This is the unperfected transcript of proceedings on Day 19 of the Horizon High Court trial, part of the Bates and others v Post Office group litigation.
Today was the second day of Dr Robert Worden's cross-examination. Dr Worden is the independent IT expert contracted by the Post Office to look into the Horizon issues.
Transcript follows:
Thursday, 13th June 2019
(10.30 am)
DR WORDEN (continued)
Cross-examination by Mr Green (continued)
MR DE GARR ROBINSON: My Lord, housekeeping. Bundle of
PEAKs and KELs referred to during Mr Coyne's
cross-examination with, I believe, an index. Could
I hand that up to your Lordship?
MR JUSTICE FRASER: Of course. Thank you very much.
(Handed)
So that's those referred to last week.
MR DE GARR ROBINSON: Last week.
MR JUSTICE FRASER: The one that I handed back, which was
referred to in the evidence of fact, what's happening
with that?
MR DE GARR ROBINSON: My Lord, that was handed up I think to
your clerk at close of business on Tuesday. So you
should have that.
MR JUSTICE FRASER: I see, yes.
MR DE GARR ROBINSON: My instructing solicitors went through
it and put in a proper index.
MR JUSTICE FRASER: You are right --
MR DE GARR ROBINSON: So you should now have --
MR JUSTICE FRASER: So I have now apart from this week,
which one wouldn't necessarily expect. That's very
helpful. Thank you very much.
MR GREEN: My Lord. Just one very quick point before we
resume, if we may. There was a letter that I think may
have been copied to the court sent by Wombles yesterday
about the status of the recently disclosed documents
which include information from the MSC spreadsheets
which were disclosed on 21 December.
MR JUSTICE FRASER: Yes.
MR GREEN: And what is being said there is that from the
email that I sent the court --
MR JUSTICE FRASER: Well, I have read the email and I have
read the letter.
MR GREEN: I'm most grateful.
MR JUSTICE FRASER: Do we need to pursue this now rather
than at the end of the day, given we have Dr Worden
there, or do you want to --
MR GREEN: I'm happy to do it at the end of the day.
MR JUSTICE FRASER: If it is not going to affect what
happens during today, I think the best thing, if you
have any points arising on that, we will revert to it at
the end of the day. Let's get on with the
cross-examination of the witness.
MR GREEN: I'm most grateful.
MR JUSTICE FRASER: All right.
MR GREEN: Dr Worden, could we look first please at {C1/1/1}
which is the Common Issues.
A. The Horizon Issues, right.
Q. Sorry, the Horizon Issues, I do beg your pardon. The
Horizon Issues agreed list.
A. Sorry, could I just put in one thing first? I would
like at some stage, at your convenience, at any time, to
make two corrections to the evidence I gave on Tuesday.
MR GREEN: My Lord, is it convenient to do that now?
MR JUSTICE FRASER: I would have thought it is quite
important to probably deal with them first.
A. Right. The corrections are concerned with the issue of
claimant branch sizes, which if you remember we spent
some time on, and there are two points in which, looking
back at my evidence, I think it needs to be corrected or
improved. Those points are in the transcript at
pages 183 and 181 {Day18/181:1}. You will recall that
at the time I said I was not very clear about what I had
done because the history is, as you well know, that
I addressed the issue of claimant branch sizes both in
my first report and in my supplemental report and the
calculation of claimant branch sizes for my first report
was done about nine months ago, and for my supplemental
report, I have looked it up, and the calculations were
done six months ago. And I will admit, I had not gone
back and refreshed my memory about these before Tuesday
but obviously I did so yesterday.
There are two issues on which I would like to
correct my evidence. One is the factor 1.7 where, as
you recall, we were discussing the distinction
between -- what are they called -- customer sessions and
transactions, and I mentioned I was uncertain about this
factor 1.7. And I shouldn't really have mentioned that
because the uncertainty I had about the factor 1.7 was
some time earlier than my first report, and by the time
of my first report I had satisfied myself in my mind
what the factor 1.7 was and it has nothing to do with
the distinction between transactions and customer
sessions.
Now, my opinion at the time of my first report was,
and it is now, that there are three terms in use. There
are customer sessions, there are transactions and there
are baskets, and my opinion is they all refer to the
same thing. And particularly if you look at all the
stuff there is about recoverable transactions and
cancellable transactions, it becomes quite clear to me
that a customer session is the same thing as
a transaction.
Now, the figure 1.7 was a figure I had come across
earlier in a document which I think is TD Arc 0039, and
I think it is called Horizon Architecture Summary, or
something. We could go to that. But the reference to
that is 1.7 is the average number of products which
a customer buys in a basket and we could find that
reference if you like.
MR JUSTICE FRASER: So the first correction is the 1.7 that
you referred to on Tuesday is the average number of
products which a customer buys in a basket.
A. Yes, it is nothing to do -- and I believe that customer
session and transaction is the same thing. So that is
the first correction.
MR JUSTICE FRASER: And the second correction?
A. The second correction is a sort of history one, that
Mr Green took me to the Angela Van Den Bogard
spreadsheet and pointed out that there are only I think
496 lines in the spreadsheet whereas there are 561
claimants, and so this would make a difference of
approximately factor 10 -- 10%, sorry, a difference of
10% approximately to the answer.
Now what I would like to clarify there is that in my
first report I did make a mistake. I did not take
account of the fact that there were only 496 lines in
the spreadsheet but there are 561 claimants. Now,
I have since gone back and looked at the calculation
which I made on December 28th, I got the spreadsheet for
the supplemental report, and it is evident from that
spreadsheet that I did the summation of the number of --
it is a different calculation because it is three
different years and it is done differently and so on,
but it is evident from the spreadsheet that for each of
those years I actually did the sum of the number of rows
in the spreadsheet, so I corrected that error.
So the result was that while I thought the
difference, the change in my answer from 0.37 to 0.45,
which is a 21% change, I think, while I thought that
change arose from my change of method, in fact it arose
partly from my correcting that error.
MR JUSTICE FRASER: Right, Mr Green.
MR GREEN: Well, we may have to come back to some of those
points.
A. Absolutely yes.
Q. Let's start with a simple one. You are saying now that
you have reflected overnight on what was put to you
yesterday about the difference between transactions and
sessions?
MR JUSTICE FRASER: Tuesday.
Q. Sorry, yes, on Tuesday, about the difference between
transactions and sessions, that they are the same?
A. I believe and I believed at the time of my first report
that they are the same, yes.
Q. And the problem with thinking something that's
completely wrong is that it undermines the basis of any
calculations that you thereafter make on that basis, in
theory, if you were wrong?
A. I had an uncertainty in my mind well before my first
report. What I'm saying to the court is that by the
time of my first report that uncertainty was cleared up
and is my current opinion.
Q. I'm struggling slightly, Dr Worden, to make sense of
this.
Can you tell the court now whether you enquired into
that difference specifically and found out the answer
with confidence before you gave evidence today -- before
you gave evidence on Tuesday?
A. When I gave evidence on Tuesday I had done those
calculations nine months before, I hadn't gone back and
revised it, and I said in court that my memory was
unclear of the time order.
Q. No, no. I'm talking about the distinction between
sessions of transactions.
A. Yes.
Q. Now, had you, before you came to court on Tuesday, at
any time satisfied yourself of the distinction between
transactions and sessions and found there was none?
A. Yes, before my first report.
Q. Before your first report?
A. Yes.
Q. And how did you do that?
A. Well, I considered the nature of recoverable
transactions and cancellable transactions, which in my
mind addresses all the cases.
Q. Well, that came up in the case of Mrs Burke, didn't it?
A. It comes up in all sorts of places. It is a very
important issue of the trial.
Q. Yes, and so a proper understanding of that issue and
whether or not a transaction is the same as a session
would be necessary to any properly formed opinion about
the problem, wouldn't it?
A. No. Proper understanding of a transaction is necessary
for understanding of recoverable transactions and
cancellable transactions. On that basis, I concluded
before my first report that a transaction and a customer
session are the same thing.
Q. So why would there be this reference to 1.7 in
a document that you had previously seen but hadn't
mentioned before Tuesday?
A. Because my memory was confused and I recall that at some
time in the past I had been concerned about this figure
of 1.7, and not having gone back and recalled the
history of my calculations of customer branch size
I mistakenly associated the factor 1.7 with this issue,
and that was my mistake in evidence which I have
corrected.
Q. Okay. Let's look at {F/1461/1}, please. The F bundle
takes a moment to load so it will come up in a second.
(Pause)
This is a receipt in Mrs Burke's case.
A. Yes.
Q. You will see about halfway down the receipt,
"Disconnected session", do you see that?
A. Yes.
Q. In capitals?
A. Where are we?
Q. Halfway down, "Disconnected session". Do you see that?
A. This is a disconnected session receipt, yes.
Q. Then it says:
"Do not attempt to reverse any transaction from this
session."
A. Yes.
Q. They are not the same?
A. The word "transaction" gets used in lots of ways and
obviously here a transaction means a part of what
a customer did, and that's a different sense of
transaction from recoverable transaction which is
a whole thing. This is a recoverable transaction that
had to be recovered.
Q. Not the same?
A. No, there are different uses of the words "transaction".
There is the technical use in terms of computer systems,
there is the use in terms of Horizon, and there is
probably the use that subpostmasters have. But it is my
opinion that a transaction as recorded on Horizon -- it
is my opinion that statistics on customer sessions are
recorded on Horizon and they are synonymous with
transactions, Horizon transactions.
Q. You got the statistics for the number of transactions
from Angela Van Den Bogard's witness statement, didn't
you?
A. From various places. I think there are various
documents which also have transaction volumes in them.
Q. But you took -- you said it was in her second witness
statement, it was actually in her first.
A. For the claimants' branches I got them from her witness
statements. For the mass of branches I got them from
various places.
Q. That is not right actually. You say you took the
figure, the 48 million -- we went through this on
Tuesday -- from Angela Van Den Bogard's witness
statement and note Mr Coyne used the same figure. On
Tuesday I put to you that actually it is her first
witness statement, it is 47 million, and Mr Coyne says
47 million. That's what I put to you on Tuesday. Do
you accept that?
A. I remember that distinction --
Q. Right. Let's look at Angela Van Den Bogard's second
witness statement at paragraph 14.2 at page {E2/5/4}, I
think.
MR JUSTICE FRASER: Which paragraph?
MR GREEN: 14.2.
MR JUSTICE FRASER: I think it does start on page {E2/5/4}.
MR GREEN: I'm most grateful. You can see there, halfway
down, on the left-hand side:
"If there is a payment due to or from the
customer --"
A. Sorry, I haven't got there yet.
Q. About halfway down on the left-hand margin:
"If there is a payment --"
A. Sorry, I just haven't found it. Ah, right down at the
bottom. Halfway down the last paragraph. I was looking
halfway down the page.
MR JUSTICE FRASER: I think, Dr Worden, if you look at
paragraph 14.2 and count down six lines from the top of
that paragraph.
A. Yes, I have got it now. Thank you.
MR GREEN: You will find the words:
"If there is a payment due to or from the customer,
the session (ie the transaction or transactions sitting
in the stack that have not been completed) is settled to
cash and a receipt is automatically printed."
A. Yes.
Q. That is the witness from whom you took the figure for
the number of transactions, isn't it?
A. I took from her spreadsheet, yes. As I say, there are
various uses of the word "transaction" in currency and
I felt that the only thing that could be automatically
measured by Horizon was the number of transactions which
are the same as customer sessions. Now if I'm mistaken
about that, I was mistaken at the time of my first
witness statement, but I still -- it is still my opinion
that a transaction and a customer session, particularly
from the definitions of recoverable transaction.
A recoverable transaction consists of a customer session
in which all these things happen, and then it goes wrong
when some contact has been made with the bank, and the
whole recoverable transaction has to be recovered. And
that's the sense in which I think a transaction is the
same as a customer session.
Q. Dr Worden, I'm going to suggest to you that you were
embarrassed at what we saw on Tuesday and what you have
just come up with this morning is an answer of
convenience to cover up your embarrassment?
A. That's not the case.
Q. We will return to some of the other points later on that
you have canvassed this morning but for present purposes
can we start again at {C1/1/1}, please.
A. Yes.
Q. Now, Issue 1(b) on the Horizon Issues --
A. 1(b) yes.
Q. Yes?
A. Mm.
Q. Is:
"The extent to which it was possible or likely for
bug, error or defects ... to have the potential to (b)
undermine the reliability of Horizon accurately to
process and to record transactions ..."
Yes?
A. Yes.
Q. And you chose to answer Issue 1(b) separately in your
reports?
A. That is right. It is some subsection of 8.
Q. If we look at paragraph 574, please, at {D3/1/138}.
A. It is worth my getting this one out. 574? Oh.
Q. On page 138.
A. Part (b), yes.
Q. Do you have 574 there, Dr Worden?
A. I have it there, yes.
Q. I'm really taking you to this just to be fair to you, to
re-orient you in your report where you dealt with it.
Okay?
A. Mm.
Q. So 574 is your summary where you say:
" ... the Horizon core audit process was designed to
create a secure, accurate and immutable record of what
was entered into Horizon at the branch, and to record
verifiably who entered it."
Yes?
A. Yes.
Q. "In my opinion, regardless of any other processing done
in other parts of Horizon, the core audit database was
an accurate record of transactions entered in the
branch. It was carefully designed, and I have seen no
evidence that it ever failed in service. Therefore in
any case of doubt about processing done in other parts
of Horizon, this record was available to establish the
true state of any branch accounts, based on transactions
entered in the branch."
Yes?
A. Yes.
Q. And that's the substance. Then you deal with it as
being a highly reliable record at page {D3/1/191},
paragraphs 848 to 850.
A. Sorry, are we coming to that? Yes. Okay. Part (b)
again. Right.
(Reads to self)
Right.
Q. Yes? And you explain that we actually have to go back
to two different parts of the report from there, at 849?
A. Sorry, can I get to that?
Q. Yes. We are looking at it.
A. In 4.4 and 6.2.6 I describe the audit system, right.
Q. Yes? You say "highly reliable record of transactions
entered" into the branch, yes?
A. Yes.
Q. And that's your robustness countermeasure of secure
kernel hardware?
A. Yes, and we talk about the secure chain of
communication.
Q. Indeed. Okay? Then from there to get to 4.4 we go to
pages 45 to 48 {D3/1/45}.
A. So we've got more about the audit database here.
Q. Exactly. And it is 173 to 179.
A. 179? Right, okay.
Q. Can we pause on that -- sorry, my fault entirely --
A. So they are the pictures. Yes, okay.
Q. But just pausing there, we see again the phrase in the
second line of 173, "an accurate and immutable record",
don't we?
A. Yes.
Q. Yes. And then we -- "of any activity which can affect
the branch accounts"?
A. Yes.
Q. And then at section 6.2.6, which is on page {D3/1/73},
paragraphs 267 to 271 is where you deal with it again.
A. Again.
Q. Just to trace through. I would like you to look,
please, if you would, at paragraph 270.
A. 270. Yes, okay.
Q. It is over the page on page {D3/1/74}.
A. "... KELs indicates that use of the audit database was a
backstop, and rarely used ..."
Yes.
Q. Now, you have drawn an inference there about the reason
for not using the audit database?
A. Yes.
Q. That's actually a matter in dispute between the parties,
isn't it?
A. Well, Mr Coyne suggested the audit database should have
been used more and differently and that is a difference
between the experts, yes.
Q. But when Mr Coyne suggested that, it was positively put
to him that it was quite expensive and labour intensive
as a justification for not using it?
A. Not using it for every TC, I believe that is
a justification, yes, but every TC and every bug is
a different matter.
Q. Let's look at Day 15 of the transcript, if we may,
please, {Day 15/71:21}.
A. Page?
Q. We are looking at page 71, line 21.
A. "... labour intensive ... expensive ..."
He says he can't imagine why it would be labour
intensive.
Q. Do you remember listening to that?
A. Yes, I think I can --
Q. We can see on the same screen at the bottom of 73:
"Question: And the charge that's made over the
allowance of 720 a year, it is over £200, are you aware
of that?"
Do you remember --
A. Yes, I've always been aware of this figure in the
ballpark of £250, yes.
Q. So the figure you have always had in mind is £250?
A. Something like that.
Q. In that ballpark.
Let's pause there. It seems that -- it appears to
be agreed that the allowance for ARQ requests was 720
a year?
A. I don't recall a precise figure but I am sure you are
right.
Q. I can just show you quickly, {E2/8/4}. That's the
witness statement of Ms Mather at {E2/8/4}. You will
see at paragraph 19 -- yes?
A. Yes, number of ARQs.
Q. She says that she has spoken to a colleague called
Christopher Knight who has confirmed that Post Office
gets an allowance of 720 data queries a year, yes?
A. Yes.
Q. "He is not aware of any fees or penalties having been
paid by Post office, nor anyone being deterred from
making ARQ requests because of fees that might have to
be paid ..."
Just focusing on the number at the moment.
A. Yes.
Q. 720 appears to be right. Let's look please at
{F/1092/1}. You can see underneath "Financial Benefits"
the second point:
"ARQ ... retrieval process ..."
A. Yes.
Q. And you can see 720 requests there, can't you?
A. This is subsumed without breakdown.
Q. Yes. But you can also see there that the figure that's
referred to there is £450 --
A. Yes.
Q. -- per unit, can't you?
A. Yes. Well, I think it's the division gives that answer.
Is that right?
Q. Well, let's take it in stages. What was put to Mr Coyne
without any document or any particular basis was the
figure was over £200?
A. Well, I think -- I would imagine there are two different
figures. In other words, there is a bulk price for your
first 720 and that works out. You have paid that
already and you can get 720 for that, and so the average
of those is that much. Then if you go beyond that, for
each one you pay a different figure.
Q. And you think the £200 is the extras?
A. I suspect so, yes. But there are those two figures and
I haven't really gone into the detail of that because
250/450, you know, it doesn't seem to me hugely to
influence my opinion --
Q. It is just a bit more than double, isn't it?
A. Yes.
Q. And that's not an order of magnitude that would bother
you from an engineering perspective --
A. -- it's not a thing that feeds into any of the numbers
I have tried to calculate really.
Q. But it might feed into whether or not cost was
a disincentive to seek ARQ requests?
A. Well, as I say, the issue Mr Coyne raised was seeking
ARQs for every TC, in other words 100,000 a year, and
that's rather different from seeking evidence for
a suspected buyer.
Q. Well, what about -- if we just focus at the moment on
looking at ARQ data where in every case the
subpostmaster queries the transaction.
A. Yes.
Q. If the cost was half, you would be able to get twice as
many, wouldn't you, for the same amount?
A. For the same budget, if you choose the same budget on
that, yes.
Q. Yes. So it makes a bit of a difference?
A. Yes, I agree it does.
Q. And --
A. But as I say, my impression is ARQ, you know, is
a backstop basically. And normally one can investigate
these issues without going to ARQs and one can arrive at
a position of understanding what happened without going
to the ARQ because MISs are designed to do that.
Q. Let's take it in stages, if we may. Just eyeballing the
figure of 384,000 and dividing by 720, that's actually
about £533, isn't it?
A. Oh really? Right, yes, okay.
Q. And what was put to Mr Coyne was it was over £200?
A. Mm.
Q. Would you say that's consistent with it being 450 or
533?
A. Well, it is consistent -- consistent to me means not
contradictory --
Q. Yes, so it is consistent?
A. And that's consistent, yes.
Q. So it is literally consistent but quite misleading for
purposes of trying to work out whether it is
a disincentive, isn't it?
A. I'm not sure who is misled.
Q. I'm just saying if someone is saying cost is a
disincentive because you are charging over £200, it
doesn't really tell the whole story if the true price is
450, 436 or 533, does it?
A. But the 450 was paid upfront so, you know, however many
you go towards your 720, it doesn't make a difference
what Post Office paid, so it wasn't a disincentive for
them.
Q. Dr Worden, you are making it up as you're going along.
A. I'm not. I'm answering your questions as you put them
to me.
Q. The true answer is you have no ideas about these figures
and you're guessing what they might be.
A. No, I'm not. I'm answering your questions.
Q. You don't know any of this.
A. I'm trying to answer your questions --
Q. I understand --
A. -- on an issue I have not looked at in great depth.
Q. That's rather the point. I'm not disputing you are
trying to answer the questions, I'm putting to you that
you have no foundation for doing so. Do you agree with?
A. My knowledge of the price of ARQs is not very precise
because I haven't focused on them in my -- that price in
my reports. So I'm trying to do the best I can to
answer your questions.
Q. It is perfectly okay to say "I have no idea about that".
A. That wouldn't be true.
Q. Then what idea do you have?
A. I have an idea that I have seen some of these figures
and I know it is in the ballpark of £250/£300 --
Q. Yes, but let's focus on a particular thing that you have
given evidence about. You say there is a distinction
between the ones you get all paid for in advance, which
you were saying would be the £200 price, £200 a unit?
A. No, the ones you get more for in advance are the £450 --
Q. Sorry, quite right. And you say you pay £200 for the
additional ones?
A. That's been my understanding, yes.
Q. Where do you get the £200 for the additional ones from?
A. I can't recall exactly. My understanding of these
things builds up from all sorts of documents I read and
I can't, I'm afraid, always point to say: this document
is where I got it.
Q. Well, I'm positively putting to you, Dr Worden, that you
are giving answers that you think are consistent with
what has been put as part of Post Office's case rather
than from any actual facts you have?
A. That is not true.
MR JUSTICE FRASER: I'm going to ask a question to clear it
up and then I'll ask Mr Green to move on.
In the last couple of minutes you have mentioned
a number of different prices and I just want all costs.
I think you said £200 and at one point you said ballpark
£250 to £300. Do you know how much the requests in fact
cost?
A. I don't know in detail. The figure I have always had in
mind is ballpark 250.
MR JUSTICE FRASER: Mr Green.
MR GREEN: If we look please at {F/994.1/2}, this is
an email which is at or about the same time as the 2012
document we were looking at a moment ago.
A. Right.
Q. And you will see on that second page, if you come
two-thirds of the way down, do you see "Monthly
Reporting"?
A. Yes, I see that paragraph.
Q. Okay. Just below that:
"We have always worked on the belief that a single
ARQ costs now about £450 each ..."
Do you see that?
A. Yes.
Q. Just pausing there. The first point is that
an organisation is going to take its decisions based on
the beliefs it has whether they are right or not, aren't
they? If everyone believes it costs about £450 --
A. That seems to have been the consensus view amongst
various people in Post Office, I'm not sure what
population of people it is.
Q. Okay. This is what is said by Mr Laycock here. He
says:
"... in that I have costs from 2004 that identified
an uplift of an additional 390 at a cost of £170,000."
A. Yes.
Q. "This indicates a large unit cost of £436 per
enquiry ..."
A. I take it that the division works.
Q. It does, I think it is 435.8.
"So the cost we have assumed now to be in the region
of £450 ..."
And then:
" ... although Sue has stated 'there is provision in
the contract to increase the maximum number of queries
and if we do so the charge would be £207 per query.'"
So if they were to change the contract they would be
able to get additional ARQs much more cheaply?
