically to say, These are the messages that are allowed to be written to the message store and they all provide the following function… ’

Clint continued, ‘It’s almost like an API – a programming interface² – so that you have a list of allowed messages, agreed messages, which can all be written to the correct format with the correct content. You should also have a layer of software that lies on top of the message store which checks any application above it that’s trying to write a message conforms to the agreed data dictionary. Otherwise, you can just write freestyle to the message store, which is what they were doing. There was no application interface in there, no agreed data catalogue or anything.’

According to Clint, Horizon’s developers had spent the last couple of years ‘firing any old shit’ into the message store as they changed and developed the product. Clint explained that this was a recipe for disaster. If a message was given a new data field, but this wasn’t retrospectively applied, the counter software could retrieve an old message with what it would now perceive to be a missing data field. The reaction of the application would be unpredictable. It could crash. It could send the wrong information to the wrong place, unnoticed. It could cause the wrong values to be applied to a transaction. It could cause values to halve, or double, or multiply.

Knowing exactly what code is in your system is essential. ‘If the application’s not checking that the contents are correct, which they weren’t because they weren’t writing them properly, then the message store is completely corrupted with garbage,’ Clint told me. This meant the software had no integrity. It was unreliable.

I wondered how this could have happened. It was a question Clint was asking himself at the time. He said that from talking to people around the project he gathered the Horizon software at the EPoS end was originally written by a small nucleus of people as a prototype, to show what a Riposte-based counter system might look like. It was this which won them the contract.

‘And what you should do when you get the contract,’ Clint said, ‘is throw the prototype away and start from the beginning, because all that prototype is, is proof of concept – the architect’s cardboard model. You don’t start putting roof tiles on the cardboard building – which is what they were doing.’

Having reviewed the whole EPoS side of the Horizon project, and tested his theories with some developers he trusted, Clint says he went back to his bosses with a few home truths.

‘I broke it down and said, You can keep these bits at a push if you have to. But that bit in the middle, these bits of the engine, the gearbox, you need to throw them away and rebuild them. Starting with the cash account. You’ve got to throw the cash account away and you’ve got to rewrite it. ’

The cash account wasn’t an account in the traditional sense of the word. It was a program which crawled through every transaction on each Horizon terminal in each branch at the end of the day’s trading. It then came up with a figure which should correspond exactly with the amount of physical cash on the premises. That figure was then automatically uploaded to the Post Office’s central servers overnight. It is a relatively simple task to describe, but not necessarily to execute. Given its central importance to the financial integrity of the Horizon system, it had to be bullet-proof. It wasn’t. The code was not good enough.

Clint told his bosses at Fujitsu the cash account had to be completely scrapped and rebuilt from scratch. They refused his request, saying it would take too long and cost too much. He was told to repair it. Clint told me he convened and ran a team of hand-picked developers who did what they could, before internal politics saw him shifted to working on the back-end of the Horizon project.

I listened to Clint with rising levels of alarm. When he had finished, I asked him to sum Horizon up. Without hesitation, he replied:

‘It was a prototype that had been bloated and hacked together afterwards for several years, and then pushed screaming and kicking out of the door. It should never have seen the light of day. Never.’

Over the first six months of 1999, whilst Clint was still there, Horizon’s PFI contract was reorganised once more. The Benefits Agency, having almost fatally holed the project with its decision to take swipe-cards off the table, walked away completely. The government decided Horizon would become the Post Office’s baby. Fujitsu (which had written off £180m on the project and hadn’t yet worked out how it was going to get it back) would continue to develop Horizon on a fixed payment basis. A subsequent National Audit Office report estimated the botched procurement had wasted half a billion pounds of government money. So much for Fujitsu shouldering nearly all of the risk.

Once the decision had been made by government, the Post Office’s IT and business impact teams were understandably concerned about taking responsibility for Horizon. They wanted the opportunity to test it properly before it went anywhere near the Post Office estate.³

On 4 March 1999, the Post Office’s Horizon Programme Board examined the risks associated with the project. It scored them up to 25, multiplying their ‘impact value’ by their ‘probability value’, and graded them green, amber and red. Anything over 15 was a red. The first five risks listed were red. All of them were scored at the maximum 25. The authors wrote:

‘Due to lack of adequate visibility of the ICL Pathway [read: Horizon] design, and the lack of support from the contract to leverage this visibility, we have been unable to gain a high level of assurance in the adequacy or suitability of the service.’