A. Yes, this is sort of buy more get a discount.
Q. So would you accept, first of all, that this appears to
be the position that they were working on?
A. Yes. I mean this is a snapshot of what they thought at
a certain time.
Q. Right. Let's go, please, if we may, now to {F/728/1}.
This begins at the back of this change. This relates
to --
A. This is 2010. What was the last one?
Q. 2012?
A. So this is a bit earlier.
Q. This is a bit earlier. This begins at the back of the
chain. I will take you, if I may, to the last actual
text which is on page {F/728/12}, other than
Michele Graves' name and contact details.
A. So this is at the bottom. It starts with the first or
the last in the chain, sorry?
Q. Now, do you see the second paragraph of the "Hi Lin"
email?
A. Sorry, could I ask, this is an email chain where the
first email is at the bottom?
Q. Yes, it is.
A. Right, okay.
Q. The second paragraph under "Hi Lin" at the bottom:
"Moving forward, can you confirm what your next
steps are re the points she has raised. I know you are
waiting for the audit trail of the transaction events.
Re the comment about the two auditor visits monitoring
her work and apparently also having a problem with the
figures, are you obtaining a report from the auditor? If
this escalates we will need to answer the apparent
discrepancies in the figures on his laptop & horizon."
A. Yes.
Q. Pausing there, that's a reference to the fact that the
auditor had figures on his laptop that he had worked out
that were different from the ones on Horizon?
A. Yes, and presumably he had done this by making a visit.
Q. Yes.
A. Right. Okay.
Q. So there is a discrepancy between the figures the
auditor thinks Horizon should show and what's on
Horizon.
A. Yes.
Q. And they are asking about whether they are getting
a report. If we go up to the email above --
A. "I have changed it slightly."
Do you know what "it" is?
Q. Let's just focus on the next paragraph:
"In terms of the points raised we do have a report
from the auditor but it is probably not detailed enough
to cover all the points, so we will probably need to go
back on this as part of the contractual case. In terms
of the audit trail via Horizon we are waiting for Mark
Dinsdale to authorise the case as he holds the budget.
"Nigel has today referred the case to Jason Collins
requesting their involvement given the level of losses -
I will forward e-mail separately. Need to see where this
gets us before we can move the case forward or start to
answer her detailed questions."
A. Yes.
Q. So you can see the genesis of this.
A. Okay.
Q. So this is a classic case where the ARQ data might well
be helpful, isn't it?
A. It looks like it. It looks they are considering getting
the ARQ data, yes.
Q. And it is particularly acute, the need for the ARQ data
here, because you have got the subpostmaster asking
detailed questions and challenging what's being shown.
You have got an auditor with figures that he says should
be on the system?
A. Yes.
Q. And those are differing from Horizon?
A. Let me check --
Q. That's the premise of this enquiry?
A. The differing from Horizon, yes, that was in some
previous paragraph.
Q. Yes exactly, just setting the stage. So this is
a particularly important example of when you might wish
to seek ARQ data to resolve what's happened?
A. It sounds like it, yes.
Q. That's reflected on page {F/728/11}, if we go back to
that.
A. Yes. We are on 12 now. Go to 11. Yes.
Q. "Thanks Lin:
"Have made suggested changes & sent:
"If we can encourage Mark Dinsdale to authorise the
audit trail, I feel it would be beneficial given the
current interest in Horizon from media & MP's."
A. Right.
Q. Now, was it your impression when you drew the inference
in your report that they would get the audit data if
they needed it? Was it your impression that they would
be tipped over the edge into trying to get it if there
was media interest or interest from MPs?
A. I wasn't concerned with that.
Q. No?
MR JUSTICE FRASER: I think he answered two questions
together there, Mr Green. I wonder if you could put
them separately.
MR GREEN: I'm grateful.
Dr Worden, did you think that Post Office would only
think about getting ARQ data because of interest from
media and MPs when you were looking at the inference you
drew?
A. Which inference?
Q. The inference that the reason they didn't get ARQ data
was because they had every other information source they
needed?
A. Well, we must distinguish between -- what I was mainly
looking at was investigating potential bugs and
mysteries, and that is a mixture of Post Office and
Fujitsu. I was certainly not concerned with Post Office
business decisions about whether media attention or
political attention made it more important or not.
I was not concerned with that.
Q. Because here, Mrs Stubbs' case, not only have we got the
problem itself, militating in favour of getting ARQ
data, but on top of that we have got an extra layer that
they seem to be giving weight to on the face of that of
current interest in Horizon from media and MPs, haven't
we?
A. Yes.
Q. So that is a further reason for them to be apparently
motivated to get it. Let's go, please, now forward to
page {F/728/9}.
A. Right, we are moving back, so this is --
Q. There is an email from Mark Dinsdale, do you see that?
A. Right, and he says it'll take three weeks, yes.
Q. That's not really the point, is it, because if we read
on it says:
"Has Jason agreed to take this case on, because we
don't hand over Horizon logs to a spmr."
A. Where are we?
Q. Just after "3 weeks" where you stopped reading.
A. Yes, he says that.
Q. Why would they not give Horizon logs to a SPM who was
concerned about discrepancies in their branch?
A. I don't know. I haven't looked at it.
Q. "It needs an expert to understand what it says, and
usually this requires one of the investigators."
A. Yes, um --
Q. "I'll give Jason a call in the morning ..."
I will just read it to you and then ask you
questions, if I may?
A. Yes.
Q. "... then I will raise an ARQ from Fujitsu."
Then he says this:
"Is this for our benefit, as there is a cost
attached to ARQ requests, we do get a supply free of
charge as part of the contract but we usually don't have
enough, therefore we usually charge the defence
lawyers."
A. Yes.
Q. Cost was a disincentive for Post Office based on this
email, wasn't it?
A. Well, I mean on this email they are saying we charge the
defence lawyers, so it is not actually a cost for them,
but I have to read this email carefully to answer that
question.
MR DE GARR ROBINSON: My Lord, I do rise to ask whether this
line of cross-examination is productive with this
witness? He is an expert giving evidence about the
operation of the Horizon system, and my learned friend
wishes to put a story to him, but isn't this a matter
best left for submissions rather than taking time up in
cross-examination?
MR JUSTICE FRASER: Well, as you know from last week I am
relaxed about how counsel uses their time, but you are
correct, that last question was in fact submission
because it was asked about the thought processes within
the Post Office.
So Mr Green, if you would like to put the point
based on this expert's view of cost incentive or
disincentive. And the point, as Mr de Garr Robinson
says, effectively boils down to one of submission, so
I would not necessarily spend very long on it, but as
you found out last week I will let both of you during
your cross-examination spend as long as you want on any
points you might think are useful to each of you.
MR GREEN: I'm grateful.
You didn't consider this before you formed the view
that you have expressed in your report, did you?
A. No, because -- I didn't consider it -- I didn't see this
email chain before I formed my view.
Q. You accept that what you have seen here would be
relevant to forming the inference that you have
expressed in your report, wouldn't it?
MR DE GARR ROBINSON: Which inference? Could you --
MR GREEN: The inference which was the beginning of this bit
of the cross-examination about the reason for not
looking at ARQ data.
A. Can we go to that inference? That was that MISs were
normally sufficient for the purpose, I think.
Q. Right.
A. And what did I say in my report that we are referring
to?
Q. Let's look back. Paragraph 270 on page {D3/1/74}.
A. 270:
"... audit database was a backstop, and rarely used
..."
Yes.
"... other comparisons of data were usually
sufficient to diagnose the problem."
That was my inference, yes.
Q. And I positively put to you that was an inference you
drew, yes?
A. Yes.
Q. And you drew the inference about the reason for not
looking at the audit database?
A. That was a technical inference based on quality of data.
Q. I'm going to suggest to you, Dr Worden, that you and
Mr Coyne found that the audit data was very rarely
referred to. That's agreed?
A. I think so, yes.
Q. And you felt the need to explain that away, and that's
why you said there that it was:
"... because other comparisons of data were usually
sufficient to diagnose the problem."
A. I would not put it as explain away. I was trying to put
in context the way audit data was used and I felt that
was part of the description.
Q. Having seen the documents I have just put to you, do you
accept that the cost of these was a disincentive to
Post Office using the ARQ data which you should have had
regard to, or now do accept you will have regard to, in
relation to that issue?
A. My view has always been that in the context of TCs, the
cost of retrieving ARQ data would be a disincentive
because they need 100,000 TCs a year and it would have
been prohibited.
Q. I'm asking you about what I have shown you and I have
given you the example of Mrs Stubbs, who was not dealing
with TCs, she was dealing with problems with her branch
accounts, and I have shown you the other documents.
Last chance. Do you accept that it appears on the
face of these documents for the purpose of any such
inference that cost was a material disincentive?
A. It appears from these documents it was, yes.
Q. Thank you.
Now, we had disclosed on the Tuesday before the
trial started some further ARQ data, that's 28th May,
which was described as going back to 2004. There is
a year missing from that which is still being pursued,
so I may have to come back to that with you, Dr Worden.
But you hadn't looked yourself at the number of ARQ
requests made in any particular year, had you?
A. No.
Q. You heard Mr Coyne's evidence about system design,
didn't you?
A. Yes.
Q. And just stepping back for a moment, it seems that
Fujitsu had negotiated for themselves a contract where
Post Office couldn't actually see the data in the audit
store or read it in real time. That is correct?
A. The audit store, yes.
Q. It could not be read in real time?
A. That is right, not designed --
Q. And that was the arrangement?
A. Well, that was the business requirement that apparently
Fujitsu and Post Office had agreed.
Q. That's what they agreed. And I think we saw in the
Peter Laycock email we went to earlier, I didn't point
it out to you, but they were paying about £11 million
a year for their data centre and ARQ service and it was
from that budget that the ALQs were provided.
Nonetheless there was a limited number of requests they
could make and they had to pay about £450 or so they
thought. So that is where we got to, yes?
The matter that was being put to Mr Coyne was that
it was expensive and therefore it was reasonable not to
do it. That's a consequence of the way the relationship
has been designed and what they have agreed, isn't it?
A. Well, to my mind it is the consequence of the fact that
there are 100,000 TCs a year --
Q. I'm not talking about doing it to every TC, I'm just
talking about whether you have access to read the audit
data, and I'm saying what we have established was the
position, you would fairly accept, of the consequence of
the way the arrangement had been set up between
Post Office and Fujitsu --
A. It is a consequence of the way the Post Office had
defined their business requirements, and Fujitsu and
Post Office had agreed requirements and had built the
Horizon system this way. It was a consequence of that.
Q. Yes. So it is a consequence of the design and build of
the system --
A. Yes.
Q. -- based on the business requirements that Fujitsu and
Post Office had agreed between themselves?
A. Yes.
Q. And if we look, please, at Day 15 of the transcript at
page 87 {Day15/87:1}. I'm going to ask you to --
A. 87?
Q. Yes, page 87. If you look at lines 1 to 14.
A. Yes, can I read all that through? (Pause)
(Reads to self)
Yes.
Q. You have heard of the acronym WORM, haven't you?
A. Yes.
Q. What does it mean?
A. Write once read many.
Q. And that's not an idiosyncratic acronym of Mr Coyne,
that's a standard industry --
A. No, I think that is pretty common.
Q. Pretty common?
A. Yes.
Q. Mr Coyne says there, when it is put to him that it has
to be cracked open hundreds of times a day, the separate
seal core audit store, His answer is:
"Answer: I think the word 'sealed' is misleading
and the concept of cracking something open to get access
to it I think is misleading as well.
"Things in an audit store are only -- can be written
to and only written to once, and the term that's often
used is write once read many, WORM. So the process is
written to once, but people can read from that store on
many occasions."
Now, that is not an uncommon system for that kind of
data, is it?
A. I think it is fairly common, yes. I'm not --
Q. Hence the acronym, actually?
A. Yes.
Q. And if we look at page {Day15/84:6} to line 14, you can
see him, Mr Coyne, explaining the purpose of an audit
store.
"Answer: Well, the purpose of having an audit of
what happens at branch counters is so that if there is
a dispute over what has happened that somebody,
presumably this will be Post Office, can have a very
quick look at what happened and find out the truth.
That's the purpose of having an audit store. There is
no other reason for it other than looking back at what
actually happened. It is my perception that that look
back was available to people at the Post Office."
A. Yes.
Q. Yes? Now, that is right so far as it goes?
A. Let me see.
Q. Subject to cost etc and time to get the ARQs from
Fujitsu?
A. Sorry, can I read that paragraph again?
(Reads to self)
Now, "very quick look" is not what was intimated.
It is not what Horizon did.
Q. Well, it was open to Fujitsu to at least look back when
they eventually did get the ALQ data, wasn't it?
A. Well, the business requirement had been stated and
agreed that here is this audit store and it does these
things. A quick look was not one of them.
Q. Do you have any practical experience yourself of working
in or designing audit stores for different systems?
A. Let me think. Not this kind of audit store.
Q. No, because Mr Coyne says he does at page {Day15/82:2}
to line 14.
A. Let's look at this. Page 82, line?
Q. Do you see that?
A. (Reads to self)
Okay.
"... they don't have to work in the way ..."
Q. Yes. And he agrees with you, they are:
"... often very easily accessible to be able to be
read by certain users ..."
Hence the WORM acronym.
A. Sorry, what does he agree with me?
Q. Well, do you agree with him that audit systems of the
WORM type are:
"... often very easily accessible to be able to be
used by certain users ..."
There's nothing inherently difficult about that if
you design it that way?
A. If the business requirement is that and you design it
that way, then it is possible, yes.
Q. Yes. And if you don't design the system that way, it is
not?
A. That is right, yes.
Q. And if we look at {D3/1/102}, paragraph 400.
A. Yes, right.
Q. You say:
"I have not had much personal involvement in
building secure kernel software ..."
MR JUSTICE FRASER: Which paragraph?
MR GREEN: Paragraph 400:
" ... or computer security techniques, although I'm
familiar with the underlying mathematical specification
methods."
And that's fair?
A. I said it.
Q. Now, just focusing on the gold standard or tamper-proof
nature of the information in the audit store now. You
have described it as a gold standard in your expert
report?
A. Yes.
Q. And you say it is a highly secure and tamper-proof
record of what's entered into Horizon at the counter,
etc, as a gold standard for comparison for data held in
other parts of the Horizon estate, etc, supporting the
diagnosis of software errors.
Now can we agree that the point where the accuracy
of the audit store data matters is the point at which it
is actually being looked at for comparison with what's
there at the branch or on the auditor's laptop?
A. Well, accuracy matters in any context it is used.
Q. Okay, in any context it is used?
A. I think so.
Q. But you would accept that its accuracy matters within
the audit store?
A. Yes.
Q. Because if it is wrong there it is just wrong?
A. Yes.
Q. And its accuracy matters when it is being looked at
after it has been extracted, yes?
A. Yes.
Q. Because if it is not still as accurate as it was in the
audit store you have got another problem?
A. Yes.
Q. Mr Dunks gave evidence on this, Mr Miletic
cross-examined him on that. Were you there for that?
A. I do not think I was, actually.
Q. Can we look at {F/1716/43}, please.
A. "Extraction client", right.
Q. So this is a page of the audit extraction client user
manual.
A. Right.
Q. And we want page 43, if we may.
A. Could I just clarify. There are two stages in an audit
extraction, there is getting the xml raw data out and
then there is converting it to spreadsheets. Is this
referring to both --
Q. Well, it looks as if it is looking at the process
overall but we will take it in stages.
It says:
"TMS and BRDB messages --"
A. Sorry, where are we?
Q. At the top of the page.
A. Okay.
Q. ""TMS and BRDB messages are numbered in sequence for
each node. During filtering any retrieved audit message
data is analyzed to determine what message sequences are
present in the data and whether there are any gaps or
duplicates in those sequences. A gap in a message
sequence may indicate that a message is missing from the
audit data."
A. Yes.
Q. "Duplicates may indicate that an audit file has been
gathered twice."
A. Yes.
Q. Do you see that? And if you look at the actual dialogue
box that would be on the screen, on the right-hand side,
can you see "Gaps Found (shown in red)", and "Duplicates
Found (shown in blue)"?
A. Yes.
Q. Then underneath that, do you see "Seek assistance from
audit support"?
A. Yes.
Q. Then the text below the diagram or figure 27:
"When gaps are found, the gaps are shown in red in
the message ... list ..."
And so forth.
"When duplicates are found ..."
And so forth?
A. Yes.
Q. Did anyone tell you or give you -- direct your attention
to the transcript of Mr Dunks' cross-examination about
this?
A. No, I don't think so. I think I have read that
transcript though.
Q. Had you seen this document before you --
A. I certainly looked at this document, yes.
Q. This page?
A. I'm not sure about this page. I was more concerned with
the process of getting from the xml to spreadsheets and
the different spreadsheets I might get out.
Q. Let's pause. You would accept that this introduces
a more complete aspect of the picture as to whether or
not the audit data is a gold standard, doesn't it?
A. It obviously clarifies understanding audit data, yes.
Q. And the fair inference from the document is that gaps
and duplicates do occur?
A. No. I think the fair inference from the document is
that if gaps and duplicates occur you should be
concerned.
Q. So you are not prepared to accept that the fair
inference from this document is that gaps and duplicates
do occur in the audit database?
A. I do not think that's a fair inference. I think the
fair inference is that they are not supposed to and if
they do you should seek assistance.
Q. So in fact even if you had seen this, it wouldn't have
changed your view about gold standard, would it?
A. No, it doesn't. I'm saying that gaps and duplicates are
something to worry about, therefore raise the alarm.
Q. Pausing there. If there were gaps or duplicates, they
could arise on the journey of the data to the audit
store to the point of being committed, couldn't they?
A. Yes.
Q. They could arise on the journey out of the audit store
as a result of the extraction process itself?
A. That sounds less likely but possible.
Q. Possible but less likely. Or there could be some sort
of bug, error or defect or form of remote access that
might make the underlying data unreliable?
A. What do we mean by that?
Q. Well, let's just -- let's take for example the
piggy-backing into the counter, and if you accept for
a moment that if that means that a transaction can be
done remotely that looks as if it is being done in
branch, the data in the audit store is going to record
what was shown in branch, which is that it was done in
branch when in truth it was done remotely?
A. Firstly, nobody has ever explained to me what
piggy-backing is and I'm uncertain as to what
piggy-backing means, it is not a technical term --
Q. I understand, but I'm just asking you to assume that's
what it means, not to challenge it.
A. You say what's shown in branch. I mean ... I'm
struggling with this question a bit. In other words,
the audit store has been designed to record what
happened in branch and normally that's what happens.
Now you are asking me what else might have happened, and
normally I would expect any process of remote access to
branch accounts to record in the transactions, for
instance with counter 32 as one mechanism, that
something different had happened and therefore I would
expect that to go to the audit store.
Q. Let me put it this way, Dr Worden. If it didn't record
that, that's what would go to the audit store?
A. If there was a bug or a fault in the software that was
used to piggy-back for instance, and piggy-backing did
not leave a trace in transactions, then that would be
the case.
Q. If piggy-backing itself did not leave a trace in
transactions that's what would show up in the audit
store?
A. Absolutely, yes, that is right.
Q. Now Mr Dunks couldn't assist on the cause of potential
gaps and duplicates when he was asked about it.
A. Mm.
Q. But what we can see is their suggestion that one should
seek assistance from audit support if gaps or duplicates
were found?
A. Yes.
Q. Do you know anything about that process that audit
support would use?
A. I haven't looked that deeply, no.
Q. Do you know that it was a semi-automated process?
A. As I say, I haven't looked into it.
Q. Because we know from the Seema Misra case that it was
referred to by Mr Jenkins in a witness statement to the
court which, just for your Lordship's note, is
{F/676/2}. It is referred to as a semi-automated
process to remove duplicates, for example.
A. What stage was Mr Jenkins referring to?
Q. What had happened in the Seema Misra case was ARQ data
had been obtained, it had duplicates in it, they were
spotted, and then there was what was described as
a semi-automated process to remove them.
A. Yes, I believe this -- what was the date of this ARQ
data?
Q. As at 2010 I think.
A. That was the Seema Misra case at that date, was it?
Q. Yes, but you don't know anything about this?
A. I have an approximate awareness that at some stage
duplicates can arise because of two correspondence
servers, for instance, and that they have to be removed
at some stage. That's as far as I have gone.
Q. What about gaps?
A. Gaps are rarer, I would suspect, and they are -- again
I haven't looked in depth at the process by which gaps
might occur but I believe they are not supposed to
happen.
Q. Because a few minutes ago you were saying neither were
supposed to happen?
A. I believe that is right, but "happen" may refer to
several locations in the process, and by the time it
gets in the audit store I believe it is the intention
that duplicates and gaps should not be there.
Q. That sentence encapsulates one of the biggest
differences between you and Mr Coyne, doesn't it,
Dr Worden?
A. I don't know.
Q. What Mr Coyne has observed is your report is written
from the point of design aspiration: this is the
intention and I'm going to assume that the intention is
achieved. And Mr Coyne has taken a different approach
of trying to see on the ground whether it was. Do you
accept that as a fair characterisation of your two
different approaches?
A. No, I don't. I have looked at testing a lot, I have
looked at in service a lot, so I have not looked at
design aspirations only.
Q. So do you feel that you looked in relation to the bugs
that you and Mr Coyne discussed, which we will come to
later, do you feel that you looked at that carefully to
form a view about that, did you?
A. I looked -- I mean, I looked for bugs. We both looked
for bugs and we both did as carefully as we could.
Q. I see.
MR JUSTICE FRASER: But this document that's still on the
screen is about extracting the data from the audit
store.
A. Yes.
MR JUSTICE FRASER: And as I understand what you have said,
and I just want to check in case I have misunderstood,
duplicates may occur, they shouldn't, but they may
because of the use of two correspondence servers.
A. On the way.
MR JUSTICE FRASER: Is that on the way out or on the way in?
A. I would expect that duplicates coming out are not
intended whereas duplicates are somewhere on the way in,
and somewhere on the way in duplicates are removed.
MR JUSTICE FRASER: But they could occur both on the way in
and on the way out, is that right?
A. Well, on the way in I think they are perhaps more to be
expected. On the way out they are a sign that something
is wrong.
MR JUSTICE FRASER: And what about gaps?
A. Gaps on the way out I think are again a sign that
something's wrong.
MR JUSTICE FRASER: And what about on the way in?
A. It is not clear whether they may happen. For instance,
if a counter gets isolated, you get maroon transactions,
you might get gaps on the way in.
MR JUSTICE FRASER: All right. Thank you very much.
Mr Green.
MR GREEN: I'm obliged.
Can we look at audit data reversal indicators. If
we can look please at {F/829/1}, it is a document from
11th August 2011, and it is a document that records that
ARQ don't identify transaction reversals.
So this is a PEAK, it is PC0211833. If you go to
the bottom of page {F/829/2}, please.
My Lord, we have got a ring binder with this first
one in for Dr Worden to add the ones we do as we go
along.
MR JUSTICE FRASER: All right.
MR GREEN: As we pass them up, is it all right that
Mr Donnelly --
MR JUSTICE FRASER: Yes, of course. What, goes and puts
them in the file, or hands them up?
MR GREEN: That is right.
MR JUSTICE FRASER: Of course.
MR GREEN: I'm most grateful.
Dr Worden, if you look at page 2.
A. Right.
Q. At the foot of page 2?
A. Yes.
Q. Do you see "Impact on Operations" in capitals about five
lines up?
A. Yes.
Q. Underneath it says:
"Spreadsheets supplied by the prosecution team miss
out an indication as to whether a transaction is
a reversal."
A. Yes.
Q. And it appears to be thought that that's relevant there?
A. Yes.
Q. And that is -- what's being spoken about is the
extraction process of data from the ARQ logs?
A. That is right.
Q. Underneath it says:
"The prosecution team are well aware of the problem;
we hope to have a release out in a few days; a KEL is
therefore not required."
A. Yes.
Q. So it looks as if this was being taken in hand.
If we go over the page to page {F/829/3}.
A. Yes.
Q. Do you see "FASTARQs" at the top?
A. Sorry? Fast ARQs.
Q. Exactly. It says:
"They just need to run fast ARQs with all the
various queries and check that the HNG-X spreadsheets
all now have a reversal column."
A. Yes, right.
Q. It says under "Risks":
"There are a few risks with this fix. It must be
got out or prosecution evidence is incomplete."
It is clear, isn't it, that what the ARQ data would
show would depend on how it was going to be extracted?
A. Yes, I mean --
Q. That's fair?
A. -- to fill this in a bit, extraction is getting out the
xml and then running various programmes to convert the
xml into various different possible spreadsheet forms,
and I believe there is more than one, and these xql
files are xml query files that take xml and extract
stuff from it.
Q. But the answer to my question was yes?
A. Yes. I was just adding a bit of clarification.
Q. If we can now go please to {F/1082/1}. So that was
August 2011. This is 12th June 2013. This is the
document that has been referred to as the Helen Rose
report.
A. Mm.
Q. Is this a document you have seen before, when it comes
up?
A. Certainly the Helen Rose report, when it comes up,
I would have seen before.
Q. You are familiar with it?
A. I'm fairly familiar with it, yes.
Q. Now, it is at {F/1082/1}, and if we look please at page
3.
Let me give you the context. Look at the bottom of
page {F/1082/2} first.
A. Now the blue is Gareth Jenkins in this, I believe.
Q. That is right. At the bottom of page 2 you see a
question:
"I can clearly see the recovery reversal on the
fujitsu logs received, but would this have been clear
had we not previously discussed this issue."
Do you see that?
A. Yes.
Q. As you say, the blue is Gareth Jenkins. When you had
your conversation with Mr Jenkins about the receipts and
payments issue, did you also discuss this?
A. No, not at all.
Q. Okay. If we go over the page please to {F/1082/3}, and
you look at Mr Jenkins' answer in blue --
A. At the bottom.
Q. At the bottom.
A. Yes.
Q. "I understand your concerns. It would be relatively
simple to add an extra column into the existing ARQ
report spreadsheet, that would make it clear whether the
Reversal Basket was generated by recovery or not."
A. Yes.
Q. "I think this would address your concern. I'm not sure
what the formal process is for changing the report
layout. Penny can you advise ..."
And so forth.
Then at the foot of the page:
"May recommendation is that a change request is
submitted so that all system created reversals are
completely identifiable on both Fujitsu and Credence."
Now, Angela Van Den Bogard gave her evidence that
she didn't think this had been acted on, this
recommendation. You haven't seen anything to indicate
that it has in relation to the extracted audit data,
have you?
A. I certainly don't know. I should say that if it had
been acted on, the way I would imagine it would be acted
on is to produce a change in some of these xql files
which do the conversion to spreadsheet.
Q. And that is a relatively simply thing to do as
Mr Jenkins said?
A. I think so.
Q. So there is no sensible reason not to do it, is there?
A. I don't know.
Q. Well, if it is something you want to do and it's
important and relevant, you explain it's easy to do, can
you think of a sensible reason why you shouldn't do it?
A. No, I can't. But I don't know what the priorities were
or what the business considerations were or anything
else, I just know I don't know whether it was done or
not.
Q. Now, we have looked at your approach to Issue 1(b) which
is to focus on the audit store data?
A. Yes. I think that is not my only conclusion on
Issue 1(b).
Q. Would you fairly -- because I don't want to take you
back to your report -- accept that is the focus of your
answer to 1(b)?
A. Well, if we go back to my report there were several
paragraphs in 8 point whatever it was.
Q. I haven't got time to show you every document again but
let's focus on this. You agree with Mr Coyne that
Horizon does not record disputes. That's agreed?
A. Yes, that's agreed.
Q. So the Horizon system does not record whether one of the
parties involved in the transaction, namely the
subpostmaster, agrees that a figure is correct or
disagrees?
A. Well, disputes are disputes between presumably the
postmaster and the Post Office about what happened.
I was not -- that's what I was referring to.
Q. There's no dispute button on the screen?
A. No.
Q. No. And were you aware that the suggestion of a dispute
button being on screen was considered and rejected in
2008?
A. I wasn't aware of that, no.
Q. Furthermore, where an amount is less than £150, you are
aware, aren't you, that an SPM can't settle centrally?
A. Yes.
Q. So in relation to individual items of £150, even if
disputed, the SPM has to make them good by cash or
cheque?
A. I think that is right.
Q. And there could be more than one of those?
A. In a month or in what?
Q. In a trading period.
A. Well, my understanding is that in a trading period, if
the aggregate amount is less than £150, then it's got to
be cash on the nail. If it is bigger it can be suspense
account.
Q. We will come back to that.
The points relevant to the reliability of the
Horizon system to record transactions are essentially
these, that in certain cases the Horizon system will
record a figure which is in dispute. That follows from
what we have just said?
A. The Horizon system is recording loads of figures and
some of those figures may be in dispute, yes, certainly.
Q. And because of your view about transaction corrections
being necessary as part of the overall system, those
transaction corrections are at some point in time
correcting figures on Horizon which would otherwise be
wrong?
A. Yes. Certainly.
Q. So without those transaction corrections the figures
shown on Horizon are wrong?
A. They could be wrong for a variety of reasons, all sorts
of reasons --
Q. The answer is yes?
A. TCs try and correct all sorts of errors.
Q. The answer is yes?
A. Yes, but I'm saying there are lots of causes.
Q. I'm not asking you about --
A. I'm saying yes.
Q. And it might be that the subpostmaster knows or believes
the figure to be wrong?
A. Yes.
Q. It might be that Post Office or possibly Fujitsu believe
the figure to be wrong?
A. There are all sorts of investigations, yes, which can
lead to views about figures being wrong.
Q. And it might be that two or more of those parties will
think that the figure is wrong?
A. Yes.
Q. But it is still the figure on Horizon which requires
a transaction correction later?
A. Yes.
Q. So even where everyone agrees that a transaction
correction is necessary, the figure shown on the Horizon
system itself is wrong?
A. Intermittently wrong, and the point of the transaction
correction is to make sure that in the long-term Horizon
is right.
Q. Indeed. Now picking up from Tuesday in relation to
transaction corrections and the time that they take to
issue --
MR JUSTICE FRASER: Are you onto -- is this a convenient
moment?
MR GREEN: I'm so sorry. Yes, that would be a convenient
moment.
MR JUSTICE FRASER: I get the sense we are moving on to
a new topic.
MR GREEN: Indeed.
MR JUSTICE FRASER: Possibly because you said picking up
from Tuesday.
Right, we will have 10 minutes, Dr Worden. Same
score as before. You know the drill. And we will come
back in at 12 o'clock.
(11.50 am)
(A short break)
(12.00 pm)
MR GREEN: Dr Worden, picking up from Tuesday in relation to
TCs and the time they took to issue, can we look please
at {F/1324/1}.
A. Yes, right.
Q. Is this a document you have seen before or --
A. I'm not familiar with this one, no, sorry.
Q. When you wrote your report did you have any factual
knowledge about how long it took to issue TCs?
A. Rather little. My impression was --
Q. No, pause there.
A. Yes.
Q. Did you actually know any facts?
A. I didn't have any data.
Q. Thank you. Let's look at page {F/1324/9}, please. If
we look at 3.1.4, do you see what's being proposed there
is 95% of transaction corrections within four months?
A. Yes, right.
Q. Then 3.1.5, 95% of transactions within six months?
A. Let me just see the categories here. Okay.
Q. You can see?
A. Yes.
Q. So there are different timescales for different ones.
If we go over the page to page {F/1324/10}, you can see
that there are provisions there at 3.1.10 for
"Aged/large volume/value transaction corrections"?
A. Yes.
MR DE GARR ROBINSON: I don't mean to be difficult but
I don't know what this document is. Has that been
explained to the witness?
MR GREEN: Have you seen any of these before?
MR DE GARR ROBINSON: What's "these"?
MR JUSTICE FRASER: All right, let's go back to page
{F/1324/1}. I assume it is a Post Office document, is
it?
MR GREEN: It is, my Lord, yes.
MR JUSTICE FRASER: Why don't you just explain to the
witness what the document is.
MR GREEN: This is a working agreement between the financial
service centre and the network.
A. And what's the date?
Q. It is I think 10th March 2015.
A. Right, okay.
Q. If we go to page {F/1324/8}. Paragraph 3, there is
a heading "Working Agreement."
A. Yes.
Q. This reflects the working agreement between FSC and the
network and --
A. And the pages we have looked at before are after this
page, is that right?
Q. Hold on.
A. Sorry.
Q. This reflects the working agreement between FSC at
Post Office and the network, so an internal working
agreement, which was heralded by the title of the
document, the title being a working agreement --
A. Yes.
Q. -- between FSC and the network.
A. Yes.
Q. And at paragraph 3.1 it says:
"The following section sets out the standard
timescales for the issuing of transaction corrections to
branches by FSC."
A. Yes.
Q. Then if we go over the page {F/1324/9}, we see the
provisions there. My question to you was you hadn't
seen any -- you hadn't said you hadn't seen this
document and you said you didn't have any data.
A. That is right, yes.
Q. Did you know of guidance like this from any other
documents as far as you know?
A. I do not think I did, no.
Q. Thank you.
Then if we go to {C5/11/14}, please. This is part
of a request made by Mr Coyne for further information.
We are looking at paragraph 15.2. Mr Coyne asks:
"Please describe the average duration of resolution
for transaction corrections where other statistical
might not be found in relation to causes of TCs."
Yes?
A. Yes.
Q. You did not support that request, did you?
A. I didn't, no. What time was this request?
Q. This is dated -- give me one second. Mr Coyne makes
this 4 June 2018?
A. So quite early, yes.
Q. You didn't support it, did you?
A. No. TCs were --
Q. So that might have provided some data for you about that
topic?
A. I didn't feel that my supporting requests led to them
being acted on any faster, really.
Q. Is that why you didn't support so many of the requests
by Mr Coyne?
A. It was not the centre of my focus of interest at the
time.
Q. Let's look at your transaction correction calculations.
The context in which I think you consider them is Issues
5 and 15, and then you effectively then reconsider them
for the purposes of Issue 1.
A. How do I do that? I mean they do interact with
Issue 1 --
Q. And 3?
A. -- but where's the implicit linkage?
Q. Would you accept that is a fair summary?
A. Well, TCs calculation does not enter into my numerical
estimates on Issue 1, I don't think.
Q. Let's pause there. Let's have a look at Mr Coyne's --
your criticism of Mr Coyne, as it were. Let's look at
paragraph 891 at {D3/1/198}.
A. This is my chapter 9, is it?
Q. Yes, your chapter 9.
A. Which paragraph? 8?
Q. At 891.
A. Yes.
Q. So you note that:
"Mr Coyne has gone further than the above scope."
A. Yes.
Q. Because he had actually referred to the possibility of
further error in the Horizon system where
an inappropriate method of fix was selected or the
possibility of transaction corrections being issued as
a result of error, yes?
A. He had referred particularly to the possibility of
errors in the manual process involved in transaction
corrections.
Q. And that's what you felt was out of scope?
A. Yes.
Q. And you then explain at 891 that for balance, in 9.6 you
provide your own commentary without prejudice to your
understanding of the scope of Issues 5 and 15?
A. Yes, right.
Q. If we look at what Mr Coyne says in his expert report,
you refer to it -- if we go to the next page of your
expert report just for a moment {D3/1/199}, the
particular points that you have picked out at
paragraph 893 --
A. That's 3.13.
Q. -- are 3.13 and 3.28. Let's go to those. It is
{D2/1/27}. There are two separate points here. 3.13 is
the first one we are looking at now.
A. Yes.
Q. And he says:
"The reconciliation process ultimately presents the
possibility of further error within the Horizon system
whereby an inappropriate method of fix was selected,
and/or the corrective fixes may have been carried out
erroneously."
A. Mm.
Q. Now, that's not actually particularly limited or focused
on transaction corrections, is it?
A. ""The reconciliation process ultimately presents the
possibility of further error within the Horizon system
whereby an inappropriate method of fix was selected ..."
It seems to me that fix does have a bearing on
transaction corrections.
Q. Okay, that's how you understood it?
A. Yes.
Q. Then if we look at 3.28 -- sorry, can we just stay on
that page one second.
Just in terms of substance, you agree that that's
a fair comment by him, whether it is in or out?
A. Well, I have difficulty understanding the bounds of the
Horizon system there because a method of fix being
selected is a human process.
Q. Okay. Subject to that you would accept the substance of
what he is saying, subject to the bounds of the Horizon
system?
A. "... corrective fixes may have been carried out
erroneously."
Again, that seems to be a human process we are
talking about.
Q. The bounds of the Horizon system you're referring to
exclude the process of issuing TCs?
A. Well, it seems to me that this statement is referring to
some human processes.
Q. And you don't include those in the Horizon system?
A. No, not part of the system.
Q. If we look at {D2/1/30}, which is the other paragraph to
which you expressly referred, 3.28.
A. (Reads to self)
Yes.
Q. He says:
"It is also possible that transaction corrections
were issued as a result of error in Horizon transaction
data processing."
A. Yes.
Q. Just pausing there. In/out, whatever you like to do
with it, whatever its status going to the Horizon
Issues, you agree that that's possible?
A. It is possible, yes.
Q. So at least on that point there's no disagreement of any
substance?
A. No. I would obviously --
Q. Just yes or no at the moment.
A. No, there is no disagreement.
Q. And you note in your report, {D3/1/199} at
paragraph 892.3, you say there:
"Whenever the comparison revealed any discrepancy,
there appeared to be a human process of deciding where
to allocate responsibility for the discrepancy this had
to be a human process and was therefore subject to
errors."
A. Yes.
Q. So that's entirely consistent with you accepting the
point that Mr Coyne made there?
A. Yes.
Q. On any definition of what consistent means?
A. Well, I say consistent means not contradicting, yes.
Q. You are actually agreeing with him properly, aren't you,
there?
A. 3.13 or 3.28?
Q. 3.28.
A. I think I am, 3.13 I think I am, yes.
Q. And then you then devote a substantial section of your
report, section 9, to calculating your upper limit on
the magnitude of discrepancies --
A. This is 9.6 I think, yes.
Q. -- arising from erroneous TCs.
And if we go to paragraph 895 at {D3/1/199} we can
see that you have sought to calculate what in line 2 you
call there:
"... an upper limit on the magnitude of
discrepancies in claimants' accounts arising from
erroneous TCs ..."
A. Yes.
Q. You have focused on the claimants' accounts rather than
the subpostmasters generally?
A. I have adopted that scaling factor, but to my mind the
advantage of using numbers is if that scaling factor is
not the right one it is easy to convert to another
scaling factor.
Q. It is a yes or no answer --
A. Yes, I have adopted that scaling factor.
Q. And you have looked at annual volumes, distribution of
types of TC, proportions of TCs disputed and proportion
of disputes upheld?
A. Yes.
Q. That's a new exercise that you have done that Mr Coyne
hadn't done?
A. Yes.
Q. And none of the Horizon Issues particularly asked you to
do it?
A. You could say the robustness asked me to do it, because
they are a user error correction, they are a form of
robustness.
Q. But the errors in TCs, your express position is that
that's out of scope, manual errors in TCs?
A. I'm saying the causes are out of scope. There are a lot
of things where the causes are out of scope but the
robustness is how the effects are dealt with.
Q. Let's look at page {D3/1/205}, paragraph 928. You
identify in paragraph 928 a table of volume of TCs by
year?
A. Mm.
Q. Did anything odd strike you in the data when you were
eyeballing it?
A. Yes, there is a funny year where if you look at "Value
of TCs", then 2015 is rather peculiar. It jumps up
above the others.
Q. Yes, it is about five times the average of the
surrounding four years.
A. I didn't get to understand the final reason for that.
Although there was another piece of data where
a particular month they had some lumps in the number of
TCs which may be related but I never investigated that.
Q. You have no idea whether that was a catch up on lots of
old ones that had gone wrong or whether it was
a disastrous year in some respect, or there was
a specific problem or anything else, do you?
A. I don't know the causes of that lump, no.
Q. When the claimants' solicitors specifically asked
a question about the TCs in correspondence -- for
your Lordship's note {H/69/2} -- were you asked about
that?
A. No, I don't think so.
Q. And so you were relying I think on Mr Smith's evidence
as you say at paragraph 931 on {D3/1/206}, is that
right?
A. Particularly for disputed TCs I was relying on his
evidence, yes.
Q. And you were here for Mr Smith's evidence?
A. Mm.
Q. Sorry?
A. I think I was, yes.
Q. I am just checking because earlier on, on Tuesday, you
said you thought you were here for all the defendant's
evidence, and every time I put someone to you, you say
you were not here.
A. I agree that's confusing. I was certainly here for
certain key defendant witnesses, like Mr Parker and
Mr Godeseth. The others I can't be quite so sure about.
Q. Because if you rely on someone's evidence it is pretty
interesting what they say in cross-examination, isn't
it?
A. I read the transcripts if I'm not there.
Q. And you have had the transcripts --
A. Yes.
Q. -- since Tuesday to consider before you came back today?
A. Yes.
Q. Did you read the transcript of Mr Smith's evidence?
A. I believe I did, yes.
Q. And it is right that your analysis in 206 is essentially
premised on Mr Smith's evidence being accepted?
A. It is, absolutely.
Q. You in fact say that, you say:
"If this evidence is accepted it enables me to
calculate the approximate financial impact of errors in
processing TCs."
If we just look a bit further down at 934, you have
just referred again {D3/1/207} to disputed TCs and
upheld TCs in Mr Smith's witness statement?
A. I have jumped somewhere.
Q. Sorry.
MR JUSTICE FRASER: I think you need to be on {D3/1/207},
I think.
Are you going to paragraph 934?
MR GREEN: My Lord, I am.
We have just looked at some other figures from
Mr Smith, and you say:
"I proceed on the assumption that these figures,
which are the only ones available to me, are accepted by
the court."
A. Yes.
Q. Mr Smith had presented the figures for Santander in
a way that had misled both you and Mr Coyne, hadn't he?
A. That is correct, there was a change in Mr Smith's
evidence. And also I made another calculation of TCs in
my supplemental report as you are aware.
Q. Did that rock your confidence in his knowledge of the
subject matter at all?
A. If you look at my second calculation of TCs, I isolated
three principal categories, that was Camelot and remming
and Santander online banking, and Mr Smith's correction
was not about Santander online banking, it was about
Santander manual deposits.
Q. Yes, but I mean Mr Smith's Camelot figures were
specifically relied on by you, weren't they?
A. Camelot figures, yes.
Q. And I think we see that at paragraph 936 and footnote 29
on page 207.
A. Yes. And I think in my subsequent calculation, when
I had the three columns for the different kinds, Camelot
TCs were not a large contribution to the ultimate
result.
Q. Let's have a look at that, paragraph 49. The figures
that Mr Smith gave --
MR JUSTICE FRASER: Where are we?
MR GREEN: I'm so sorry, paragraph 20 of Mr Smith's witness
statement which is {E2/9/5}. Do you see paragraph 20
there?
A. Yes. I remember those figures, yes.
Q. There actually weren't any figures for Bank of Ireland
retracts and lottery for the number of TCs disputed or
compensating TCs, so they had been estimated?
A. They are estimated figures, yes.
Q. Did you pick up the fact that they had been estimated
when you were relying on his evidence in your first
report?
A. Well, I'm always conscious of the limitations of
evidence and this introducing of uncertainty, that's
a further dimension of uncertainty in the analysis.
Q. But you had assumed they had been estimated based on
some sort of knowledge?
A. I assumed if somebody made an estimate it was a sensible
estimate, yes.
Q. But based on some facts or knowledge that they had?
A. Yes.
Q. And in his cross-examination, if we go to that,
{Day6/186:19}, starting at line 19. It is page 186 at
line 19.
A. I'm not there yet.
Q. Don't worry, it will come up in a moment.
A. Okay.
"Question: ... under 'BOI retracts' and 'Lottery'
the number of TCs issued for those two is very different
..."
Right.
"Question: But the number of disputed TCs
apparently is estimated to be the same?
"Answer: It appears so, yes."
Right.
Q. You see:
"Question: And the number ... is ... estimated to
be identical?
"Answer: It appears so, yes.
"Question: Do you have any feel at all from your
own knowledge as to whether those figures are even
remotely reliable?"
A. Well, my own knowledge --
Q. No, I'm just asking you to look at the transcript for
the moment. I'm just reading out the question I said to
Mr Smith. Do you see line 4 on page 187?
A. I don't have feel for my own knowledge --
Q. No, I'm not asking you the question --
A. I thought that's what you were asking me.
Q. No. Could you please just look at the transcript and
then I'll ask a question in a minute. It's my fault for
not making it clear.
MR JUSTICE FRASER: I think what Mr Green is doing is he is
just going to read out some questions and answers from
Mr Smith and then he is going to put a question to you.
A. Right, okay.
MR JUSTICE FRASER: Mr Green.
MR GREEN: I'm most grateful.
If you look at line 4 on {Day6/187:4}, and he says:
"Answer: The number of issued TCs I would suggest
are very accurate. The number of TCs disputed is not
something that I can comment on at this stage. I do
know that prior to having our case management system in
there was no consistent method of recording the method
of disputes."
A. Yes.
Q. So on that footing the figures that you were looking at
and the person giving them doesn't seem to have been
hugely well placed to give reliable figures, does he?
A. No.
Q. Now if we look at TCs of different types on page 207 of
your first report {D3/1/207}, at paragraph 938, bottom
of the page, you refer to a TC summary --
A. Yes.
Q. -- from a TC reporting pack from November 2012. If we
look at the following page {D3/1/208} you will see table
9.3.
A. Yes.
Q. "Volume of TCs by origin".
A. Yes.
Q. For 2011/2012. Do you see that?
A. Yes.
Q. If we look at the source document from which you have
taken that, could we please open {F/987/1}. It is
an Excel spreadsheet.
Do you remember you got that from an Excel
spreadsheet, Dr Worden?
A. Yes, plenty of tabs I remember.
Q. That is right. We are going to look at a tab called
"Summary by period" when that comes up. It is
{F/987/1}.