Under ‘Action’ it rather desperately states:

‘All other approaches having failed – final entreaty has been made for cooperation from Pathway [read: Fujitsu] to make available appropriate level of documentation.’

Fujitsu saw this concern from their clients as yet more interference, which could lead to yet more changes and yet more cost. Also, they still couldn’t get Horizon to work. Fujitsu put up a shield of commercial confidentiality, citing the terms of the PFI project, and shut everyone out.

Behind that shield, Fujitsu’s developers, testers and engineers feverishly bashed their new IT system into something that looked like it might work.

Although Horizon was clearly not ready to go live, in July 1999 the government announced the Post Office would start its switch to full automation in October the same year. A joint Working Group was convened. Base units, touchscreens and keyboards were bought and specced up. Teams were hired. A live trial began.

Margaret Davison’s Post Office in West Boldon was one of the branches selected for the trial. In a short, but vivid memoir, written long after her retirement in 2006, Margaret describes what it was like:

‘The installation took place over some days when a constant stream of electricians, Post Office staff and computer geeks climbed or sat all around my office whilst I tried to keep my counter and business running. Looking back I wonder how I retained my sanity or my strength… There were so many faults in the system which you were expected to cope with, learning on your feet with a queue of customers in front of you … not to mention helpline staff so inexperienced and under pressure it often took over an hour to get a call to them answered. How I avoided a nervous breakdown at the age of 60 in a one-position very busy little village Post Office, I do not know. From day one the system was flawed.’⁴

In August 1999, two months before the project would go live, a Post Office ‘business impact analysis’ of Horizon listed six high severity problems, including, ‘TIP [Transaction Information Processing] derived cash account not equal to electronic cash account received by TIP.’

In other words, the cash account Clint was so exercised about still didn’t work.

Under ‘Business Impact’, the report’s authors wrote that the Post Office ‘has not seen a detailed description of the faults creating the missing data, neither has it seen any description of how and when these faults will be fixed.’

The effect was clear: ‘These gaps in data will ultimately be reflected in balance sheet accounts.’

The seriousness of the situation was underscored by the startling revelation that Fujitsu had admitted to the report’s authors that they ‘do not yet understand the root cause of the problem.’

Other high severity problems included back-end data losses causing accounting discrepancies, transactions being lost before they could even be written to the cash account, system freezes and ‘lock ups,’ printer failures, and general losses of accounting integrity.

It is perhaps no surprise that in September 1999 the Post Office board refused to sign off the project, noting ‘serious doubts’ over the reliability of the software.

Yet, a month later, in October 1999, the minutes note, ‘Following remedial work around two issues which had previously prevented acceptance … the system had now been accepted with implementation proceeding at a rate of 200 offices per week.’

How Horizon’s serious system problems could be fixed to the satisfaction of the Post Office board so quickly (and conveniently) is a mystery. The document, presentation or written assurance which gave them this comfort has not yet been made public. Nevertheless, the board had signed it off, rollout was underway, and Horizon would soon be wreaking its havoc across the Post Office network.

_______________________________

¹   Which I then had independently corroborated, checking out his job roles and the technical accuracy of his allegations with other computer experts.

²   Literally, an Application Programming Interface, a set of definitions and protocols for building and integrating application software. APIs allow two applications to talk to each other.

³   A word regularly used to describe either the Post Office systems networks and/or its physical estate (including Crown and sub-Post Offices and its administrative buildings).

⁴   As published on former Subpostmaster Tim McCormack’s blog, Problems with POL.

THE FIRST GOVERNMENT AGENCY

To understand how the Horizon scandal could happen, it’s worth trying to understand what the Post Office actually is.

If you have spent any time in the UK, you are likely to have some sort of concept of the Post Office. Depending on where you live, and possibly how old you are, that concept will vary. The image of a middle-aged husband and wife team running a village branch as their last job before retirement still just about holds true; but the network has changed significantly over the last 20 years. There are now hundreds of busy suburban outlets in the hands of limited companies, or entrepreneurial Subpostmasters with multiple branches seeking profit in economies of scale. In recent years the Post Office has also retreated from many of its imposing city-centre Crown Office buildings, and chosen instead to inhabit the basements and back ends of newsagents and stationery chains.

Unfortunately, a down-at-heel shabbiness characterises many Post Offices. In 2018, the journalist Patrick Collinson wrote an article for The Guardian entitled: ‘How did we allow our Post Offices to become so grotty?’ You only have to drive by a few urban branches in large cities to see what he means.

Yet the Post Office still holds (and undoubtedly trades off) a unique position in the British psyche. In the alleyway behind my house there is a wooden telegraph pole. Carved into the pole at just about head height are the initials ‘GPO.’ This stands for General Post Office – a brand which pre-dates the industrial revolution, the British Empire, and, indeed, Britain itself.¹

There has been a Master of the Post since Henry VIII’s time, and in 1660, Charles II approved an ‘Act for Erecting and Establishing a Post Office,’ which created the role of Postmaster General, and ‘one Generall Post Office … soe that speedy and safe dispatches may be had.’

The General Post Office formally survived as a directly-controlled government department until 1969. But the Post Office isn’t just old, it is everywhere.

During the eighteen hundreds, the Post Office’s activities grew exponentially on the back of huge railway expansion, democratising long-distance communication and accelerating Britain’s capacity to conduct business between its great cities. Nineteenth and twentieth century developments in telecommunications – telegrams, and then telephones – were monopolised by the GPO, which required thousands of operators and engineers to keep these new technologies going. By 1936, the Post Office (along with its glamorous, liveried sub-brand, the Royal Mail) was the largest employer in the country, with a quarter of a million staff.

The Post Office as a concept is therefore more than just a retail presence on the High Street. It can legitimately be said to be the oldest government agency, and at least until recently, the main physical interface between the British state and its citizens. Even now, Post Office paraphernalia retains certain romantic associations which are bound up with concepts of national identity. Think about images of Penny Blacks, post boxes, mail trains, switchboard operators, postcards and telegrams. The apparatus of the networked state has been lionised in poetry, literature, film and television. More often than not, they were presented as symbols of British greatness, representing notions of trust, efficiency, stability and security.

But the Post Office’s eternal presence has been preserved by something with an altogether more sinister edge. As well as being part of the fabric of the nation, the efficient and secure operation of the Post Office is protected by its proximity to power. Interrupting or defrauding Post Office business comes with severe penalties.

For most of the last three centuries, the Post Office has maintained a specialised investigative unit. This unit has direct access to the criminal justice system through the Post Office’s in-house prosecutors. In fact, the Post Office Investigation Branch (known by the start of the twentieth century as ‘IB’) is the oldest recognised criminal investigation force in the world. It pre-dates the police. In the eighteenth and nineteenth centuries, postal workers caught stealing from the mail could expect to be hanged. The Post Office Museum website proudly states that the Investigation Branch ‘has worked to detect offences against the post and prosecute the perpetrators.’ These could be highwaymen, robbers, clerks or delivery boys. Or even spies.

During the twentieth century IB personnel worked with the security services to identify mail sent by internal subversives. When suspicious letters reached Royal Mail sorting offices, they would be picked up by IB security staff and taken to the first floor of the Post Office’s Headquarters in St Martin’s-le-Grand, near St Paul’s Cathedral. Here, technicians would carefully open the letters to photograph the contents. The photographs were passed to government spooks. The letters were carefully re-sealed and dropped back into the system with their intended recipients none the wiser. In addition, whilst the GPO had responsibility for the nation’s phone lines, the Post Office Investigation Branch supplied the security services with phone-taps.

This creepy element to the Post Office’s activities wound down as perceived post-war and cold-war threats to the internal stability of the nation dissipated. In 1969, the office of Postmaster General was abolished and the GPO ceased to exist as a brand, though the Post Office and Royal Mail remained state-owned, with a monopoly on the business of shifting letters from one part of the country to another.