We can't see it now, but presumably you looked
carefully at the data on the Excel spreadsheet?
A. I poked around that spreadsheet a bit.
Q. You poked around a bit?
A. Yes.
Q. There are quite a few tabs so it is important to see
what you are dealing with.
MR JUSTICE FRASER: Pause for one second. We are still
waiting for F/987.
MR GREEN: We are.
MR JUSTICE FRASER: Which I imagine is quite a big
spreadsheet which is why it's taking a while to load.
I can see it there but it has not gone on the common
screen yet. Is that F/987? Here we go. (Pause)
MR GREEN: Shall I just ask you, Dr Worden, while we are
waiting for that, I will just take you to a different
paragraph, if I may.
A. Yes.
Q. If we look at paragraph 942.
A. Yes.
Q. On page {D3/1/209}.
A. I will try my paper copy, I think.
MR JUSTICE FRASER: If we do that, we are moving away from
the spreadsheet, is that right?
MR GREEN: My Lord, I will come back to that spreadsheet.
MR JUSTICE FRASER: Maybe at 1.55 pm ask for it to be loaded
up and it will be there at 2 o'clock.
MR GREEN: I'm most grateful.
If we look at paragraph 942, you proceed on various
assumptions to reach a calculation that:
"If there were 2% of TCs issued in error, which were
resolved incorrectly against the branch, the net effect
on branch accounts would be £6 per branch per month."
A. Yes.
Q. "As described above, in my opinion this is a
conservative upper limit on the magnitude inaccuracies
introduced into branch accounts - which could be of
either sign."
A. Yes.
Q. We go down. 943, you have got your assumption that
branches are affected equally, yes? Which takes us back
to our Penny Black example which we won't revisit.
And then at 944 we have got:
"This figure is to be compared with the mean
shortfall per month claimed by the claimants - which, as
I described in section 8 ..."
Then you say:
"A maximum of £2 per month from erroneous TCs is
less than 1% of this amount."
A. Yes, that's just arithmetic.
Q. Yes? So in fairness to you, Dr Worden, you later in
your second report revise the figure from £2 per month
to 1.50 per month?
A. Yes, there is a complete new calculation in the second
report.
Q. And that change of 50p was significant for your
calculations on an engineering approach?
A. Well, I think I summarised in the second report it was
£2 again. I can't recall exactly whether I presented it
as £2 or 1.50. But my belief is that figures in that
range are interesting to the court, whether it is £2, £3
or whatever, so I didn't feel the need for high
precision in that figure. But I think I summarised it
somewhere in my supplemental report as £2 in spite of
the fact the arithmetic had come a bit lower. I can't
recall.
Q. And the effect of the figures that you put forward is,
you say, to show that the probability of a claim by
a claimant being correct is extraordinarily low?
A. I was just converting from this average of £2 a month to
what it would look like if the £2 came in lumps. If the
£2 came in thousand pound lumps then that would
obviously have to happen one every 500 months to create
the right average. So I was doing the arithmetic of
probabilities.
Q. Yes, but my question to you is that the effect of what
you were doing was to show, on your approach, that the
chances of a claim being made by a claimant that they'd
lost £200 in one month due to errors in TCs, in the
absence of further evidence the probability of that
being correct was about 1%?
A. Yes.
Q. So very unlikely?
A. That is the arithmetic, yes.
Q. And that's the effect of what you were showing there?
A. Yes.
Q. And you weren't asked in any of the Horizon Issues by
the court to give your view of the likelihood of
a claimant being right about a claim for £200 being lost
from an erroneous TC, were you?
A. No, but I was asked about discrepancies of various kinds
and I felt, rightly or wrongly, that this was a useful
way to present the figures.
Q. Okay. In fairness to you, let's show you your second
report at paragraph 32. It is on {D3/7/98}. If we look
at paragraph 32 on that page and there you say that your
revised figure is £1.50 per months rather than £2 per
month?
A. Yes.
Q. And you say at the end of that paragraph:
"So in my opinion, errors in TCs cannot account for
even a small part of the claimed shortfalls."
A. Yes.
Q. So it is not just the effect of the calculation, it is
what you reach a conclusion on?
A. Yes.
Q. So can we just do another statistical analysis. Let's
look at a worked example of Mr Abdulla's case. Have you
seen information about his case?
A. I have. I'd need to recollect it.
Q. Let me -- assume I'm guiding you correctly about the
facts.
A. I am sure you are.
Q. Your average for TCs per branch per month is £1.50.
A. Mm.
Q. And you say that when your average per branch per month
was £2 the chance of a £200 erroneous TC is 1%?
A. Yes.
Q. And so when the average per branch is £1.50 the chance
of a £200 erroneous TC in month is 0.75%, isn't it?
A. That is right.
Q. You also assumed that the likelihood of TCs -- erroneous
TCs hitting a branch were equal across the board?
A. Per volume of transactions, yes.
Q. Per volume of transactions. And so the chances of
an erroneous TC of £1,000 would be what, roughly?
A. We started with £200 so it is five times lower.
Q. So if we divide 0.75% by 5, the chances of one erroneous
TC of £1,092, will you take it from me, is 0.14%?
A. That feels about right.
Q. Feels about right?
A. Yes.
MR JUSTICE FRASER: To two decimal places.
MR GREEN: Thank you. What is the chances of that happening
in two months in a row, Dr Worden, on your analysis?
A. Let me consider this carefully. If you believe the two
months are independent statistically then clearly the
probability is multiplied, but there may be correlation
factors, who knows?
Q. Yes, and there are two points there. Let's leave
correlation factors aside for a moment. If there were
no correlation factors, yes?
A. Yes.
Q. Or other factors, and they were independent variables?
A. Yes.
Q. The answer is 0.14% x 0.14%.
A. Yes.
Q. So about a seventh or something of a percent of
a seventh of a percent?
A. Well, what is it? It is 1 part -- I mean 0.14% is 1
part in -- sorry --
Q. It is 1.5 parts in a thousand, isn't it, roughly?
A. So the square of that is 2 parts in 1 million, I think.
Q. So that is the chances of two erroneous TCs --
A. In two identified consecutive months, say.
Q. Two identified consecutive months?
A. Yes, or non-consecutive months. I would be more
confident about con-consecutive months because I think
consecutive months might have correlations.
Q. And you have not factored in the possibility of
correlations or indeed concentrations of TCs or any
factors of those sort in your calculations, have you?
A. I haven't, I do not think, gone on to calculate these
commentorial things about N months at a time. I could
have spent a lot of time going about distributions of
three months here and so on. I didn't go into that,
I just went into that one result.
Q. Do you accept that looking at what appears actually to
have happened is quite a good way of testing
a theoretical model that you constructed?
A. Well, the theoretical model -- the conclusion is in the
absence of other information, and then when we have
other information we have to consider how that other
information meshes with our original model and so that's
complicated.
Q. So is it fair to assume that in fact the extent to which
the reality presented by the claimants departs from your
theoretical model is likely to be explained by
information you have not considered?
A. Well, when we get to individual claimants, as doubtless
we will in future trials, we will consider all that and
we will: think what are the circumstances and how does
that alter the basic model and so on? We will do that
calculation, presumably, but that was not my purpose in
this report.
Q. You accept that your theoretical model is not an obvious
fit with the facts of Mr Abdulla's case if indeed he did
receive two erroneous TCs running?
A. I have not compared my model with Mr Abdulla's case.
Q. I know you haven't, that's why I'm asking you to do it
now?
A. I can't do it now. I don't know enough about
Mr Abdulla's case.
Q. Well, on the theoretical basis you agree that what we
see in Mr Abdulla's case does not fit at all with your
predictions in general so that you would look for some
explaining factor?
A. I haven't done the analysis of Mr Abdulla's case
compared with my general model. If I did, I'm not sure
what I would conclude.
Q. But if we just read your report, the chance of
Mr Abdulla being right about even one erroneous TC
having been issued is vanishingly small?
A. No, because he was in -- I mean the sort of factor one
has to consider is how many months the claimant was in
post, for instance. And as I say, comparing the general
model with a claimant is a complicated exercise which
I haven't -- and I hesitate to jump in there now.
Q. But you have said at paragraph 32, you have reached
a conclusion that errors in TCs cannot account for even
a small part of the claimed shortfalls?
A. That's about the claimants as a population.
Q. But you have done that without the sort of facts that
you are now wishing to consider in Mr Abdulla's case?
A. I have not considered the claimants as individuals, and
when we get round to that it will be a whole new set of
considerations.
Q. I suggest to you, Dr Worden, that the assumptions that
you have made, including the even incidence of TCs
across the subpostmaster population based on
transactions, is a false premise to arrive at a reliable
analysis of the type which you have done?
A. I don't agree with that. I would like to know why you
say that.
Q. We gave the Penny Black example on Tuesday, didn't we?
A. We did indeed, we went into that.
Q. And someone I think tweeting about the case suggested
a different example which was very similar?
A. I haven't read the tweets, I'm afraid.
Q. Let me suggest it to you and see if you accept this one:
based on lottery winners, a very small chance of winning
the lottery, you walk into a room and everyone in the
room says to you, "Oh yes, I won the lottery", "I won
the lottery", "I won the lottery", and that seems very
unlikely, doesn't it, until you see the sign on the door
that says "Lottery Winners' Reception".
A. In the Penny Black example and in the example that you
have just given me we are going into the issue of
supplemental information and how that alters your
conclusions based on a base model. We are also going
into complicated statistical issues about selected
populations. We are going towards advanced statistics.
Q. That's what you are an expert in.
A. I was very careful in my reports not to use advanced
statistics. I was trying to keep it at undergraduate
level, if you like. So I'm quite happy to answer
questions about advanced statistics but in doing so
I shall be very careful and I need to know the question
very clearly.
Q. I'm going to put a point to you that I'd be happy to put
to my 13-year-old daughter, which is that when you look
at a statistical sample the first thing you should do is
look at the nature of the sample and how they were
selected?
A. Yes.
Q. And that is what the Penny Black and lottery examples
are about, isn't it?
A. Well, the Penny Black example led to a conclusion which
in my cross-examination I queried on one ground, and the
one ground was that it seemed to me that to follow your
argument I would have to base my analysis on the
assumption that the claimants were right, and that
seemed to me strange and not a thing I could do as
an expert. But since then I have thought more about it
and there's another much stronger reason for not taking
that example, and the point you were putting to me was
that the claimants were a self selected population and
you need to deal with them differently, and that is
an advanced statistical point. But why it is not
relevant to my analysis is that the claimants are
a self-selected sample and they selected themselves long
after they suffered their shortfalls.
So the point you are putting to me effectively is
these people selected themselves and that somehow caused
Horizon several years previously to rain bugs on them.
And so the causation is completely the wrong way round
between Horizon affecting the claimants and the
claimants self-selecting. It doesn't make sense.
Q. But, Dr Worden, I'm going to put to you that that is
a comical explanation.
A. It is not comical at all. It is commonsense that
causation can't go backwards in time.
Q. No one is suggesting that causation goes backwards in
time.
A. Well, I think that's the suggestion that was explicit in
your Penny Black --
Q. I will clarify it to you. The Post Office's case is
that large numbers of subpostmasters are perfectly happy
with the Horizon system and do not feel they have
suffered from unjustified shortfalls.
A. Yes.
Q. But others do feel they have.
A. Yes.
Q. How many of the former group do you think you would
expect to join a group action complaining about
something they haven't suffered?
A. I don't know the answer to that question but I would not
expect many.
Q. No. Zero or close to zero?
A. Yes.
Q. If you were aggrieved because you believed that you had
in fact suffered in that way and you were afforded the
opportunity of redress, do you think the fact that you
believe you have suffered in that way is a material
factor in your decision whether to join the group action
or not?
A. It is a material factor, and it is not a material factor
in whether Horizon during your tenure caused bugs to
you.
Q. But Dr Worden, just because you join doesn't mean that
we go back to the future with the professor in the
DeLorean and Horizon causes problems in the past?
A. Exactly. That is precisely what I'm saying.
Q. But you do recognise, don't you, that you accepted that
identifying how a sample has been selected is important.
Take it in stages. You accepted that?
A. I accepted that and --
Q. And the importance of the sample in this case is you are
capturing what Post Office themselves call a small
minority of people who, whether they are right or wrong,
are all people who feel strongly enough to join the
group action that they have suffered these shortfalls?
A. Yes. They have self-selected.
Q. Yes. So there is a factor which applies to them which
does not apply to people, the vast majority --
A. But that factor did not apply when they were suffering
from shortfalls.
Q. You genuinely can't see, are you saying, the relevance
of the sample you're dealing with --
A. I'm saying the causation is back to front, and causation
is what's at issue here.
MR JUSTICE FRASER: All right. I'm going to bring this
sequence of cross-examination to an end, Mr Green.
I think it has probably gone on long enough.
MR GREEN: I understand. My Lord, may I just put what
techniques the expert said he had in fact applied in
that?
MR JUSTICE FRASER: Yes.
MR GREEN: Can we look please to {Day18/10:6}. You were
asked about having your CV and you have given evidence
in software development methods and advanced statistical
techniques. You said yes.
You were then asked at line 13:
"Question: The phrase 'advanced statistical
techniques' reflects the application of the expertise
that you have just been talking about?
"Answer: Absolutely. I believe that the statistics
I have applied as a scientist particularly but also as
an engineer goes to the point of advanced statistical
techniques."
A. Yes.
Q. Do you now say that you have not applied advanced
statistical techniques in the approach in your reports?
A. What I say is I was encouraged and I took the advice
that the techniques I have applied in my reports are
elementary statistical techniques.
Q. Who encouraged you to do that?
A. The Post Office lawyers were telling me to keep it
simple, basically, and I was encouraged -- and I felt my
duty was to provide explanations to the court which the
court could readily understand, so I did not want to go
into advanced statistics for that purpose.
Q. A final question on this, Dr Worden, and then we will
move on. Did you come up with the idea of an even
distribution across all claimants or did somebody else?
A. I did.
Q. Can we move forward, please, to Issue 4, for which we
will go back to {C1/1/1}, please.
You can see Issue 4:
"Controls and measures for preventing/fixing bugs
and developing the system."
A. Mm.
Q. That's the general heading, and then the specific
question at question (4) is:
"To what extent has there been potential for errors
in data recorded within Horizon to arise in (a) data
entry, (b) transfer or (c) processing of data in
Horizon?"
I want to ask you about (a), data entry first,
please. Data entry clearly includes the potential for
mis-keying, doesn't it?
A. It does.
Q. And at {D3/1/63} you say there -- you refer to -- at
paragraph 222, under the heading at 6.1.1 "Detection of
User Errors" or DUE, you say:
"In the design of the Horizon counter user
interface, there are large numbers of measures to
prevent user errors."
A. Yes.
Q. "Many of these measures have by now become common
practice in the design of user interfaces - such as the
use of menus and buttons, rather than free text input
..."
A. I was there referring to a common practice rather than
specifically Horizon, I guess. Horizon has plenty of
buttons, not so many menus.
Q. So having a screen with a first class stamp button on it
is one of the factors that you think is helpful?
A. For instance, yes.
Q. As an example.
A. Yes.
Q. And you haven't actually had any regard to the specific
layout of the individual screens, have you?
A. I haven't tried to redesign screens myself or to
consider how they might have been better. I think that
is a very dangerous exercise for an IT engineer to do
actually.
Q. Because it is not your field of expertise?
A. Well, I have run a field of -- a team of user interface
experts and we did user interface design for things like
air traffic control, and the one thing that I learnt is
the designer's prejudices about what is a good user
interface or not are not to be trusted, and one thing
you have to do is user trials to find out what works.
Q. Yes. And that is a very important part of having
a robust system?
A. Yes, user interfaces should be tried out and evaluated.
Q. Yes. And if you get it wrong that increases the
potential for mis-key errors, doesn't it?
A. It would do, yes.
Q. At paragraph 224 {D3/1/64}, you say:
"The Claimants have drawn attention to the user
error of 'mis-keying', to the question of how well
Horizon prevented mis-keying, and whether Horizon might
have prevented it more effectively."
Yes? And at paragraph 226 you refer to the
Mis-Keyed Project Feasibility Study, 2012?
A. Right.
Q. Which you deal with in appendix C1.
A. Yes. I haven't read that lately, I'm sorry.
Q. If we look at {D3/2/40} and we look at paragraph 131,
there you say:
"The Post Office internal feasibility study makes it
clear that Post Office were concerned at the costs
incurred as a result of mis-keying."
Yes?
A. Yes.
Q. You say:
"However, the background section of the report makes
it clear that the costs of concern were Post Office's
central costs, and were not costs or discrepancies in
accounts in the branches."
A. Yes.
Q. Did you actually read that document or did someone else
write that for you?
A. I read it and wrote it.
Q. So you read that. You read the document, the background
document, and you wrote this that we just --
A. Yes. My strong impression from the background document,
reading the whole of it, was that the emphasis was
central costs in Post Office.
Q. And you feel you read that document with the same care
that you read other documents you read in the case?
A. I think so, yes. I mean --
Q. Let's look at it {F/932/1}. Let's look at the front of
it first. "Mis-Keyed Project Feasibility Study", this
is the one.
A. Okay.
Q. And we will find the background section to which you
referred on page 4 {F/932/4}. Let's look at the first
paragraph of the background section to which you have in
fact expressly referred. It says:
"As part of the P&BA centre of excellence drive, one
of the areas of concern is the number of instances of
mis-keyed transactions that occur and much to the
detriment of P&BA. A mis-keyed transaction occurs when
an incorrect value is input by the counter clerk, which
causes a poor customer experience."
Then this:
"The mistake can have a significant impact on the
branch and resource is required in P&BA to manage the
client and address the error. A very large value
mis-keyed transaction will put the viability of a branch
in doubt."
A. Mm.
Q. Why did you not mention that impact in your summary of
the background?
A. The last sentence I agree I did not -- it didn't
register with me, but it seemed to me that poor customer
experience and impact on the branch, and it seemed to me
that basically mis-keying can lead to errors and it
leads to costs having to correct those errors, and
certainly large impacts in my opinion are very likely to
be corrected.
Q. Taking your evidence on its face first, the passage that
you have referred to absolutely does identify that costs
and discrepancies in branch accounts were of concern.
A. It says "impact" on the branch. And it does -- I agree
with you the last sentence does say that it has impact
on the branch, but the general tenor of the document
seems to me that it is saying, look, this stuff occurs,
we can correct it, but it is costing us money to correct
it --
Q. Are you being scrupulously fair in your answers,
Dr Worden, on that point?
A. I agree with you that that last sentence of that
paragraph I had not paid attention to in my summary.
Q. I'm going to suggest to you that that is not
a scrupulously fair answer. Do you agree?
A. I think I have answered your question fairly.
Q. Is it scrupulously fair?
A. Scrupulously fair? I'm trying to be as fair as I can,
certainly.
Q. Are you? Can I suggest you might wish to try harder
when we look back at what it actually says in the first
paragraph.
Come four lines down. If you look -- if you come
four lines down, about two inches in from the left-hand
side margin:
"The mistake can have a significant impact on the
branch."
A. Sorry, where are we?
Q. Four lines down.
A. "... impact on the branch ..."
Yes, that --
Q. No, no. Do you see?
A. Yes, I have got that sentence.
Q. You have got the sentence that says:
"The mistake can have a significant impact on the
branch ..."
A. Yes.
Q. And you were trying to limit your agreement in answer to
my questions only to the last sentence which says:
"A very large value mis-keyed transactions ..."
A. Yes, but that sentence which you quoted to me goes on to
say:
"... resource is required in P&BA to manage the
client and address the error."
So the impact on the branch in that sentence is not
assumed to be but is implied to be a temporary impact
because it gets corrected.
Q. It does not say correct the error necessarily, does it?
A. "Address the error", I mean obviously addressing is
trying to correct.
Q. The other point you have not mentioned in this document
is recommendations on the document weren't in fact acted
on, were they?
A. I didn't follow through, no.
Q. Did you know that Post Office had not acted on the
recommendations in this document when you wrote your
reports, either of them?
A. I cannot recollect exactly what I knew or did not know,
but I have not paid attention to whether the Post Office
actually acted on the recommendations because, as I say,
user interface issues are very complicated and
I hesitate to be an armchair critic, if you like, of
somebody's user interface design and what steps they
took to improve it. That is a complicated issue when
you look at -- say somebody said "We can improve the
design. What do we do about it? Let's run some
trials". And what's the virtue of changing the design
versus the virtue of keeping it stable? For all those
postmasters who are using it perfectly correctly, you
want to keep user interface stable over the years. So
there are those trade-offs, all of which I haven't
looked at.
Q. Last question. Despite having done a lot of work on
user interfaces, you didn't actually try to analyse how
user friendly or prone to mis-keying the interfaces
were, did you?
A. I felt it was a difficult thing to do precisely for the
reason I have said --
Q. Yes or no?
A. No, I did not.
MR GREEN: Thank you very much.
Is that a convenient moment, my Lord?
MR JUSTICE FRASER: I think it is. This doesn't affect you,
Dr Worden. But if you want to go back to that
spreadsheet, I suggest one of your colleagues or you
maybe -- I would say based on my experience of the
bigger documents when I access them from my desk, five
minutes is probably ...
Thank you, 2 o'clock.
(1.00 pm)
(The short adjournment)
(2.00 pm)
MR GREEN: Dr Worden, at 2 minutes past 1 today we received
a big spreadsheet about ARQ requests in 2013. Is the
number of ARQ requests something that you know much
about?
A. No.
Q. Okay, I will leave that.
MR JUSTICE FRASER: Did that come with a covering letter, by
any chance?
MR GREEN: I think there may be one, my Lord.
MR JUSTICE FRASER: All right. Let's move on.
MR GREEN: I'm most grateful.
Picking up where we left off before lunch. Can
I ask you please to look at {F/1848.8/1}.
A. This is the big spreadsheet, is it?
Q. Yes, it is the big spreadsheet. This seems relatively
old in the sense it was disclosed on 31st May of this
year, but it is a draft input and information -- it is
"Draft Input & Information Provided to Support the
Post Office Internal Process" -- sorry, this is the
wrong one. Sorry. Can we get 1848.8.1, please? We
will come back to the table in a minute. We are after
{F/1848.8.1/1}, please.
MR JUSTICE FRASER: Are you looking at the common screen?
MR GREEN: Yes.
MR JUSTICE FRASER: Is that not what you were expecting?
MR GREEN: No. My Lord, it is a normal document.
{F/1848.8.1/1}. That's very kind, thank you.
Now, you see this is a -- this document is headed
"Draft Input & Information Provided to Support
Post Office Internal Process".
A. Yes.
Q. Now, this is a document relating to an incident on
4th March 2019.
A. Right.
Q. So it is a recent matter in that sense.
A. Yes.
Q. And if we look at page {F/1848.8.1/2} and we look at the
box that says "What's the issue?", do you see that?
A. Right, okay.
Q. Just pause. Have you seen this document before or not?
A. I think there is something familiar about it actually.
I remember being puzzled about the phrase
pre-announcement interface and I'm still puzzled about
it.
Q. Okay. Let's just see what we can understand about it:
On 4th March an incident was raised that there were
failures in the pre-announcement interface to Horizon.
"The result of this was that branches had to
manually key the value of pouches received into Horizon
on receipt, rather than scanning a barcode for automatic
population of data including the value."
A. Yes.
Q. "This led to some manual keying errors where the wrong
value was keyed into Horizon."
A. Yes. So pre-announcements are something to do with
remming cash.
Q. Let's not focus too much on pre-announcement, let's look
at what the problem is, if we may?
A. Sure.
Q. Let's take that bit in stages. The advantage of having
a scanner and a barcode is that if the system is working
correctly it will correctly rem in that patch?
A. Yes.
Q. So in a sense, that is a desirable aspect of a system in
general?
A. Yes.
Q. And that wasn't working, we can see?
A. As a result of the pre-announcement failure, yes.
That's interesting.
Q. So the branches had to manually key the value of the
pouches received into Horizon on receipt?
A. Yes. So they had to count the cash, it feels like --
Q. No, they had to key in the value.
A. So there is a label which says --
Q. Yes. Okay? This led to some manual keying errors where
the wrong value was keyed into Horizon.
Then if you look in the "Impact", it says:
"Branch: some manual keying errors resulting in
overstated sterling or foreign currency positions."
Yes?
A. Yes.
Q. You see there is no number of branches identified there,
next to that?
A. That is right, yes.
Q. And under "Impact" you see in brackets:
"Include number of branches impacted and the detail
of the impact."
A. Yes.
Q. And the financial accounting impact is:
"Holdings at branches needed to be corrected."
A. Yes.
Q. So at this stage what is showing on the face of the
Horizon system is wrong as a result of what has
happened?
A. Yes.
Q. And it says:
"Some manual keying errors ..."
Yes?
A. Yes.
Q. Resulted -- as a result the wrong value was keyed in,
yes?
A. Yes.
Q. Just pausing there. Would you regard that happening as
a problem with the system or would that be the
subpostmaster to blame? From your perspective as
an expert looking at the reliability of the system?
A. Well, obviously failures in pre-announcement is some
sort of failure in the system which causes a higher
propensity to keying errors.
Q. Yes. And it looks from that at least that the keying
errors might be those of the SPMs?
A. Yes, it sounds like it.
Q. If we look at page {F/1848.8.1/3} and we go down to the
entry on 8th February:
"This communication to all branches had already been
sent based on a previous incident, reminding them not to
enter decimal places and to take extra care when
entering remittances manually."
A. Yes.
Q. What they say there is:
"When entering a sterling (notes/coin) or foreign
currency Remittance manually onto Horizon NEVER enter
the value by including a decimal point followed by two
zeros."
A. Yes.
Q. That's quite a common way of putting numbers into
systems, isn't it?
A. I must admit it looks strange to me, because I think
somewhere else in this document you get quite a big
error if you put the decimal points in.
Q. Let's look at that. You are obviously familiar with the
document?
A. I have seen the document before, yes.
Q. So taking it in stages, if we may. From a design
perspective if you want to avoid errors of this type,
that set up is not really as you would have designed it
Dr Worden yourself, is it?
A. As I say, I'm very afraid of taking a user interface
decision myself, but it does seem strange to me, yes.
Q. It is bizarre, isn't it, actually?
A. I don't know. There must have been some reason for not
entering decimal points. I don't know what the reason
might be.
Q. Let's have a look. What he says is:
"Doing so will result in incorrect totals being
entered ..."
MR JUSTICE FRASER: Where are you?
MR GREEN: This is at the bottom of that box, do you see?
On page 3.
A. Which box?
MR JUSTICE FRASER: 8th February 2019.
A. Ah yes, sorry.
Q. Sorry, it's slightly --
A. "Doing so will result in incorrect totals being entered
... extra care ..."
Yes.
Q. Do you see:
"Doing so will result in incorrect totals being
entered. Please take extra care when entering
remittances in manually."
Yes?
A. Yes.
Q. If we go over the page, please {F/1848.8.1/4}, you can
see the 5 March. Do you see that?
A. Yes.
Q. "This communication to all branches was sent following
the new pre-announcement interface issue:
"We have seen a higher than normal number of
incidents where Foreign Currency remittances did not
auto populate which required branches to manually key
the amount into Horizon. As a consequence of this we
have become aware of some branches mis-keying either the
wrong currencies and/or amounts into Horizon which will
result in a mis-balance in branch at declaration stage.
This will also mean that your automated currency
replenishments will be affected."
And so forth.
At the bottom it says:
"A general remainder for all branches to take extra
care if they are required to manually enter remittance
values into Horizon."
Do you see that?
A. Sorry, I'm just reading the bullets in between.
Q. Please do.
A. Right, okay.
Q. Now there's no hint there that the problem is about the
missing decimal point, is there, on the 5th?
A. This announcement to the branches doesn't seem to
mention the decimal point issue explicitly, I agree with
that.
Q. If we look, please, over the page {F/1848.8.1/5}, we
have got on -- sorry, can we just go back.
{F/1848.8.1/4}
When it printed out, my Lord, ours looks different.
Just give me one second.
If you look on 4th March at the bottom of that page,
do you see:
"Formal incident ... raised during back office
transformation early life support and issued to
Fujitsu."
Yes?
"Status Update"?
A. Yes.
Q. Then if we go forward, please, a page {F/1848.8.1/5},
you will see there that there is -- if we look at
6th March 2019, if you look down you will see -- they
are not in order, but there is a second 6th March 2019
saying:
"Report showing list of failed pre-announcements
requested --"
A. Oh, yes. It messes the order around.
MR JUSTICE FRASER: Sorry, where are you reading?
A. After the 7th it goes back to the 6th again.
MR GREEN: Yes. Do you see that?
A. "... list of failed pre-announcements requested, to be
cross checked against branch rem-ins."
Q. Yes. If we go over the page {F/1848.8.1/6}, we can see
what the errors actually look at -- look like from
branches that have reported a keying error?
A. Yes. And the interesting thing here is some of them are
a factor of 100 and some of them are a factor of 10,
I think.
Q. Which one is a factor of 10?
A. 3,500 booked as 35,000.
Q. So there appears to be one that looks as though it might
be a factor of 10, but all the others are a factor of
100 --
A. -- I haven't checked it out but there's both there, yes.
Q. So it looks like, for the most part, entering in
10,000.00 euros gives you a mis-keying error by entering
instead 1,000,000 euros?
A. You usually get a factor of 100.
MR JUSTICE FRASER: There are at least two that are a factor
of 10, I think. Meliden Road and New Quay.
Q. But for the most part it looks like they are mostly
multiplied by 100?
A. Yes. And I suppose the factor 10 could be where they
have entered one decimal point.
Q. It might be. That is not an ideal design, is it?
A. It doesn't seem good to me. The only remark I would
make is this was something that was not part of the
mainstream design. The mainstream design was do the
barcode.
Q. Understood. But the barcode failed, and as a result the
system was designed in such a way that if people entered
in what's a perfectly reasonable approach to entering in
a number, they risked a multiplication of the sum by 10
or 100.
A. I agree, this feels strange to me. But I hesitate to do
armchair design of user interfaces.
Q. But I'm not talking about armchair design of user
interface, I'm saying if their report of how the system
reacts is right, that is going to enter into the system
an incorrect figure --
A. Yes, yes.
Q. -- and the figure on the system will be wrong?
A. Yes.
Q. And it will then have to be corrected by a transaction
correction?
A. Well, there's two safety nets here. There's TCs, if it
is discovered centrally, and there's also the daily cash
count which would also pick it up.
Q. I'm not talking about discovery, I'm saying it has to be
corrected by a TC. That's what they say in --
A. Not necessarily -- oh, yes, I think if you are doing
a cash count and you see a discrepancy, you don't -- do
you correct it at the time? I'm not sure. But the
postmaster would see a discrepancy in his daily cash
count.
Q. If you can't reverse a rem in and there is an error, if
you take it from me, on the premise that you can't
reverse a rem in, if that is right --
A. Well, on Dalmellington they did reverse rems.
Q. Let's take it in stages. If you can't reverse a rem
in --
A. If you can't.
Q. -- it has to be corrected by a transaction correction?
A. And you may well ask for one, you say.
Q. If you can, there is an opportunity if you spot it
potentially for the subpostmaster to do it?
A. Yes.
Q. What we know here is that the subpostmaster reported
a keying error, and we can see in this document that, if
we look back at page {F/1848.8.1/2}, in
"Financial/Accounting Impact":
"... needed to be corrected."
Do you see that?
A. Yes.
Q. And if we go forward one page to 27 February,
{F/1848.8.1/3}.
A. I have the 28th.
Q. There we are. Do you see on 27 February:
"Branches who called the to report the issue were
advised to declare the correct cash on hand at branch.
Branches who have made keying errors will receive
transaction corrections processed by the FSC."
A. Yes.
Q. So it is right, isn't it, Dr Worden, that first of all
what we have there is a defect in the system in that the
scanner remming in didn't work?
A. The announcements somehow caused that, yes.
Q. But we had a defect, yes?
A. It does seem to be.
Q. And that caused subpostmasters to have to manually enter
in the figures?
A. Yes.
Q. And do you accept that having that decimal point problem
is also a defect in the system?
A. As I say, it seems a strange user interface to me.
Q. Yes. But come on, it is a defect?
A. It is not good.
Q. It is a defect?
A. I hesitate to say it is wrong. It probably is wrong.
Q. Thank you.
If we can finally look at what I have got as page
{F/1848.8.1/5}, it is 7 March 2019. Let's go back to
that, please.
We looked at this. If you look at the bottom
populated row, 7/3/19.
A. Yes.
Q. "Issue discussed at BOT Steerco. Action logged to follow
up with Fujitsu requested to confirm process and
controls in place to ensure that this is proactively
managed in the future."
That doesn't suggest necessarily a fix, does it?
A. I would have to read the whole thing. And I agree that
if the coder -- supposing there was some error in code,
supposing pre-announcement failure was an error in code
somewhere, which I don't know, and supposing that had
been fixed, then this last comment is -- I would have to
take time to try and understand what that meant.
Q. In your experience of systems of this sort, when we
looked at the communication to the branches, which
didn't actually spell out the decimal point problem
immediately afterwards, is that how you have seen people
generally communicate with their users in the past?
A. Well, I think earlier in here we saw some say -- some
statement that says you must advise the branches not to
do the decimal point. Then we saw another announcement
which didn't refer to the decimal point. And again
I would like to untangle what those two mean together.
Q. Dr Worden, the short point is this: the earlier one
referred to in the 8th February 2019 specifically says:
"... NEVER enter the value by including a decimal
point followed by two zeros."
A. Can we go back to that and see what the status of that
sentence is?
Q. By all means. It is on page {F/1848.8.1/3}, I hope. Do
you see the guidance to the word "never" in capitals?
A. So some communication to branches had been sent on
a previous incident, and that's what's said about the
decimal point, but on this one they didn't for some
reason.
Q. Yes. So we can see what was said on the previous
incident, highlighting the problem and telling people to
avoid a decimal point, yes?
A. Yes.
Q. After the problem actually causing some quite big
discrepancies, the communication that they actually send
out on 5 March, on the next page --
A. Sorry, can we go back. I was just reading that page.
Q. I think we have done 8th February.
A. I'm reading the 18th now.
Yes. Okay, thank you.
Q. {F/1848.8.1/4}. So the 18th February one doesn't say
anything about the decimal point?
A. No, but I think what we seem to have is the 8th February
says don't do this, and the 18th February says if you
have done this and there is a problem, do this.
Q. Well, what it doesn't say is that the problem is
actually -- I mean, if you look at the way it is phrased
in the second line, it says:
"As a consequence of this we have become aware of
some branches mis-keying ..."
A. I'm on the wrong page.
Q. Sorry, go up, please. {F/1848.8.1/3}
MR JUSTICE FRASER: Are we looking at the 5th March entry?
MR GREEN: We are trying to look at the top of the 18th
February, my Lord.
MR JUSTICE FRASER: We need to go back to page 3, please.
A. Right.
MR GREEN: So let's look at the second line there. Well,
let's read the whole thing:
"We have seen a higher than normal number of
incidents where Foreign Currency remittances did not
auto populate which required branches to manually key
the amount into Horizon. As a consequence of this we
have become aware of some branches mis-keying either the
wrong currencies and/or amounts into Horizon ..."
A. Yes.
Q. They don't say that's because of a failure with the
system itself --
A. Sorry, they then say or they don't say?
Q. It does say it didn't auto-populate?
A. Yes.
Q. Then it says:
"As a consequence of this we have become aware of
some branches mis-keying either the wrong currencies
and/or amounts into Horizon which will result in
a misbalance in branch at declaration stage."
A. So this announcement is covering two cases, an error in
the number and an error in the currency.
Q. Well, the announcement is referring to two cases which
we don't seem to see any examples of in the list?
A. We don't in the ...? Sorry, I missed that.
Q. We didn't see any examples of that in the list at the
back here?
A. No, we didn't. We saw amounts only in the list.
Q. And it doesn't refer to the problem with the decimal
point, does it?
A. This one doesn't. As I say, the 8th February says --
Q. Take it in stages. We know the 8th does. This one
doesn't. There has just been an incident. What is
happening is if you put in a decimal point and two zeros
on Horizon in a way that you have accepted is wrong, it
adds the two zeros or the one zero to the number, and it
doesn't say that?
A. This announcement doesn't say that. This announcement
says when this damage has been done here's what you do.
Q. And if you want users to be able to diagnose what is
going wrong, you need to tell them what the problems
with the system are candidly, don't you?
A. I demur from that. Telling users about problems in the
system is -- can be too much information. Telling users
what to do is what I think is most useful.
Q. So were they right or wrong to mention the decimal point
the first time?
A. They were right.
Q. Were they were right or wrong to not mention it the
second time?
A. I don't know.
Q. Dr Worden, when there's just been a flash of people
getting £900,000 discrepancies, things like that, if you
are being candid you say: this is due to a fault, or
whatever you want to call it, in the system by which the
decimal point is ignored?
A. You might say that --
Q. If you were being candid you would --
A. If we return to the point that the first announcement
was don't do this, and the second announcement was if
you have got problems from either amounts or the right
currency here's how to fix them, here's how to sort it.
So the purpose of the two announcements are rather
different and I don't know enough background to say that
the decimal point point should have been repeated.
Q. Let's go to the table, the Excel spreadsheet, which I
think very kindly we have very got prepared to come up,
which is what we were going to look at before. This is
the one that you had a bit of a poke around in?
A. Yes.
Q. To get the table that you have referred to, and we will
have a look at it in a minute, at table 9.3 in your
report?
MR JUSTICE FRASER: Can you just remind me of the trial
bundle reference of this.
MR GREEN: Certainly, I was just about to read it out
{D3/1/208}.
MR JUSTICE FRASER: No, the one on the common screen.
MR GREEN: I apologise, my Lord. It is {F/987/1}.
MR JUSTICE FRASER: Okay.
MR GREEN: You went down to look for the relevant table to
use and had a look around.
A. Yes, but obviously the most relevant table was the one
that appeared in my report.
Q. I understand. That was the one you felt was most
relevant?
A. Yes.
Q. And if we go down to row 46, please?
A. That's a header.
Q. Yes.
A. "Volume net value."
Q. That is the table you reproduced?
A. That's it, okay. The numbers look familiar.
Q. Yes?
A. Yes.
Q. That's the one you reproduced, and it is to do with
branch errors, isn't it?
A. Yes.
Q. You did not reproduce the table immediately below it
which is for other errors, did you?
A. That's true, yes.
Q. Why not?
A. Well, why would I have wanted to? (Pause)
For completeness it would have been useful but
I felt -- as far as the distribution of TCs and the
distribution of erroneous TCs, but I agree I could well
have quoted that last table and it would have been
useful to do so --
Q. I'm going to ask you to give his Lordship a candid
answer: was that a mistake or was it deliberate?
A. It certainly wasn't deliberate. It wasn't, if you like,
an oversight or a wrong editorial decision, if you like.
But the question I'm asking myself is how that adds to
the information?
Q. Isn't it obvious, Dr Worden? TCs that do not arise from
what even Post Office regards as branch errors might be
highly relevant to any analysis that you might wish to
conduct?
A. Well, my intent in looking at this top table was to get
an idea of the proportions. Now, if we find that the
proportions in the bottom table radically alter the
overall proportions, then that is a problem. But I was
looking at the proportion -- what I was looking at was
how big is this, how big is that, and so on. And indeed
I overlooked some issues in my first report. I didn't
spot the fact that Santander online banking, while small
in volume was huge in value, and that's an important
point in my second report.
So I was looking for overall proportions to say what
are the important things here.
Q. If we just look, the bottom table is the table that even
in Post Office's mind relates to TCs which were not
branch errors?
A. Yes, absolutely.
Q. It is rather what this litigation is concerned with,
isn't it?
A. No, I do not think so. That is not -- TCs arising from
other areas is TCs arising from something not in the
branch, but that TC is probably correct and therefore
not imputed on the branch.
Q. So cash rems to branches, 2011/12 out-turn. The fact
that there are 4,093 TCs, which even in Post Office's
mind are not the result of a branch error, is not
relevant to your analysis of how the system works?
A. Well, 4,000 as opposed to 21,000 in the table above. It
is an interesting figure, that, and I hadn't really
drawn my attention to it at the time of my first report,
I agree.
Q. We know that. That is the premise of my question. When
you answered my earlier question you said it was either
an oversight or an editorial decision.
A. I was not very conscious of that second table. In other
words, I said what's the table to put in as the summary
of the proportions, and I chose that table.
Q. The word "chose" suggests it was a conscious choice
between the two. It wasn't. You just found one and
popped that in --
A. I found one which I thought was indicative of the
proportions and I used that one, yes.
Q. Let's move on.
Now, you gave evidence earlier I think, and I think
this is common ground, that you and Mr Coyne adopted
slightly different approaches. You adopted more of
a top down --
A. The whole thing, to the whole --
Q. Yes. And started the architecture and looked into the
KELs, and Mr Coyne was looking through the KELs and
PEAKs and so forth trying to identify --
A. Well, I should say I started the architecture, looked at
the processes and looked at the KELs, yes.
Q. I think you started with the 75 documents Mr Jenkins
gave you?
A. That is right, there was an early tranche --
Q. Was he able to describe those documents and what to look
at when you spoke to him?
A. No, it wasn't Mr Jenkins who gave me those 75. I had
this early tranche of documents which was mainly high
level architecture stuff.
Q. Do you know who those were provided by?
A. Just lawyers said "Look at these", you know, it was
really early months.
Q. I see. And in the second --
A. I mean they said "More's coming but here's something to
go on".
Q. I understand. In the second joint statement I think you
and Mr Coyne, if we look at {D1/2/28}, that's the second
joint statement. If we look on page 28 at item 1.8.
A. "Extent".
Q. You make the point at 1.8 with regard to extent, yes?
A. Yes.
Q. You say:
"In order to address Horizon issue 1, it is
necessary to define measures of the extent of bugs with
possible impact on branch accounts."
A. Yes.
Q. So you appreciated that was necessary for the purpose of
Horizon Issue 1?
A. That's my view, yes.
Q. And having some sort of idea for the order of magnitude
of something is obviously quite a good starting point,
isn't it?
A. Yes.
Q. Is it 1 or 10 or --
A. Also, I mean not only the question is it 1 or 10, but
what's the scope with which -- in other words, if I'm
asking a question about likely, what is the scope of
likely that is interesting?
Q. We will come to that. But if you look at a particular
bug and you are just looking to try and identify the
data, it is helpful to know whether it affects one
branch alone or perhaps 10 or 20?
A. Absolutely, yes.
Q. Because that is a significant difference for the
purposes of what you might infer from it. And we agreed
on Tuesday that if it has actually impacted a branch and
the branch accounts, it obviously had the potential to
do so. Yes?
A. I agree with that, yes.
Q. But in order to have the potential to do so it is not
necessary to find that it actually did in a particular
case?
A. I think potential is wider than actual, yes.
Q. Exactly. I want in a moment to take you to some of the
bugs specifically and go through them, but can I just
clarify one point first in relation to paragraph 650 in
your first expert report at {D3/1/153}.
A. 650, I will just get that. Yes, "Receipts/Payments
Mismatch". Okay, that is the beginning of the analysis
of the receipts/payments mismatch, yes.
Q. If we look at page {D3/1/153}, you will see there that
in paragraph 650 you are referring to the receipts and
payments mismatch issue, yes?
A. Yes.
Q. You refer to where it is in Mr Coyne's report, you say:
"It involved a bug in Horizon which was triggered by
a rare circumstance (which one would not expect to be
exercised in testing) and which had an effect on branch
accounts."
Then you say:
"If Mr Godeseth's evidence about this bug is not
accepted, I shall revise my opinions accordingly. They
are based on written evidence - particularly on a
written analysis by Gareth Jenkins ..."
Yes?
A. Yes.
Q. "... as well as the second witness statement of
Mr Godeseth."
Pausing there. Were they not also based on the
conversation you had specifically had with Mr Jenkins
about the receipts and payments mismatch bug?
A. That helped to clarify my understanding of the
documents. I could read the documents I think with
a little more confidence once Mr Jenkins had explained
some things. I was particularly interested in double
entry accounting and how that applied and the
conversation with Mr Jenkins did clarify that.
Q. What was Mr Jenkins able to add that we don't find in
the documents, if anything?
A. It was not so much that he added anything, it was that
I had -- not in the documents -- I had started from my
own experience and my own thoughts about system design
and I had thought double entry accounting might be
applied in a certain way. And it appeared, it emerged,
as Mr Jenkins' document made clear, and he I think
reinforced to me, that double entry accounting is not
applied to the roll over in quite the way I had
understood.
Q. And what was the difference between what you had
understood and what he told you?
A. That certain operations in the roll over were not double
entry.
Q. And which were those?
A. It was to do with calculating a final month figure from
an initial month figure and adding all the transactions,
as I recall. I realised, reading Mr Jenkins' document
again in the light of that conversation, that double
entry accounting was applied in Horizon in more
complicated ways than I had understood.
Q. Did you set that out -- set out that more nuanced
understanding in your report somewhere?
A. I believe I did. If we look at DEA in this section
I believe we will find the reference to the fact that
DEA -- here we are. 654.2 is pretty much it.
Q. That's what came from Mr Jenkins, did it?
A. That's what came from my final understanding of the
documents, having had a few words from Mr Jenkins which
made it clearer to me and made me think about how double
entry accounting might be applied in such a system and
the fact that, for accumulation exercises like that, it
may well be sensible not to apply double entry
accounting in the kind of direct way which I had first
thought was appropriate. So this was a matter of my
experience versus the documents, if you like.
Q. So you were expecting double entry accounting to apply
across the board and you discovered --
A. I was expecting it to be more comprehensive and more
immediate. Obviously at the end it applies because it
goes to POLSAP, and POLSAP does (inaudible) accounting,
but I was expecting it to be rather more immediate.