In the latter half of the twentieth century IB went through various reorganisations (first becoming an Investigations Division, then a Department). By the eighties it had largely ceded its external investigative activities to the police and was focusing its attention and resources on the internal activities of Royal Mail, Post Office and Parcelforce staff. There were thousands of people within the Post Office network who came into daily contact with large volumes of mail and tempting wads of notes at sorting offices, cash centres and Post Office branches around the country. They needed to be watched.

By all accounts the Post Office Investigations Department (with more than its fair share of burly ex-coppers), was something of a law unto itself. POID² had the authority to interview staff under caution. As with its historical predecessors, if POID believed a criminal offence had taken place, instead of handing everything over to the police, or the newly-formed Crown Prosecution Service, Post Office investigators passed their evidence to the Post Office’s own in-house prosecutors, who would bring charges directly. In the 1990s the department was renamed POSIS – Post Office Security and Investigation Services – and then, finally, Security Group.

By 2010, when the Post Office’s prosecution frenzy was still in full swing, Royal Mail Group (which had turned the tables on its older sibling and now counted the Post Office as one of its sub-brands) employed 287 investigators and security managers. A five page document informing the public about the activities of RMG Security stated bluntly, ‘Those who steal must expect to be detected and prosecuted.’

The process of calling in the heavies when suspicions were raised about nefarious activities at a Post Office branch varied. In a Crown Office it was relatively straightforward. A branch manager would spot or be informed about suspected criminal activity and refer that information directly to the Security team. Things were a little different when it came to the Post Office’s network of Subpostmasters.

This is because Subpostmasters are not, and never have been, Post Office staff. They are small business owners, acting as agents for the Post Office.

Every Subpostmaster is security-checked before being appointed. They are, as a rule, unlikely to be dishonest. But there are thousands of Subpostmasters, employing tens of thousands of counter assistants. Billions of pounds in cash wash through the Post Office network on a monthly basis. Criminal activity at some level, by someone, is a given. Detecting and stopping it is another matter altogether. Pre-Horizon, once a tranche of cash had been received by a branch from a Post Office cash centre, the Post Office essentially lost sight of it, becoming wholly reliant on the weekly filed accounts to know where it had gone. Close monitoring of what was happening in any one of the Post Office’s 20,000+ branches was impossible. There was no CCTV or electronic data collection. Almost everything was done on trust.

The only way of knowing if a Subpostmaster’s filed accounts had any bearing on reality was by paying them a visit. This was done by the Post Office’s UK-wide squad of ‘auditors’ who would descend on a branch without warning, lock the door and conduct a full stock-take and cash count, with the Subpostmaster present. Auditors chose which branch to visit either at random, on the basis of a tip off, or if someone in Chesterfield had flagged something alarming. If everything was in order, the auditors would leave and the branch could reopen. If a small amount of money was missing, the Subpostmaster would be required to make it good before being allowed to reopen. Some kind of warning might be issued. If a large amount of money was missing, the Subpostmaster would be suspended by their local contract manager and the Security team’s feared investigators would be summoned. It was a rather agricultural approach, but right up until the end of the twentieth century, it was all the Post Office had.

Horizon was going to be the Post Office’s Big Bang. Instead of being in the dark about what was going on in their thousands of branches, every transaction put through every Post Office till in the country would now be recorded and downloaded onto the Post Office’s central servers every night. A window onto the activities of Subpostmasters and their assistants had been opened. The lights had come on.

_______________________________

¹   Established in 1707 with the Acts of Union between Scotland and England.

²   Pronounced ‘pee-oh-eye-dee,’ not ‘poyed.’

ROLLING OUT HORIZON

Sio Lohrasb is a former technical lead at Fujitsu, responsible for the live rollout of Horizon. I found his details on social media and thought it was worth chancing my arm to see if he was willing to be interviewed for this book. Being an amiable chap, he saw no reason why not. It was fascinating to have a lengthy chat with someone who had the job of introducing Horizon to hundreds of Subpostmasters across the country. Unfortunately, due to the coronavirus pandemic, we couldn’t meet in person.