Q. Within Horizon you were expecting?
A. Yes.
Q. And what other operations were apparently not double
entry operations? Can you remember?
A. I can't think of any off the top of my head but my
feeling is that customer transactions are double entry.
Q. You can't remember others that aren't?
A. I can't remember offhand.
Q. That's a fair answer. Sorry, that is a matter for his
Lordship.
So can we look now please at Callendar Square --
just before we move off receipts and payments mismatch,
Mr Jenkins didn't give you any details on the phone of
how and exactly when and indeed whether every single
person in the receipts and payments mismatch bug had
actually been compensated, did he?
A. No, we didn't talk about that aspect.
Q. So you have no more information about that than we have
in the documents?
A. No.
Q. If you can move to Callendar Square, please. Can
I understand, when you wrote your first report you had
obviously had to look into some of these bugs?
A. Yes.
Q. And you had been told about how many by Post Office in
your instructions?
A. Well, I had been told about the three. I was looking
for more. But the three were the three obviously that
were a focus of those --
Q. And they were the three acknowledged bugs that
Post Office had acknowledged in its letter of response?
A. Yes.
Q. So the suspense account bug?
A. Yes.
Q. Callendar Square?
A. Yes.
Q. And the receipts and payments mismatch?
A. That is right.
Q. No one at Post Office had told you about any other bugs?
A. I wasn't relying on Post Office to tell me about bugs or
Fujitsu. I mean I was relying on me digging around.
Q. So you were left to see if there were any more than
those three and dig around?
A. That was the exercise I understood I was doing, yes.
Q. I understand. If we look please at {D3/1/156} in your
first report, and if we look at -- just to give you
context to see where you are, do you want to go back to
the previous page, very kindly, just to show Dr Worden.
{D3/3/155}
Dr Worden, you can see this is under your heading
8.6.2, "The Callendar Square ..."
A. Can I just remind myself.
Okay, yes.
Q. Okay? Over the page at 663 {D3/3/156}, after describing
how stock would disappear from the sending stock unit
and not appear in the receiving stock unit, which is
662:
"... a failure of double entry accounting which was
not evident to the subpostmaster at the time."
You go on to deal with this.
So this is another aspect, isn't it, in which on
this occasion there was a failure of double entry
accounting rather than an absence of double entry
accounting, is that fair to distinguish between the two?
A. I'm not quite sure. I mean, a failure rather than
an absence ...
Q. Well, what I'm really asking you is in relation to your
conversation with Mr Jenkins you told the court that you
identified an issue there where the operation concerned
was not governed by double entry accounting?
A. Yes.
Q. And here, on the face of it, it looks as if this did
not -- you can see, if you look at 663 you see:
"In my opinion, under the later Horizon Online
software this failure of DEA might have been immediately
manifest as a failure to send a zero-sum basket to the
BRDB. But in old Horizon, apparently it was not
immediately detected, so in this respect Old Horizon was
possibly less robust than Horizon Online."
A. Yes.
Q. That follows from 662 where you have identified that the
result of the problem, which was a time out or locking
problem somewhere inside the Riposte product, was that
the stock would disappear from the sending stock unit
and not re-appear in the receiving stock unit?
A. Or there might be a double -- I think it might have come
in twice on some occasions as well.
Q. Just focus on this point that you are dealing with at
662 first, if we may. You say at 662:
"... a failure of double entry accounting which was
not evident to the subpostmaster at the time."
A. That is right, yes.
Q. Just pausing there. What actually is happening is that
what Horizon is showing on the system is wrong?
A. Showing to whom? You mean storing in its database?
Q. Yes. What Horizon is recording is wrong?
A. Yes, I think so. I mean I think Callendar Square
typically was, you would transfer out of a stock unit
once and because of these Riposte problems you might
transfer in twice.
Q. Okay. Let's look. You see at 662, the sentence I'm
asking you about is on the second line, after the dash:
"... a failure of double entry accounting ..."
Yes?
A. Yes. I mean double entry accounting is something goes
out of one stock unit into another and they must exactly
balance, so if they go in twice, as appears to happen at
Callendar Square, that is a failure of double entry
accounting, yes.
Q. Yes. Because the initial failure was not evidence to
the subpostmaster, you say that at 662?
A. Yes. He didn't see it immediately and it wasn't brought
to his attention straightaway.
Q. Exactly.
So let's look at 664 and you say:
"While the failure was not immediately visible to
the Subpostmaster at the time of the stock transfer, it
would always be visible later when balancing stock
units."
A. Yes.
Q. You see that?
A. Yes.
Q. You say, referring to Mr Godeseth:
""It was also, as Mr Godeseth says at paragraph 13.7
of his Second Witness Statement, soon visible to Fujitsu
in two different ways (a flag from overnight processing,
and a system event)."
Yes?
A. Yes.
Q. And you identify that as potentially one of your
robustness measures?
A. Yes.
Q. You then say:
"So in the normal course of events, the
Subpostmaster would see a discrepancy of some large and
easily identifiable sum (because stock unit transfers
generally involve larger sums than customer
transactions) and would know, since he had not made any
mistake to call the help desk. This was countermeasure
MID."
A. Manual inspection by the postmaster of his stock, yes.
Q. Yes. So the point you are making there is that what you
have described at 665 is the countermeasure of manual
inspection of data?
A. That's a part of it. It can be manual inspection by
lots of different people.
Q. Yes.
A. It can be back office or it can be the postmaster or --
Q. And you say:
"As is shown by the PEAKs, the presence of the
Riposte error was easily identifiable from system logs
so the help desk would know it was not a user error and
Post Office could correct any discrepancy if it arose in
the branch accounts."
A. Yes.
Q. It actually doesn't sound that bad?
A. Well, we always have this issue of if there is
a discrepancy, how obvious is it and therefore how much
can one infer about whether it is likely to have been
corrected or not? And receipts/payment mismatch, which
I think this eventually led to, is a pretty prominent
red flag to Fujitsu. And so a lot of receipts/payment
mismatches I would expect -- you see them in PEAKs when
they occur and you see the amount involved, so I would
expect on a high proportion of cases generally
R/P mismatches would be sorted out.
Q. On 662 you fairly observed it wouldn't be evident to the
subpostmaster at the time, that's when it happens, yes?
A. That is right.
Q. If we go over the page to 667 {D3/1/157}, you say there:
"At paragraph 15 of Mr Godeseth's Second Witness
Statement, he says that this bug had impact on branch
accounts in 20 [branches]."
Yes?
A. Yes.
Q. You then go on to reason as follows:
"For the receipts/payments mismatch bug, there is
evidence that affected branches were compensated."
A. Yes.
Q. We will come back to that.
"Because of this evidence, and because Fujitsu could
always spot any occurrence of the bug in event logs, and
because neither Post Office or Subpostmaster wanted
Subpostmasters to suffer shortfalls from bugs in
Horizon, I would expect the Subpostmaster to be left
with a shortfall (i.e. not compensated) in only a small
minority of cases, if any cases."
A. Yes.
Q. Now, pausing there, have you actually seen any evidence
of any actual repayments to the subpostmasters and
subpostmistresses who suffered in the receipts and
payments mismatch bug?
A. No, I've seen that there was careful tabulation of the
discrepancies, that's all I've seen. The actual
compensation process is outside the PEAKs and so on,
so --
Q. Let's have a quick look while we're on the point and
then we can take a break, if we may, when I finish this
point, my Lord.
{F/1001/1}. You have seen this document?
A. When it comes.
MR JUSTICE FRASER: Is it 1001/1 we are going to?
MR GREEN: It is, my Lord.
A. This one, yes. Fine.
Q. "Receipts/Payments Mismatch issue notes". Attendees are
from service delivery, security, network, IT, POL
finance and Fujitsu:
"Discrepancies showing at the Horizon counter
disappear when the branch follows certain process steps,
but will still show within the back end branch account.
This is currently impacting circa 40 Branches since
migration onto Horizon Online, with an overall cash
value of circa £20k loss."
A. Yes.
Q. Do you see that?
A. Yes.
Q. If we go over the page {F/1001/2}, we see halfway down:
"Note the Branch will not get a prompt from the
system to say there is Receipts and Payment mismatch,
therefore the branch will believe they have balanced
correctly."
Do you see that?
A. Yes.
Q. This is just a subpoint in relation to receipts and
payments mismatch. That is not the system alerting the
subpostmaster or subpostmistress to what's going on, is
it?
A. I agree that is different from other cases where I think
receipts and payments mismatch shows in a trial balance
or something that the postmaster sees.
Q. Honestly, Dr Worden, does that bit take you by surprise?
A. It does a bit actually.
Q. I'm grateful.
My Lord, is that a convenient moment to pause?
MR JUSTICE FRASER: Yes. Come back in at 3 o'clock.
(2.52 pm)
(A short break)
(3.00 pm)
MR GREEN: So Dr Worden, just picking up where we were
before the break, this was in the context of your
inference for the purposes of Callendar Square that
given the experience in the payments mismatch case, you
had confidence broadly in the matter being corrected.
A. I would say when an R/P mismatch is evident, in my view
there is a high probability that it will be sorted out,
the effects will be sorted out.
Q. I understand. Just to clarify the position, if we look
at this document that we are looking at now {F/1001/3},
if we go back up one page, please {F/1001/2}, just under
"Impact" it says --
A. Sorry, can I -- sorry to do this, but can I go back.
{F/1001/3}
The statement that surprised me said the branch will
not get a prompt from the system.
Q. Yes, that's just above.
A. So he has to look at two numbers to see there is
a mismatch rather than it being hidden from him.
Sorry about that. Let's get on, sorry.
Q. Isn't the true position on receipts and payments
mismatch that it will appear to balance when it hasn't?
Isn't that the real problem? Not that he has to look to
find out, it is not just the absence of a prompt.
A. I do not think that's it. I think there is -- he gets
a report and it has receipts on it and payments on it
and the two figures are not the same.
Q. Well, this receipts and payments mismatch issue is not
that, Dr Worden. Look at the very page we are looking
at now. {F/1001/2}
A. Yes.
Q. The sentence I was about to take you to, under "Impact":
"The branch has appeared to have balanced ..."
A. Okay, yes. Sorry about that.
Q. "... whereas in fact --"
A. "Appeared to have balanced" seems to be that it appears
to balance, yes.
Q. Pausing there. It wouldn't be apparent to the branch,
would it?
A. It sounds like it, yes.
Q. And that's a fundamental point about this bug?
A. It doesn't appear to the branch.
Q. Yes.
A. Yes.
Q. If we look what they say underneath, they say:
"Our accounting systems will be out of out of sync
with what is recorded at the branch."
A. Yes, so --
Q. That's obvious?
A. RDS will pick it up.
Q. And it says:
"If widely known could cause a loss of confidence in
the Horizon System by branches."
A. Yes.
Q. "Potential impact upon ongoing legal cases where
branches are disputing the integrity of Horizon data."
A. Yes.
Q. "It could provide branches ammunition to blame Horizon
for future discrepancies."
A. Yes, okay.
Q. You see those?
A. Those last three points are kind of ramifications on --
Q. Now, if you are going to rely on your users to help you
monitor what's going on with the system, is being candid
with them about a clear problem to be expected for that
countermeasure to work properly?
A. Yes, but I think for a problem one has to decide in
terms of communication with users how many are affected
and how many are likely to be affected and whether
therefore you are going to confuse the great majority of
users by telling them about some problem that occurs to
a tiny minority. So there are trade-offs there about
how you communicate with users.
Q. And in terms of the inferences you might draw in your
professional opinion about the effectiveness of the
approach we see on this page?
A. Yes. So the approach is?
Q. Post Office's approach to this on this page appears to
be regarding at least as material or influential factors
worries about loss of confidence in the Horizon system
if it gets out that this has happened, ongoing legal
cases, and branches getting ammunition to blame Horizon
for future discrepancies.
A. Yes.
Q. Would you normally expect those factors to feature in
your idea of the UEC countermeasure of how it should
work ideally?
A. Those three bullet points are kind of psychological
points about how it would influence mindsets and they
don't seem to me to have a very direct bearing on UEC.
Could you spell it out?
Q. Dr Worden, I probably didn't ask the question well
enough.
If Post Office is being held back from telling
people about established bugs in the system on that
basis --
A. I see.
Q. -- they are not making the best use of UEC, are they?
A. I see. So you are saying that these psychological PR
implications in their mind may influence their decision
whether to talk candidly with users.
Q. That appears to be the case. It is what they are
saying.
A. Well, they are saying here are some impacts. They are
not saying these impacts affect our decision. They are
pointing out that here is a possible impact.
I'm not being ingenious, really.
Q. You might have given the game away there.
Dr Worden, the reason they are listing those impacts
is because they are the impacts they had in mind in
weighing up what to do, because you can see the next
heading is "Identifying the issue and forward
resolution".
They are factors to which they are giving more or
less weight but they are factors?
A. They are factors that they are pointing out in this
summary of the whole impact of the incident. I'm not
clear whether they are saying these factors affect our
decision how to communicate with postmasters, I can't
draw that inference --
Q. Okay. Let's go over the page to {F/1001/3}. Top line:
"The Receipts and Payment mismatch will result in an
error code being generated which will allow Fujitsu to
isolate branches affected this by this problem, although
this is not seen by the branches."
A. Yes. This is the 902s and 903s I think referred to.
Q. And the "not seen by the branches" appears to confirm
what we have seen on the page above?
A. Yes.
Q. They say:
"We have asked Fujitsu why it has taken so long to
react to and escalate an issue which began in May."
A. Yes. So this is about September, isn't it?
Q. September/October time.
A. Right.
Q. And they are going to provide feedback.
If we just go down, the next paragraph begins
"Fujitsu", the one after that says:
"The code fix will on stop the issue occurring in
the future, but it will not fix any current mismatch at
branch."
A. Yes, I think it is obvious that you can't go backwards.
That fix is a code fix for future, yes.
Q. So the state of play as at the date of this document,
before they have decided what to do with affected
branches, is that the Horizon system is recording the
wrong figures. There is a difference between the
figures that the Horizon system is recording and the
ones at POLSAP which it should be recording?
A. There are discrepancies, yes.
Q. And the Horizon system has the wrong figures on them?
A. There are lots of figures around the place. Some of
them are wrong, yes.
Q. Look at "Proposal for Affected Branches", if you would:
"There are three potential solutions to apply to the
impacted branches, the groups recommendation is that
solution two should be progressed."
So that is just the recommendation at this stage.
"Solution one - alter the Horizon branch figure at
the counter to show the discrepancy."
So that would be, it looks like, dialling into the
counter and altering the figure that would show on the
counter?
A. "... alter the ... branch figure at the counter to show
..."
It is not clear to me which branches that applies to
at any given moment.
Q. They are talking about impacted branches as we can see,
because the heading says "Proposal for Affected
Branches", and the line underneath says:
"There are three potential solutions to apply to the
impacted branches."
So we know they are talking about the branches that
have been affected by this bug, don't we?
A. Yes.
Q. Then they say:
""Solution one - alter the Horizon branch figure at
the counter to show the discrepancy. Fujitsu would have
to manually write an entry value to the local branch
account."
A. Yes, that looks like, as you say, remotely going into
the branch.
Q. Okay, so that is something they were able to do and were
considering doing?
A. That was a possibility yes.
Q. "Solution two - P&BA will journal values from the
discrepancy account into the Customer Account and
recover/refund via normal processes. This will need to
be supported by an approved POL communication. Unlike
the branch 'POLSAP' remains in balance albeit with an
account (discrepancies) that should be cleared."
Yes?
A. Yes.
Q. "Impact - Post Office will be required to explain the
reason for debt recovery/refund even though there is no
discrepancy at the branch.
"Risk - could potentially highlight to branches that
Horizon can lose data."
A. Yes.
Q. So we can see that that is the adverse factor militating
against solution two?
A. Yes.
Q. Notwithstanding at this stage there were recommending
solution two, yes?
A. Yes, and they're saying solution two has this drawback
in that it draws attention.
Q. Yes. And then:
"Solution three - It is decided not to correct the
data in the branches (ie Post Office would prefer to
write off the 'lost'.
"Impact - Post office must absorb circa £20K loss.
"Risk - Huge moral implications to the integrity of
the business, as there are agents that were potentially
due a cash gain on their system."
So the point is although Post Office can decide what
it wants to do as one corporate body, there are lots of
different post offices and sub-post offices involved.
Some will have losses, some will have gains?
A. Yes, I can't fully interpret solution three.
Q. Okay. The short point we get from this document,
Dr Worden, is that the correction of what had gone wrong
was not automatic exactly, was it? It was discretionary
as to how they did it and whether they do it?
A. Yes, but this does refer to "recover/refund via normal
processes", as though there were processes to do it.
Q. It is not that there weren't processes. The question,
which I think you fairly accepted, was it was
discretionary rather than automatic?
A. Well, they were choosing how to sort it out. They had
three ways --
Q. And that was a discretionary choice that they had?
A. They had a choice of three ways to sort it out, yes.
Q. Now if we look at the joint statement for a moment
{D1/4/5} at 3.22.
A. Yes:
"... the same effects as a user error ..."
Yes.
Q. What you and Mr Coyne agreed is:
"Many software bugs can have the same effects as
a user error (as illustrated, for instance, by the
Dalmellington bug, which produced a remming error)."
A. Yes.
Q. And a remming error might look like a user error?
A. Absolutely.
Q. And that's why you refer to that?
A. Yes.
Q. Pausing there. I think you were here for Angela Van Den
Bogard's evidence, can you remember?
A. I do not think I was, actually. Sorry about this. But
I certainly read the transcripts.
Q. Did you see a reference to UEB in her cross-examination?
A. No, you would have to take me to it.
Q. User error --
A. Oh, UEB. It is a strange acronym.
Q. Yes, user error bias. It was put to her whether she
accepted that Post Office suffered from UEB or user
error bias from time to time in relation to --
A. I have never seen that acronym myself.
Q. I understand. But for the moment if it is right that
Post Office suffers from user error bias in its dealings
with subpostmasters, it is quite important, isn't it, in
the context of what you and Mr Coyne have agreed at
3.22, because you have agreed that many software bugs
have the same effects as user error. So they look
similar, and then the subpostmaster is faced with
dealing with an organisation that has a bias in favour
of assuming it's user error when they look the same?
A. If a software bug looks like a user error, the resilient
processes will compensate regardless of which one it is.
Q. Let's have a look and consider this in a little bit more
detail. If we go please to {H/6/3}, turning to
Callendar Square now. This is a letter of
11 January 2017.
A. Yes.
Q. If we look at page 3 of this letter, do you see 7.8.1 at
the top of the page?
A. Yes.
Q. This is Post Office's solicitors, Wombles, writing to
the claimants' solicitors in January 2017.
A. Yes.
Q. And there they say:
"The Falkirk/Callendar Square issue was only known
to have affected that one branch."
A. Yes.
Q. And you have identified that it affected 20 branches in
your report, that is correct?
A. Yes.
Q. If we look at how the Callendar Square story develops.
If we look at {F/297/1}, please. You are just going to
be given a hard copy of this, Dr Worden. This is
PC0126042. If we just go down to -- do you see
15/09/50, 10.28, just after halfway down?
A. "Unable to find relevant KEL."
That one?
Q. Yes. And underneath "Unable to find relevant KEL" is:
"Information: Faye at nbsc states that she went
through 2 hours of checks."
A. Yes.
Q. If we go down to "Recommend", which is about seven lines
down from the bottom?
A. Yes:
"Please investigate ..."
Q. " ... as to why the stock unit aa on node 3 and node 4
are showing varied amounts on counter daily reports."
If we go over the page very kindly {F/297/2}, we
have got at the top "Stock units vary on counters."
Sorry, it is not stock units, "SU cash amounts vary on
counters".
A. Yes.
Q. And we come down to the fifth box, "Cheryl Card",
underlined.
A. Yes.
Q. 15 September 2005 at 16.12.27:
"Due to the Riposte errors on 14/09/05 from 15:30
onwards (see call E-0509140700), messages were not
replicated on counter 3. As a result, 3 transfers in to
stock unit AA were done twice, initially on other
counters then again on counter 3. The transfers in were
for:
"3000.00 (cash)
"400.00 (cash)
"89.69 (cheques)
"This has resulted in a loss of 3489.69 in CAP 25 to
the outlet, which POL may need to correct via an error
notice."
A. Yes.
Q. "Phoned the PM to explain what the problem was. He is
concerned about other transactions which he has input
twice (3 Giro deposits and another cheque) because of
the replication problem. Have advised him to contact the
NBSC as this is a business issue."
Do you see that?
A. Yes.
Q. We know eventually that it was actually a bug?
A. Yes.
Q. But what he is being told here is at least for part of
this to contact the NBSC because it is a business issue?
A. Yes. I mean what seems to have happened here is that
because he had this stock problem which was caused by
a bug the postmaster started thinking I need to re-enter
these transactions, which was not to do with the bug.
He thought I have to re-enter these transactions. So it
is a little confused to me.
Q. The approach you have taken in your report is that
Post Office would -- you say:
"Neither Post Office or subpostmaster wanted
subpostmaster to suffer shortfalls from bugs in
Horizon."
A. Yes.
Q. Because that was in paragraph 667 which I took you to.
A. 667.
Q. It is on page 157. If we go back to that for a second.
A. Yes.
Q. You say there:
"Neither Post Office or subpostmaster wanted
subpostmaster to suffer shortfalls from bugs in
Horizon."
Yes? And it is obviously right that subpostmasters
didn't want to suffer shortfalls, did they?
A. That is right.
Q. But if Post Office was gaining money at the expense of
subpostmasters --
A. Yes.
Q. -- that in itself would not be an incentive to try and
give the money back, would it?
A. Well, I was asked to consider Post Office's motivations,
and in that context I think that one of Post Office's
motivations is to keep down the administrative problems
of things recurring and not being sorted, and if you
don't sort the discrepancy and the postmaster keeps
coming back and so on, your admin costs will soon rise.
So it is a complicated -- there is a lot of motivations
at play there.
Q. There are a lot of motivations at play. If
subpostmasters are, let's say hypothetically, pressured
to pay regardless of who is at fault and they just pay
up because of the way they are asked, hypothetically,
that reduces your admin costs a lot, and if they have
suffered a loss you don't have to give the money back,
so that meets two objectives?
A. That is part of the trade off. There will be the ones,
as you say, that just knuckle under and take it, and the
ones that keep banging the table will cost you a lot of
money.
Q. Just on that point, were you aware of any general
Post Office suspense accounts in --
A. Central suspense accounts?
Q. Yes.
A. Yes, there are I believe, and they may be to do with all
the dealings with some client.
Q. Okay. Well, what about -- because elsewhere in your
report, I don't want to stray too much at the moment,
but you also mention micro bugs, small bugs, being
unlikely because you would expect to see large sums of
money somewhere --
A. Money that disappears somewhere has to pop up --
Q. It's got to come back somewhere else, it's got to pop up
somewhere else.
Have a look at {F/333.1/1}, please. Dr Worden, I'm
asking you just to look at this to see whether you were
aware that an issue had been raised about it, not
evidence of it itself, yes?