‘I thought Horizon was state of the art,’ Sio told me, when we finally got our Zoom link working. ‘I actually really liked the solution, and the hardware we were delivering was quite high spec. I mean, it didn’t run so well, but that’s because it was being asked to do so much. But it was very forward-thinking.’

It was Sio’s job to help Subpostmasters make sense of Horizon, both as a piece of kit and as a concept. ‘It was really daunting to the older generation,’ Sio told me. ‘Some of them just weren’t ready for it. One guy was selling postcards in his shop, and I said to him, You see all these individual postcards? Each one of these could be a holiday, that you could sell through Horizon. But he couldn’t grasp it. He called it a sledgehammer to crack a nut.’

Sio had a team of installers who would help Subpostmasters switch from paper accounts to touchscreen data entry, working with them to patiently input their existing figures into Horizon, and holding their hands as they came to terms with this brave new world. There were plenty of Subpostmasters who welcomed the arrival of the new IT system, but a few found it genuinely terrifying.

Sio recalled ‘one old dear’ who went to press her new Horizon touchscreen ‘with her finger shaking, bless her. I really felt sorry for her. But we never rushed anybody. We gave her as much time as she needed to make her comfortable and make sure she was all right.’

Even so, Sio admits there was a problem from the start. ‘Yeah, there was incompatibility there with the older generation.’

WHAT IS A SUBPOSTMASTER?

Today, the terms Postmaster and Subpostmaster are used interchangeably. They describe exactly the same job. This is a recent conflation. The role of Head Postmaster, distinct from a Subpostmaster, survived well into the 1980s. In the nineteenth century, there was a clear hierarchical divide between the two. Head Postmasters were regional appointees of the Postmaster General, responsible for the receipt and distribution of the entire mail operation in a given area. Subpostmasters were an altogether less fortunate breed.

Unlike Head Postmasters, Subpostmasters were not employed by the Post Office. Their role attracted no pension, holiday or sick pay. They were self-employed, and on their appointment were expected to install their Post Office counter and telegraph communications fixtures at their own expense. In Queen Victoria’s time, they received no extra allowance for working Sundays – or up to twelve hours on Christmas Day – and often found the cost of running a branch outweighed its income. In short, Postmasters – full time members of Post Office staff – were the haves; Subpostmasters were the have nots.

There was also a not-so-subtle class distinction at work. Within the Post Office, Postmasters were seen and treated as, maybe not quite gentlemen (after all, they worked for a living), but an altogether better sort of person, going about the Queen’s business in service of their country and Empire. Subpostmasters were traders, shopkeepers – lower-middle class sorts opportunistically seeking to improve their social standing by association with a national institution. Subpostmasters were accepted by the Post Office hierarchy on sufferance, mainly because their contribution to a functioning network was essential, but they were never quite trusted or embraced.

In 1896, Joseph Ramms, a stationer living in Wakefield, wrote,

‘I was desirous of the appointment as Subpostmaster, in the belief that to have employment from the Government was a direct road to success in commercial life.’

Ramms’ application succeeded, but he soon discovered it wasn’t everything it was cracked up to be. ‘I was doing the work of a Subpostmaster,’ he wrote, ‘and paying for the privilege, as the working expenses of the office were decidedly more than the income from all sources.’¹

This was not sustainable. In 1897, aggrieved Subpostmasters, led by Ramms, formed a trade association – the National Federation of Subpostmasters. Campaigns, threatened strikes and wider social advances led to some improvements in working conditions, but the lot of a Subpostmaster in the first half of the twentieth century was not a happy one.²

In the 1950s, after substantial lobbying, the government awarded Subpostmasters a series of salary increases. For the first time it was just about possible to make a living. The hours were long, and you had to be a savvy retailer, but there were perks. You had a government stipend, your retail business got plenty of footfall, and as a holder of public office you became a visible and respected pillar of your local community.