A. Yes.
Q. This is the Second Sight report which you must have
seen?
A. The part two report I have seen, yes.
Q. You have. Let's look at page {F/1333.1/46}, please, and
if we look at 22.11.
A. Yes. (Reading to self)
Q. It says:
"We note that Post Office's control and
reconciliation procedures rely on correct information
being supplied by third party clients. It follows that,
if incorrect information is provided by any client
company, this can give rise to a loss being charged to a
branch. We also note that, for most of the past five
years, substantial credits have been made to Post
Office’s Profit and Loss account as a result of
unreconciled balances held by Post Office in its
Suspense Account."
Now I'm not asking you about that as evidence of
itself, I'm just asking were you aware that that was
a concern that Second Sight had raised about substantial
credits being made to Post Office's profit and loss
account as a result of unreconciled balances held by
Post Office in its suspense accounts?
A. I read the Second Sight reports and the Post Office's
reply.
Q. But did you spot that?
A. I didn't spot that, no.
Q. Just whilst we are on that, if you will forgive me,
going to the micro bugs point very briefly. If we look
at {D3/2/211}.
A. Yes.
Q. This is appendix F 2, your appendix F 2, and we are
going to look at paragraph 460 in relation to micro
bugs.
A. Yes.
Q. You say:
""Because POLSAP uses double entry accounting, in my
opinion any effect of micro-bugs on branch accounts must
also show, aggregated over all branches, in some Post
Office central account. If that effect were significant,
then in my opinion it would inevitably have been noticed
by some Post Office manager or external auditor."
A. Yes.
Q. But you weren't aware of what I have just shown you when
you wrote that?
A. No, no.
Q. And having seen that now, that would be at the very
lowest a line of enquiry that you would wish to follow
up before continuing to hold the opinion you have
expressed there?
A. I would like to kind of reconcile those two paragraphs
and work out how much I knew about Post Office central
accounts and that is limited.
Q. It would make a bit of a difference how substantial the
sums were as well, wouldn't it?
A. It would. I mean substantial -- one would like to know
what are the sums that Second Sight were referring to
versus what are the sums that micro bugs might add up
to. One might want to make that comparison in order to
drill further into that issue.
Q. Dr Worden, can I bring you back now to Callendar Square
because we are really looking at Callendar Square and
how it starts in the context of what you said you would
expect to happen.
Now, I have shown you what happened on receipts and
payments mismatch --
A. Any receipts and payments?
Q. No, the particular --
A. The particular one, right.
Q. And it was discretionary how they would approach it.
I have shown you the existence of the suspense accounts.
A. Yes.
Q. Does either of those alter your expectation of how
efficiently and helpfully the Callendar Square bug would
have been dealt with?
A. Sorry, which two points alter my expectation?
Q. The fact that there is a suspense account into which
unresolved unreconciled credits go and are ultimately
credited three years later to Post Office's accounts,
and the fact that it wasn't absolutely automatic that
a transaction correction would be issued, as we have
seen from receipts and payments mismatches. Do either
of those alter your expectations about how elegantly the
problem that Mr Alan Brown suffered at Callendar Square
would be sorted out one way or the other?
A. I think my opinion is if there is a receipts/payment
mismatch it gets noticed in several ways and my opinion
is there is a high probability that therefore it will be
sorted out.
Q. So it doesn't change your view?
A. I do not think that view has changed, no.
Q. I wanted to ask you that because it seems to bear on the
introduction of your analysis of Callendar Square.
Let's see what actually happens at Callendar Square.
We have looked at the PEAK at {F/297/1}, if we go there
you will see it. That was the one where he was
concerned about other transactions, if you look on
page 2, do you remember? It is in the fifth box down.
{F/297/2}
A. Yes, the postmaster had done some other transactions.
Q. Which is input twice, three Giro deposits and other
cheques because of the replication problem, do you see
that?
A. Yes.
Q. That's what he is concerned about. Were you here,
I think you said you were here when Mr Godeseth gave his
evidence?
A. Yes.
Q. You heard I think me take him through the history of
Callendar Square?
A. Yes.
Q. And if we look at {Day8/58:1}.
A. Page 58, yes.
Q. This was in the context -- do you remember that the
suspense account team were not prepared to authorise the
entry of part of the discrepancy into his suspense
account, do you remember that?
A. I don't recall that detail.
Q. I can show you. But let's just, for the moment, look at
his answer. I say:
"Question: So it was not easy for the
subpostmaster, was it?"
MR JUSTICE FRASER: Before you do that, you really need to
start at the bottom of page 57, I think.
MR GREEN: My Lord, I'm happy to do that. Can we go up
a tiny bit. {Day8/57:10}.
A. Right, "the suspense account" probably means the
suspense account for that branch?
Q. Yes, it does. If I can help you with it possibly. Page
57, line 10:
"'This office had severe problems balancing on
[week] 25, resulting in a shortage of £6,414.46. After
checking various reports I am satisfied that the error
is made up of ...'
"And they are then broken down carefully there and
you can see that the SPMR is saying there is a Horizon
software problem and so forth, giving the history ..."
A. Can I ask what that quote is quoting from?
Q. From the document we are just looking at. I can take
you to the document, I'm just at the moment asking you
whether you recall that this was the sort of problem
that the Callendar Square subpostmaster, Mr Alan Brown,
was faced with, or can you not really remember?
A. Well, obviously he was faced with a shortfall, that's
what I remember. Details of suspense accounts and so on
are not so prominent in my mind.
Q. Have a look at what -- the problem is if you look at
line 18.
A. Yes.
Q. It says:
"Question: Then speaking to the Horizon support
centre at the bottom of the page. If we go over the
page, please:
"'They told the SPMR that they would report to NBSC
that they had identified and rectified the problem and
that the amount could be held in the suspense account.
However, as part of the shortage relates to transfers
and no error notice will be issued, then the suspense
Account Team are not prepared to authorise the entry.'
So it wasn't easy for the subpostmaster, was it, you
can see here?"
And Mr Godeseth says:
"Answer: No, indeed, a horrible position to be in."
A. Yes.
Q. So the picture that emerges from the documents in the
case of Mr Alan Brown is not a rosy one, is that fair to
accept?
A. I believe so. I don't know what the suspense account
team were talking about, why they were not prepared to
do it and whether they thought some other mechanism was
right.
Q. Let's have a look at {F/300.1/1}. This is the area
manager intervention log, you can there it is
"19 September 2005 Horizon Problems".
If we could go over the page, please {F/300.1/2}.
You can see the amounts there broken down, £3,489.69
transfers, £2,870 Giro deposits, and £54,52
unidentified?
A. Yes. Do we understand these are stock transfers that
went in twice to some stock?
Q. Exactly. You see there it says:
"The Spmr claims that there was a Horizon software
problem on 14.09.05 from 15.30 onwards. This was picked
up when a member of staff noticed that a transaction,
which had been taken by another member of staff, had not
been entered onto the system, so therefore she put the
transaction through. She checked at the time with her
colleague who said that she thought she had put it
through already however she accepted that she could have
made a mistake."
Pausing there. What's actually happening here is
the fact that Horizon is not correctly displaying what's
happened is misleading the staff in the sub-post office
to make a mistake.
A. What's happening is it is not replicating properly.
Q. Yes. So just to be clear, the Horizon system is not
showing correctly what has happened?
A. Absolutely, because Riposte is not replicating when it
is supposed to.
Q. And we saw they had quite a lot of Riposte problems?
A. A lot of Riposte problems?
Q. -- chuck it over the fence to Escher?
A. I mean there are a number of PEAKs and KELs and so on
where Fujitsu say this is a Riposte problem, we need
Escher to fix it. Callendar Square is not the only one.
Q. If you look at the bottom of that paragraph, it says:
"Following on from that, it was picked up that other
giro business deposits that had been entered had not
come up on the system, so they were re-keyed."
Yes?
A. Where is that below?
Q. It is just at the end of that paragraph that we were
looking at, the big paragraph. Three lines up from the
bottom. "Following on from that", in the middle.
A. "... it was picked up that other giro business deposits
that had been entered had not come up on the system, so
they were re-keyed."
Yes.
Q. So they were re-keyed as well?
A. Yes.
Q. So that is how we got the two lots, the two numbers we
have seen.
"There was also a problem with transfers from one
stock to another, in that they had doubled up."
A. Yes.
Q. "The Spmr made several telephone calls to the NBSC,
telling them about his problems and he was advised to
carry on with balancing and produce his Cash Account."
Yes?
A. Yes.
Q. Is that what, in your expectation of how this process
should work, is that what you would expect to happen?
A. Well I don't know the detail, but in many cases NBSC say
don't try balancing, in some cases they do, and I don't
know the exact rationale for one or the other.
Q. He is told to produce this cash account.
"Whilst doing this a warning came up, however the
NBSC told the staff to continue to roll over. The result
was that the office balanced £6,414.46 short."
Do you see that?
A. That is the sum, is it?
Q. Yes:
"The Spmr spoke to the Horizon Support Centre (ref
E0509150123) who investigated and agreed that there had
been a navigation problem that had now been rectified."
A. Yes, not quite clear what that means.
Q. Then:
"They told the Spmr that they would report to NBSC
that they had identified and rectified the problem and
that the amount could be held in the suspense account."
A. Can we go back, who are "they" now?
Q. The Horizon support centre.
A. Okay. Sorry.
Q. Which is now run by Atos.
A. Yes.
Q. So:
"However, as part of the shortage relates to
transfers, and no error notice will be issued, then the
Suspense Account team are not prepared to authorise the
entry."
A. Yes.
Q. "I telephoned the suspense account team (Ann Wilde) ..."
This is an SPM being assisted here by someone at
Post Office.
" ... who told me that checks could be made with
Girobank after next Wednesday, and if that shows that
duplications have been made, then they will authorise
the amount to be moved to the suspense account, until
the office receives an error notice. However, Ann stands
by what she said about the transfer problems, and that
they would not move this amount to The Suspense
Account."
A. Yes.
Q. Is that how you think the system should work?
A. Well, there's obviously some policy about the suspense
account team and how they work and how certain things
are handled.
Q. I understand, that's obvious. I'm asking --
A. That's what Ann is quoting.
Q. But was it your understanding when you were looking --
did you even know that had happened at Callendar Square?
A. Well, it seems to me that what's happening here is --
Q. Can we just pause. Did you know about that?
A. I was not aware of this detail, no.
Q. In fact we see this in a number of the bugs, that you
are not aware of a huge amount of the detail, is that
fair?
A. The procedural side of how someone was compensated for
a bug and how this team pushed numbers around and so on,
that procedural side is outside the PEAKs and generally
not something I'm -- you know, how the suspense account
team worked, what their policy was, what you could do,
and so on, that sort of stuff I don't know.
Q. But your expectation that it won't amount to a lasting
discrepancy --
A. Yes, is that this procedure will somehow work out and
these teams will decide eventually: you do it, we do it,
we have got to do it.
Q. So you formed a view about how seamlessly or otherwise
this would work and on the basis of that view reached
your opinion about whether there would be lasting
discrepancies or not?
A. My view is that regardless of procedural issues like
this, in the majority of cases if there is
an R/P mismatch it will be sorted eventually.
Q. You formed that view without knowing how the actual
individual person at the Callendar Square branch after
whom the bug is named was dealt with?
A. I didn't know the details of this process.
Q. So the answer is yes?
A. I formed that view not knowing the details of this
process.
MR JUSTICE FRASER: Now Mr Green went through this in some
detail with Mr Godeseth. Can you just remind me, were
you reading the transcript for Mr Godeseth or were you
here?
A. I was here.
MR JUSTICE FRASER: You were here?
A. Yes.
MR JUSTICE FRASER: Okay, Mr Green.
MR GREEN: I will take it reasonably swiftly, if I may,
given that you have not looked at it in this detail.
MR JUSTICE FRASER: I do not think you need to put
everything to this witness that you put to Mr Godeseth.
MR GREEN: I'm certainly not going to do that, my Lord.
Can I identify, please, that at {F/312.1/1}, just to
take a couple of aspects of what happened. If we look
at page 2 of that log -- sorry, page 1, I do
apologise -- do you see at the top.
A. (Reads to self)
I see that's ... yes.
Is AIO area intervention -- oh, A/O? What are they?
MR GREEN: "Area intervention officer knows about it."
A. All right, as opposed to manager --
Q. If we go over the page, please {F/312.1/2} and look at
"Expand on any letter requested/clarify any point",
Do you see the second line:
"Spmr concerned that he has now made a fraudulent
entry in that he has rolled over to the next trading
period and put the loss into local suspense he has then
gone on to state that the cash has been made good, which
it hasn’t. This was done on the advice of the Helpdesk."
A. Yes.
Q. Now, that's because he is being forced to make good part
of the cash that can't go into the suspense account.
Did you know any of this?
A. It seems to be so, yes.
Q. Did you know any of it? Or should I take your answer
before, that you didn't really know this detail?
A. I haven't gone into this detail.
Q. I understand.
If we go quickly to a couple of other points and
then I will move on {F/324.1/1}. This is a telephone
contact, a response by SPM:
"Telephoned the office and Allan said that he was
having problems again with transfers. He has contacted
the Horizon helpdesk who have subsequently come back to
him to say that there is no system problem and that he
should contact NBSC."
Do you see that?
A. Yes.
Q. If we look quickly at {F/332.1/1}, "Response by SPM":
"Alan will continue to log a call each time he has
a problem. I told him that this would help to build
a case for having the alleged faulty kit exchanged."
A. Yes.
Q. Then just taking it forward before I ask you a
compendious question about these, {F/333.1/1}. Now,
this is an email chain. And can I ask you to look
please at page 11, which is where it begins
{F/333.1/11}, and that is the end of an email from
Sandra MacKay as you can see.
If we to the next page quickly, you will see this is
11 January 2006. If we go back to the email below, and
you see at the top:
"You may recall that in September the above office
had major problems with their Horizon system relating to
transfers between stock units the Spmr has reported that
he is again experiencing problems with transfers,
(05.01.06) which resulted in a loss of around £43k which
has subsequently rectified itself."
On your understanding of the Horizon system, is that
something that should or should not happen if it is
working correctly?
A. I think it should not really.
Q. No. If we go forward, please, to page {F/333.1/9}, if
you look at the bottom of that do you see:
"Since then it appears to have happened again,
although Fujitsu are saying no issue could be detected.
I am concerned that there is a fundamental flaw with the
branches configuration ..."
Do you see that?
A. Yes.
Q. So I mean I'm not going to take you through the whole
thing, Dr Worden, but if we -- you would accept,
wouldn't you, that the premise of everything being
corrected is dependent on all these processes working
properly and satisfactorily. That's uncontroversial?
A. I do not think it is quite uncontroversial because in
the process of trying to correct something, there will
be false steps, and I think you have shown me evidence
there have been false steps.
In spite of that I would expect people to persist,
as they you see them persisting here, until things are
sorted out. So false steps on the way, yes, they do
happen, but I would expect when there are false steps on
the way people will persevere until they have got to the
bottom of it.
Q. There are about 30 branches identified in the document
we have for Callendar Square.
A. Yes.
Q. And it suggests that probably 10 of them didn't have
shortfalls?
A. Mm.
Q. So that is how you have derived your figure of 20
branches?
A. Yes.
Q. Did you get a feel in your reading into this problem of
how long this problem had been around for and how many
branches it was actually affecting?
A. Well, there is a real problem about the definition of
what "this problem" is because there is the Riposte bug
and then there's certain event storms which causes
problems in replication, which may be short-term
problems for a few minutes, and then there are event
storms which make them long-term problems, and then
there's what happens in event storms and in particular
the double transfer in. So the whole of
Callendar Square is those things all happening together,
whereas I think some of the 20 PEAKs or 30 PEAKs,
whatever, are different from that, different
combinations.
Q. Let's just go forward one last message in this line of
emails, this is from Anne Chambers at {F/333.1/3}.
I assume you didn't look at this before you did your
report or before today?
A. Sorry, which one? It has not come up yet.
Q. Anne Chambers, halfway down. From Anne Chambers to
Mike Stewart, 23rd February 2006?
A. This is Anne Chambers, right, okay. I have not seen
this email, no.
Q. You have not seen it?
A. No.
Q. Because it might be quite helpful in getting a feeling
for the scale of what was actually going on. It says in
the second paragraph:
"Haven't looked at the recent evidence, but I know
in the past this site had hit this Riposte lock problem
2 or 3 times within a few weeks. This problem has been
around for years and affects a number of sites most
weeks, and finally Escher say they have done something
about it. I am interested in whether they really have
fixed it which it why I left the call open - to remind
me to check over the whole estate once S90 is live -
call me cynical but I do not just accept a 3rd party's
word that they have fixed something!"
Did you have even any conception that this was
an issue which was affecting a number of sites most
weeks for years when you formed the views you did about
the significance of this problem?
A. Well, this is exactly the point. The Riposte lock
problem leads to different things, and the Riposte lock
problem leading through to that double transfer in thing
is not the same as the Riposte lock problem.
Q. Okay. But just re-putting the question, if I may.
A. Yes.
Q. In forming the views that you did in your reports you
were unaware of this email?
A. It looks a bit familiar actually.
Q. You said --
A. As I said, my view has always been that there is a chain
of events and the Riposte lock problem, which is at the
source of the chain, happens much more frequently than
the whole chain.
Q. You were not aware of the scale of that problem as
reported there when you wrote your reports, were you?
A. I expected the scale of the source, the Riposte lock
problem, would be more extensive than the consequence
which required the event storm and required the double
transfer in and so on and so forth, and that must be
more rare than the original Riposte lock problem.
Q. Dr Worden, one last attempt. You were not aware of this
evidence about the scale of the Riposte lock problem
itself when you wrote your report?
A. I was aware of some investigations by Anne Chambers and
the fact that she was looking at this broader scope of
Riposte lock problem, I was aware of that, and I was
aware -- it was my opinion, it still is my opinion, that
the origin of the chain, the Riposte lock problem, is
more frequent, probably much more frequent than the
whole chain occurring.
Q. The KEL that was raised in 2002 and updated in 2010 is
at {F/565/1}. You did actually look at KELs, didn't
you?
A. Not in this format actually.
Q. Can you remember if you looked at this KEL in any
format?
A. I believe I did, yes.
Q. If we look at page {F/565/2}, please. February 2003,
about three-quarters of the way down?
A. Yes.
Q. "We are seeing a few of these each week, on Wednesdays
during balancing. This can lead to problems if the PM is
balancing on the counter generating the events, as it
may not have a full view of transactions done on other
counters."
A. Yes, I mean this illustrates that the cause, the Riposte
problem, has different consequences. For instance, it
stopped transfers for instance in balancing. And what
one expects, depending on the duration of the problem,
obviously an event storm that leads to Riposte failing
to replicate for a long period on some terminal is
different from the lighter cases where Riposte fails to
replicate for some short period, and maybe in balancing
you miss some transactions done in on a terminal in a
that short period. So there are all sorts of scales of
possibility there.
Q. Yes, and it varies?
A. It varies, yes.
Q. In June 2004 we see:
"This event can also give rise to transfer
problems."
Yes?
A. Yes. This is the double stock thing.
Q. If we go over the page {F/565/3}, at the top:
"This problem is still occurring every week ..."
September 2005.
" ... in one case at the same site on 2 consecutive
weeks."
A. Yes, and that might be just a subpostmaster noticing he
has a problem and saying -- ringing up.
Q. If we look halfway down or just before, do you see the
words "reboot" in capitals halfway down that large
paragraph?
A. Yes.
Q. And then you see:
"If they are in the process of balancing, it is
strongly advised that they reboot before continuing with
balancing as they are at risk of producing an incorrect
balance. Warn the PM that if transactions appear to be
missing, they should not be re-entered - they will
become visible after the counter has been rebooted."
A. Yes.
Q. Then it says:
If a reboot/Cleardesk does not resolve this problem,
send the call over for further investigation - SSC can
rebuild the messagestore on the affected counter."
A. Yes.
Q. So that ties in with what we have seen about the way
messagestore was rebuilt by SSC, yes? It is
an example --
A. Yes, it is an example of rebuilding a messagestore.
That sounds like the sort of full replication job.
Q. Now, at Mr Godeseth's second -- just before we move,
they are, at the bottom of that page, still giving
advice on this in 2010, aren't they?
A. Yes.
Q. This was going on for quite a long time?
A. This is on the message correspondence server and it is
a different thing from failure to replicate in the
branch.
Q. Yes, it is another problem but in the same line --
A. It may be the same, it may be different. I'm not quite
sure.
Q. Mr Godeseth at paragraph 15 of his witness statement, do
you remember, he relies on the list from Mr Lenton. We
see that at {F/322.1/1}. Do you remember that list?
A. I'm not there yet. (Pause)
This is the thing Anne Chambers put together,
I think.
Q. Yes. It turns out from the properties we can see it was
Anne Chambers in 2015?
A. Yes.
Q. And what's said there is:
"NB many other branches had multiple events,
preventing replication, but these are the majority of
those which came to PEAK, having either reported
a problem or it caused a reconciliation report entry."
Do you see that?
A. Yes.
Q. So this is a list of the majority retrospectively
compiled by Anne Chambers in 2015?
A. Yes.
Q. So it does not suggest, does it, nor I think does
Post Office or Fujitsu claim, that there was
a systematic problem management system in place to
collate everything into one place and produce this sort
of data automatically?
A. What do you mean by a systematic problem management
process?
Q. Well, we have seen reference to a problem management
system that was considered to be brought in, and
Post Office has given evidence that they didn't bring it
in, that would have produced information of this sort
automatically and collated it?
A. Well, no, that's a rather different document in my
opinion. The problem management document is a high
level strategic generic document about all sorts of
problems whereas this is a specific type of problem.
Q. So she is having to go back in 2015 to try and identify
the majority of branches affected?
A. Yes. Obviously I'm not quite sure of what her search
criteria were to pick these things up.
Q. But fingers crossed?
A. I don't know about fingers crossed at all, she was
a pretty competent woman in my opinion so she would not
wing it.
Q. So she says the competent woman is trying to find -- she
thinks she has got the majority of them?
A. I think she would do the best that can be done and she
has obviously picked up the receipts and payments PEAKs
that have a connection with this kind of Riposte
problem.
Q. Look at the blue box at 26:
"This set reported problems but probably didn't have
losses as a consequence."
A. Yes.
Q. And because she says they "probably didn't have losses",
that's why you have limited your number to 20, is that
right?
A. Yes.
You see lots of consequences here like frozen slow
counter and so on which PMs might report.
Q. Yes. Let's have a look at Mr Godeseth's second report
at paragraph 16, it is {E2/7/6}. At paragraph 16 on
page 6 you will see there that Mr Godeseth says:
"While the issue at Callendar Square was reported by
the Subpostmaster after he spotted a receipts and
payments mismatch, it would have been picked up in any
event by a batch process that is run every night which
picked up the mismatch ..."
A. Yes.
Q. But as we have seen, this is not something that's going
to be corrected overnight, is it?
A. I do not think so, no.
Q. You would agree that it arose, from what you have seen,
in or about 2000?