Throughout the technological and retail revolutions of the seventies and eighties, branch sub-Post Offices barely changed. So long as their biggest client (the government), kept putting business their way (for example, pensions, tax discs, housing benefit, social security stamps) and as long as that gave the general public an incentive to regularly visit their local Post Office (which it did), a Subpostmaster could make a living. During the latter part of the twentieth century, the National Federation of Subpostmasters seemed to spend a lot of their lobbying efforts resisting initiatives which could take government business away from their members. To run a profitable business, Subpostmasters needed to be the middle man between state and citizen. On many occasions, trading on their central importance to the High Street, they won the argument with both politicians and the public.

Despite this, and despite the official abolition of Head Postmasters at the end of the twentieth century, the Post Office’s cultural snobbery towards, and lack of trust in, their Subpostmasters never quite disappeared.

Whilst Subpostmasters were treated like employees and given some of the benefits employees might enjoy (including a guaranteed salary), the Post Office took the view that, contractually, Subpostmasters were business agents, operating sub-Post Offices as franchises.

This is legally set down in the document which underpins the relationship between a Subpostmaster and the Post Office – the Subpostmasters Contract. It spells out exactly what is expected of a Subpostmaster in return for the privilege of having a sub-Post Office. It is completely non-negotiable.

The contract makes clear the extent to which the office of Subpostmaster is in the gift of the Post Office. Once bestowed, it can be removed for any perceived infraction, or transferred to a more deserving candidate on receipt of three months’ notice. A Subpostmaster is in a position of responsibility, and therefore has to abide by strict rules. The Subpostmasters Contract makes it clear the Post Office has the right to query, audit or investigate a Subpostmaster’s branch at any time.

The most notorious clause in the Subpostmasters Contract is Section 12 (Responsibility for Post Office Stock and Cash), Clause 12 (Losses). It states:

‘The Subpostmaster is responsible for all losses caused through his own negligence, carelessness or error, and also for losses of all kinds caused by his Assistants. Deficiencies due to such losses must be made good without delay.’

The Post Office took this to mean that if a Subpostmaster had a negative discrepancy in their accounts, and could not prove it was not caused by their ‘negligence, carelessness or error’, it was on them. The clause also meant that if a Subpostmaster’s assistant messed up, or looted the safe, it was on the Subpostmaster too. Section 12:12 was designed as a clear contractual incentive to make sure each Subpostmaster ran a tight ship, employed the right assistants and trained them well.

On the day Subpostmasters took control of their branches, it was expected they would sign their contract in situ, along with the Official Secrets Act and several other legally binding documents. The contents of these documents were often a mystery to both the incoming Subpostmaster and the Post Office Contract Manager who proffered them. Subpostmasters often had no idea what they were signing up to and even if they asked, were unlikely to get a sensible answer.

The Subpostmasters who went into business with the Post Office tended to be bright and diligent, proud to work for a national institution with an illustrious history. Before applying to run a branch, many Subpostmasters had successful careers and led innocuous and blameless lives. Some had been police officers, or served in the military. Others were done with being middle-managers in large businesses. Most had built up a modest nest egg and were looking to invest in a solid proposition as their last job before retirement. Another typical group already ran small retail businesses and were looking to invest their savings into a brand which would bring them more visibility and footfall.

You might think anyone who doesn’t read a contract before they sign it is an idiot, but it comes down to how well you understand the risks involved, and the consequences of something going wrong. Downloading an app to your phone might require giving it permission to access your address book, location, camera, microphone, operating system and personal details. This carries a significant risk. But most of us don’t even read the legally binding agreement which comes with the app. We just tick the box without any idea what the app developer intends to do with the access we’ve just granted it.

This is because we think whatever could happen, won’t happen to us. Or even if it does, the outcome won’t be catastrophic, because we can probably rely on some kind of unspecified legislation to protect us.

A few years ago, a BBC colleague of mine asked Geoffrey Sturgess, a laconic and worldly-wise franchise lawyer, to review the Subpostmasters Contract for a TV piece we were making. Geoffrey had a good read of it before stating on camera it was ‘unfair.’ He caveated this by saying that being unfair is par for the course with this type of contract. ‘What’s unusual,’ he noted, ‘is the really unfair way in which the Post Office enforces it.’

Pre-Horizon, the Subpostmaster/Post Office relationship worked on a combination of trust, the threat of penalties and the expectation of mutual benefit. Subpostmasters had to keep tabs on the cash that came into and went out of their branches. They filled in their own accounts, signed them and sent them to the Post Office for examination. There are strong disincentives to filing false accounts. It is a criminal offence.

Horizon, when it came, subtly adjusted the dynamic between the Post Office and Subpostmaster by inserting a third party into it. Horizon didn’t just combine a branch’s till transactions and accounts, it took control of them. This was not acknowledged by the Post Office. Certainly, the Subpostmasters Contract was not redrawn to reflect it. The 152-page version I have from 2002 (which is the 1994 version with a lot of extra rules front-loaded onto it) acknowledges Horizon only in passing.³

_______________________________

¹   ‘100 years of proud history 1897–1997’ – The National Federation of Subpostmasters.

²   It has also come full circle – in 2019, the Post Office’s interim CEO Alisdair Cameron admitted to MPs that cuts to income and the removal of salaries meant it was no longer possible to make a living from running a Post Office. ‘We are very clear and we have been clear for years that standalone Post Offices are not usually financially viable. It needs that retail support.’ With staff costs (borne by a Subpostmaster) factored in, a Post Office counter is nowadays loss-making, but it gives the gift of footfall to a retail premises.

³   Twice in the context of linking it to an ISDN line, and twice in terms of giving assistants their own Horizon login.

TRACY IS SENT TO PRISON

The Post Office’s investigators seemed fascinated by Tracy Felstead’s family holiday. ‘They said, Did you pay for everybody to go? ’ she remembers.

Tracy’s mum and dad got involved. ‘We said, Right, you can have access to everybody’s bank accounts so you can see exactly how people have paid for the holiday and where the money’s come from. ’

The investigators were not satisfied.

Three weeks later, at the end of April 2001, Tracy was sacked. She was charged by the Post Office’s criminal prosecutors with theft and false accounting ‘because my signature was on the paperwork.’

Tracy’s solicitor was unamused. The Post Office investigators had no evidence of theft. The prosecution didn’t make sense.

Although Tracy was devastated, she remembers thinking things would work out. The Post Office would realise its mistake and drop the charges, or if the worst happened, the justice system would allow her to prove her innocence.

Word of the prosecution leaked into the local community. Tracy found herself the victim of a whispering campaign.

‘Family friends, like the guy who got me the job – his family refused to talk to me. They just totally ignored me. And I had people looking at me as if I was a thief. You know – "She’s done this." ’

Tracy’s self-belief began to crumble alarmingly quickly.

‘The only way to explain it is that you’re in a black hole. You feel trapped … suffocated. I couldn’t understand how anyone could think I would steal anything. My mental health, my whole life took a hit. I was a bubbly girl. I would go out. I had a decent life, I enjoyed life. And then all of a sudden … I didn’t want to go out.’

Things escalated. ‘Because I had time on my hands, because I wasn’t working, because I’d been dismissed, I got stuck in a rut. The more I was indoors and the more my mind wasn’t occupied, the more frantic I became.’

Tracy went to see her GP, who prescribed Prozac anti-depressants. They didn’t work. Over the summer of 2001, Tracy tried to kill herself.

‘I didn’t want to have to answer questions I couldn’t answer. I didn’t want people to see me. I didn’t want to go to court. The stigma was very strong. I didn’t want to feel like that. I wanted me back. I wanted to be me again and I didn’t feel I was me. I just wanted to die.’

Tracy took an overdose in her room. She was found by a friend while she was still conscious and rushed to hospital, where she had her stomach pumped.

A few weeks later Tracy took another overdose. ‘I thought I can’t deal with this anymore. I can’t cope. I just didn’t want to be alive. I didn’t want to feel the pain.’

Alone in the house, Tracy slipped out of consciousness. By luck, her fiancé Jon came home early from work and found her. She was rescued by the emergency services again. This time she was not sent home but committed to a secure psychiatric unit at the Princess Royal Hospital in Bromley.

Tracy was given intensive psychotherapy treatment and responded well, but once she was out, she had to deal with the reality of being prosecuted.