A. Yes, the first occurrence of the Riposte problem I think
was around there.
Q. And it certainly persisted until 2006?
A. I think so. It seems it wasn't finally fixed by Escher
in all that time.
Q. And it looks as if there may have been the same or
a related problem in 2010 but we don't know exactly?
A. We don't know.
Q. Do you regard this as a significant failing in the
system?
A. It is obviously significant but what one means by that
word ... It has been significant in this case,
obviously, and in my investigations.
Q. Riposte was part of the Horizon system, wasn't it?
A. It was, absolutely.
Q. Central to it and fundamental?
A. It was part of the supporting software. It was like
a database layer actually at the time.
Q. But it was very important?
A. It was very important. Replication was absolutely key
to how it did it --
Q. Now we discussed the difference, identifying the
difference between a bug that has affected one branch
and one that has affected ten?
A. Yes.
Q. And the Dalmellington bug affected 112 -- had 112
occurrences over 88 branches?
A. Yes.
Q. That is pretty significant as a bug?
A. It is significant in terms of the lasting effect is not
significant.
Q. We have your point on transaction corrections. We are
trying to focus on the system first.
A. It was a bug and it affected 112 branches, we can agree
that.
Q. Let's leave aside, if we may, your point on transaction
corrections one day correcting something?
A. Well, transaction corrections or reversals by the
postmaster in this case.
Q. Let's focus on whether the Horizon system itself goes
wrong, and taking a view about that, at the beginning of
the Callendar Square questions I asked you: it is
important, isn't it, to get a feel for whether something
has affected one branch or perhaps ten?
A. Yes.
Q. And you accepted that is a significant difference?
A. Absolutely.
Q. And it would be equally important to work out whether it
has affected ten or 88?
A. Yes.
Q. And this bug did in fact cause errors in branch accounts
that were then required to be corrected?
A. Yes.
Q. And so what Horizon was showing before it was corrected
was wrong?
A. Error correction was needed, yes.
Q. What Horizon was showing before it was corrected was
wrong?
A. Yes.
Q. Why did you not mention the number of occurrences and
the number of branches in either of your reports? Is
there a reason for that?
A. Yes, there is a reason, and the reason is because the
Dalmellington error was -- looked like a user error and
was corrected in the normal event of things, it did not
lead to Fujitsu investigations and PEAKs, and therefore
the normal mechanisms for detection -- therefore my
views about how many branches are affected and how
Fujitsu can detect the number of branches affected are
not affected by that, because Fujitsu were not called up
about Dalmellington for good reason, because it looked
like a user error of which there were 20,000 a year
which got corrected.
Q. Let's take it in stages. In trying to assess whether
there was in fact a bug in Horizon which had the
potential to affect a number of branches it is important
to look at Dalmellington, isn't it?
A. It is a useful example to look at, yes.
Q. In your appendix at {D3/2/118}, appendix D3 to your
first expert report, you are dealing with 62 KELs
referred to by Mr Coyne, aren't you?
A. Yes.
Q. And at 5.23 is the Dalmellington KEL?
A. Which I didn't recognise as Dalmellington at the time.
Q. You didn't recognise it and you hadn't been told that
there had been a Dalmellington bug by anyone?
A. Well, I had read Mr Coyne's report which had three
different references to Dalmellington but they weren't
actually connected, and the reference to this KEL didn't
say -- it was one of the three references that didn't
say it is Dalmellington, so that's why I didn't
recognise it as Dalmellington.
Q. But you didn't recognise this was the Dalmellington KEL
either, did you?
A. No, I didn't obviously. It's not there. I recognised
it was a remming KEL and so that was the basis of my
opinion.
Q. Now, you explain why you didn't recognise it in your
second witness statement at page {D3/6/43} at
paragraph 163.
You say:
"The reason I did not recognise that KEL acha621p
related to Dalmellington was that I was responding to Mr
Coyne's reference to the KEL - and in the two paragraphs
in which he referenced the KEL (paras 5.23 and 5.130 of
his report) he did not relate either of the paragraphs
to Dalmellington (addressed at his paras 5.16 - 5.19),
or to each other. It was not evident from Mr Coyne's
report that these three separate extracts all referred
to the same incident."
Yes?
A. Yes.
Q. And so what we see in your table is you say that:
"Any error will be corrected so there is no
permanent effect on branch accounts."
If we go back to {D3/2/118}.
A. Let me just read that. (Pause)
MR JUSTICE FRASER: Do you want on the common screen
{D3/2/118}, Mr Green, is that right?
MR GREEN: My Lord, yes, please.
And you are looking at 5.23.
A. Yes.
Q. And third paragraph you say:
"As above, when physical cash is counted and monthly
balancing is done, any error will be corrected."
As a result of that reasoning you conclude:
"So there is no permanent effect on branch
accounts."
A. In this case there are several safety nets. There is
the postmaster who recognises that he has done a double
rem in and he reverses one rem. That's one safety net.
Then there is the postmaster who does a cash count and
recognises his cash is wrong and does some reversal.
And finally there is a TC. So there are three safety
nets there.
Q. It is common ground that there were transaction
corrections for the Dalmellington branches or at least
most of them?
A. I can't remember the exact numbers.
Q. We will come to that.
A. The report says they were fixed by either reversal or
TC.
Q. We will come to that.
You say on your table just below there:
"The Peak implies that the problem may have been
around for some time. Some Subpostmasters spotted it and
reversed the error immediately those who did not spot it
would see the discrepancy later, when they counted cash,
and have to correct it in their monthly balancing."
You obviously had to look at the PEAK to form that
view, didn't you?
A. Well, I had a fairly general view that this is how cash
transfers and remming work.
Q. Pause there, Dr Worden. You say "The PEAK implies", so
you must have read the PEAK?
A. I did read the PEAK, yes.
Q. It is not referenced in your table which PEAK it is, but
you do reference other PEAKs. Is that just
an oversight?
A. Just an oversight.
Q. Let's look at the KEL at {F/1426/1} please. You see the
problem described there?
A. Cash remmed in; recorded; yes.
Q. "... received at an outreach branch and scanned into
Horizon. The manual process was followed and 2 Delivery
Receipts printed."
Yes?
A. Yes.
Q. In the middle:
"They were then able to press Enter again and
another Rem In slip was printed -- And the same amount
of cash was recorded a second time."
A. Yes.
Q. "They may have repeated several times before using
Cancel to escape, resulting in much more cash being
recorded on the system than they actually have."
A. Yes.
Q. You see at the bottom:
"Known problem should now be fixed so any further
occurrences need to be investigated - send call to
Peak."
A. Yes.
Q. "Outreach branches can avoid the problem by making sure
that they do not press Enter again after they have
printed both Delivery Receipts and the Rem In slip - if
they find the Rem In screen is still displayed,they
should press Cancel to get out of it, ignoring the
mental that not everything has been printed."
Pausing there. The system is telling them that
nothing everything has been printed which is why they
are progressing rather than --
A. The system is misleading them.
Q. Correct. And it says:
"However they are unlikely to notice immediately
that they are on the wrong screen, and will probably.
Have duplicated the Rem In before realising
something is wrong."
A. Yes.
Q. It says:
"We have seen some outreach branches apparently
resolve the problem by remming out the excess amount but
NBSC should advise on this. The cause of the problem is
being investigated but it will not retrospectively
correct the accounts at affected branches."
A. Yes. I think that is the usual statement that, fixing
the code, we will do it in future but not for the ones
that have already suffered from it.
Q. At this stage you had seen the KEL. This doesn't
actually say that transaction corrections will be
issued, does it?
A. KEL doesn't say that. No.
Q. No. So on what basis when you were looking and writing
your report did you know that these had all been
addressed by transaction corrections?
A. Well, at some stage I read the document which says here
are 112 and so many had been fixed and so on and that
was explicit, but before that my expectation was that
this is how remming happens. There are 20,000 remming
TCs per annum, therefore, my expectation is that that
would have happened.
Q. So you inferred from a KEL that didn't say it that
transaction corrections would be issued?
A. I mean very often one has to infer from KELs things that
are not said. They are written by people who know
things that we don't know and they are not sort of
written for us.
Q. You have spread that across other KELs which don't
mention transaction corrections and reached the same
inference, haven't you?
A. I have made that same inference in several cases, yes.
Q. And Mr Coyne found this bug by chance, didn't he?
A. I can't remember.
Q. Let's look at {D2/1/58}, paragraphs 5.16 to 5.19 on
page 58. Here you can see there the Dalmellington bug
at the foot of the page?
A. Yes.
Q. £24,000 discrepancy. Over the page {D2/1/59} we can see
at 5.19 he concludes that:
"The fact that Atos made a change to the Horizon
system to prevent re-occurrence is therefore consistent
with this being a software bug."
A. Atos made a change to the Horizon system is a bit
peculiar, but it is consistent with the fact that there
was a bug(?).
Q. So what Mr Coyne was doing was trying to identify
whether there had in fact been a bug or defect in the
Horizon system that had the potential to impact branch
accounts here, yes?
A. Yes.
Q. And he seemed to think that that was relevant and he was
right about that for that question?
A. Well, I was looking for bugs which had a lasting effect
on branch accounts and therefore we had different
criteria.
Q. If we look at {F/1394/3}. You can see there that it
says:
"Please can you help. A very strange case."
October 2015. You can see it says there:
"... the remittance team in Chesterfield are aware
of this fault and can issue a transaction correction for
the 'extra' remittances... They can see that the one
barcode accepted the £8000 remittance four times (even
though there was one item). They are unable to issue a
transaction correction to her Outreach as it doesn't
have a unique number. My understanding is that they have
told her if she rems out to her core branch the
non-existent £24,000 loss this error has created, they
will correct/remove it from her suspense account."
So they are well aware of this in 2015 and if we
look please --
A. This is the Chesterfield team.
Q. Yes. If we look please at {F/1425.1/1}. I'm not going
to take you through this Dr Worden, but had you looked
at this email before you wrote your report?
A. It doesn't look familiar to me I must admit.
Q. Let's go forward to {F/1495.2/1} please. This is
an email looking into effectively the Dalmellington
error which you see halfway down:
"Subject: The Dalmellington Error in Horizon."
A. Yes.
Q. It says:
"Dalmellington error in Horizon [then a vertical
slash mark, then all one word] "problemswithpol". It is
referring to a blog by Tim McCormack campaigning against
PO and Horizon.
A. Yes.
Q. It says the blog is independent from Sparrow but clearly
related and so forth --
A. Sorry where are we?
Q. Bottom paragraph --
A. Sorry, I haven't got that blog independent paragraph.
Where are we?
Q. It is the bottom of the page.
A. Right. "Independent of Sparrow" whatever Sparrow is.
Q. It says:
"I'm most concerned that we/our suppliers appear to
be very lax at handling £24k. And want to know we've
rectified all the issues raised, if they happened as Tim
explains."
A. Yes.
Q. Then --
A. That's chief exec.
Q. Yes and then what's happening there is, second from the
top, an urgent review and then at the very top:
"Can you stand down on this please?"
A. So Sharon Gilkes says "Can you stand down?"
Q. Yes.
A. I don't know who -- sorry, the top email, who is it
from?
Q. It is from a chap called Rob --
A. That's Rob Houghton, right. Both of them from him.
Yes.
Q. So it is clear that at least through 2015 and 2016 there
was a considerable amount of investigation into this?
A. Yes.
Q. Were any of the documents about the investigation into
Dalmellington drawn to your attention in your
instructions?
A. No.
Q. Was Mr Coyne's first report the first time when you
learnt of the Dalmellington bug?
A. I think it must have been. Obviously I had seen the KEL
and I had formed the opinion it wasn't a lasting bug,
when I equated the two then --
Q. Your first report was 7th December 2018?
A. Yes.
Q. The second witness statement of Mr Godeseth and the
first witness statement of Mr Parker were
6th November 2018 and you had had sight of those before
you wrote your first report?
A. Yes.
Q. 16th November 2018 was their witness statement?
A. Yes, that is right. It was quite close to the wire in
terms of getting a report together.
Q. When you get things close to the wire it can cause
difficulties, can't it?
A. Yes.
Q. You get hundreds of thousands of KELs or PEAKs or that
sort of thing?
A. Well, those witness statements were quite close to --
Q. I see. Do you remember whether you considered them
before you did your first report?
A. I did consider them, yes, I'm saying it was --
Q. You specifically relied on them in relation to various
issues, didn't you?
A. I think I did.
Q. Mr Godeseth gave in his second witness statement
evidence on four bugs, Callender Square, receipts and
payments mismatch, local suspense accounts and
Dalmellington, didn't he?
A. Yes.
Q. Mr Godeseth's second statement at {E2/7/9},
paragraph 34, he says:
"Bugs:
"In addition to the Callendar Square issue I have
been asked by Post Office to explain how the following
three bugs came to light and were resolved."
A. Yes.
Q. "The receipts and payments mismatch in September 2010.
"The local suspense account issue in 2011;
"and an issue which occurred at the Dalmellington
branch in October 2015."
A. Yes.
Q. So he had been asked by Post Office to explain that in
addition to Callendar Square. There had been three bugs
one of which was Dalmellington?
A. Yes.
Q. And you expressly relied on Mr Godeseth's evidence in
relation to those three bugs, didn't you?
A. Mr Godeseth's evidence on Dalmellington really didn't
add much to my previous view that it was a remming
problem, these would get corrected by TCs and that's --
remming problems in my mind don't generally lead to
lasting effects on branch accounts.
Q. Will you accept from me, Dr Worden, that you expressly
relied on Mr Godeseth at paragraph 649 of your witness
statement?
MR JUSTICE FRASER: Expert report.
MR GREEN: I'm so sorry.
A. Can we go to 649 and see what it is?
Q. Certainly. {D3/1/153}. 649.
A. "... and reaches conclusions similar to my previous
conclusions."
Yes.
Q. Yes and you then refer again to him in relation to
receipts and payments mismatch?
A. Yes.
Q. Paragraph 650.
A. Yes.
Q. And then in relation to Callendar Square we saw you have
done the same thing at paragraph 667, which I do not
think we need to go to.
A. Yes.
Q. And suspense account bug paragraph 681 {D3/1/160}
MR JUSTICE FRASER: You are going quite quickly.
MR GREEN: Sorry, my Lord.
MR JUSTICE FRASER: Just out of fairness to the witness.
MR GREEN: The short point, Dr Worden, is you go through
every bug in Mr Godeseth's witness statement apart from
the Dalmellington bug which affects 88 branches, despite
relying on his witness statement expressly for the other
three, why is that?
A. Because my opinion has been since long before that that
this was not a bug with a lasting effect on branch
accounts and therefore, in terms of the scope of my
investigation, was not an important bug because it
doesn't leave a subpostmaster with a lasting shortfall.
Q. But it was an important bug because of the scale of the
branches it affected which then required corrections?
A. Well it affected this 100 and so branches that is
correct.
Q. And that was an important number to have a feel for to
look at the scale of branch impacts that are possible
from bugs in Horizon?
A. No, it is not because I'm looking at the scale of impact
from bugs that don't look like something that's normally
corrected. If something is normally corrected then the
investigation of it will not lead to the same result as
something -- you see what I mean? Something that's --
the other three, there's real discrepancy and had to be
investigated. The Dalmellington one never came to
Fujitsu for a good reason.
Q. Let's have a look. {F/1415/1} we have just got time to
look at this. This is the Fujitsu presentation and did
you see that presentation?
A. I have seen that one, yes.
Q. On the first page it is for "PO's internal purposes
only", confidential.
On the second page {F/1415/2} two potentially
separate issues at play, the combination of which may
lead to the scenario above. Yes?
A. Yes.
Q. On the third page {F/1415/3} clear findings about 112
occurrences?
A. Yes.
Q. And detail there. Do you see at the bottom:
"4 items still to be confirmed."
A. Yes.
Q. Then on page {F/1415/7} we see "Detailed Preliminary
Findings"?
A. Yes, this is the by year findings.
Q. By year. 65 incidents in 2010 to 2011. On page
{F/1415/8} we can see 0 calls raised with Fujitsu.
A. Yes.
Q. 0 calls raised with Fujitsu, 2012. 2013, 0 calls raised
with Fujitsu and that's where we pause and see two
unknown outcomes: value £25,000 and £2,500. Did you
notice that when you were doing your report, Dr Worden?
A. When I was doing my report it seemed to me that the main
point was that 108 out of 112 were corrected as part of
the normal process. I was therefore not so concerned
about the two which there has been a lot of subsequent
discussion about and I believe has now turned out to be
a different effect.
Q. Well, can you just answer the question just quickly.
When you were doing your report, did you notice that
there were two unknown outcomes, one of £25,000 and one
of £2,500?
A. Well, I read this document and I must have noticed it
but, as I say, my feeling of the importance of it in the
context of the overall analysis of remming bugs was not
important because things at the edge of a sample -- a
sample of 108, four things at the edge, it is difficult
to know what the detail to those four cases are, so
I was concerned with the majority.
Q. Dr Worden, if you had seen and noticed those figures,
you should have included this bug in your report for two
reasons: (1) the large number of branches affected (2)
the size of the two unknown outcomes, do you accept
that?
A. No. The large number of branches affected is similar to
the large number of branches affected by manual remming
errors, much larger number. So I don't have to -- no,
the fact that some software errors look like human
errors and those human errors are corrected, very much
alters the significance of different errors, and I was
concerned with the overall significance of Dalmellington
and my opinion was and remains that remming errors get
corrected.
MR GREEN: My Lord, is that a convenient moment?
MR JUSTICE FRASER: I think it is. Thank you very much
Dr Worden.
I did give Mr de Garr Robinson this opportunity on
his last day, do you want to start at 10.15 am tomorrow
or do you think 10.30 is adequate?
MR GREEN: I think 10.30 should be adequate.
MR JUSTICE FRASER: Dr Worden, we are going to start again
at 10.30 tomorrow. I'm now going to listen to -- who
knows it might be a couple of minutes, it might be
slightly longer about disclosure. There's no need for
you to wait because quite frankly I don't know how long
I would be asking you to stay, so why don't you just --
A. I shall slack off.
MR JUSTICE FRASER: I would not put it quite like that. By
all means you can go and we are going to revert to the
point that Mr Green started trying to make this morning.
Right.
Discussion
MR JUSTICE FRASER: Right, Mr Green.
MR GREEN: My Lord, there has been an additional thread
added as you may have appreciated during the course of
today, which is that at 1.02 pm we got the ARQ figures.
The only missing year -- we were told up to 2014, they
run back to 2004. We discovered that there was
a missing year.
MR JUSTICE FRASER: What year was that?
MR GREEN: Up to 2013.
MR JUSTICE FRASER: Is that what you were given today?
MR GREEN: That's what we have got. Sorry, the year is 2013
to 2014 is what I meant to say, I may have said the
wrong thing. It turns out that -- we have had to press
for that. It turns out there were more than the
allowance of 720 ARQs in that year.
MR JUSTICE FRASER: Used?
MR GREEN: Used. More than that number requested. But as
Dr Worden doesn't know about that I didn't put those
figures to him. Then, the matter which I raised this
morning is the letter, which I understand I think may
have been sent to the court as well.
MR JUSTICE FRASER: I will tell you what I saw about that.
I saw an email from you which was pursuant to a request
I had just made about some references and then I read
the letter which came in as a result of your email and
that's about I think the extraction of data into a more
usable form which went in the WBD document and that is
MSC data which was disclosed anyway, is that right?
MR GREEN: My Lord that's absolutely correct. It was
disclosed in separate spreadsheets and then as I hope
I correctly and accurately explained to the court it was
then disclosed to us in a new and different form.
MR JUSTICE FRASER: I understand.
MR GREEN: Putting content from different documents into one
document and I cross-examined on the difference between
the two.
MR JUSTICE FRASER: I understand. That's what you wanted to
mention this morning?
MR GREEN: I wanted to make sure there was no
misunderstanding. From our perspective that is under
CPR 31.9, those are new documents in the same way that
the copy with the manuscript edition that someone wants
to rely on is a new document because they have come from
three different disclosed documents and they have been
put together and the way in which they have been put
together differs and we rely on the difference.
MR JUSTICE FRASER: All right. But if and insofar as that
is a point, that's a point for submission, argument and
for me, it doesn't affect the cross-examination.
MR GREEN: It was just to explain why --
MR DE GARR ROBINSON: It doesn't, my Lord, but I would
welcome the opportunity to explain. My learned friend
during the course of his cross-examination has on
a number of occasions said that documents have been put
in the trial bundles.
My Lord your Lordship will appreciate that's been
happening more or less on a continuous basis by both
sides throughout the entirety of this case.
Those MSCs, they were inserted as a result of my
request.
MR JUSTICE FRASER: Which I understand from the letter to
put it in a usable form, is that right?
MR DE GARR ROBINSON: Exactly. My Lord what happened was in
Mr Coyne's second report, I think, you will forgive me
if I can't remember particular paragraphs, but
paragraphs 3.315 and 5.242 spring to mind, it might be
5.424.
MR JUSTICE FRASER: You are just showing off.
MR DE GARR ROBINSON: It is a memory test.
MR JUSTICE FRASER: But at two places in the report?
MR DE GARR ROBINSON: Mr Coyne referred to MSCs that were of
interest to him or to PEAKs that were of interest to him
that related to MSCs.
My Lord, I asked for the data relating to those MSCs
to be extracted from the spreadsheets because I'm not
very good with spreadsheets, frankly. I find the
smallness of the text very difficult. My instructing
solicitors therefore downloaded that data which
everybody already had onto clean documents so that they
could be easier to deploy. I rather optimistically
thought I would have the opportunity and time to
cross-examine Mr Coyne about the MSCs and the issues
that he was discussing and so I asked for those
documents, which as I say just clarified data that had
already been disclosed, and indeed was already in the
trial bundles. I asked for those to be put into the
trial bundle.
As it turns out my optimism proved unfounded, I ran
out of time, so I didn't have the opportunity to
cross-examine him on his report.
So my Lord to the extent that there are any dark
intimations being conjured up by this process, I'm fully
responsible and I was trying to be helpful and I believe
had I had an opportunity to cross-examine Mr Coyne, it
would have been helpful.
MR JUSTICE FRASER: So the short points are: the data in
those MSC documents was already available in disclosed
documents but in spreadsheet form; they were put
together in a more usable form for cross-examination
purposes; and there are no dark intimations.
MR DE GARR ROBINSON: Indeed.
MR JUSTICE FRASER: I have that. Thank you very much. That
was included, effectively, in the letter but of course
it is very helpful to have it explained.
MR DE GARR ROBINSON: There are conspiracy theories often
suggested and I was quite concerned to scotch that
particular one.
MR JUSTICE FRASER: That's entirely understood. Thank you
very much.
Mr Green, anything more to say about that?
MR GREEN: My Lord you will appreciate from the
cross-examination our concern was there was a key
document which missed out the bad bits and they are put
together in different ways.
MR JUSTICE FRASER: No, I understand. There is a point I'm
going to raise with both of you about disclosure but it
is not this point, but so far as the cross-examination
of this witness is concerned, the exchanges this week
have taken us where they have taken us and it is
irrelevant -- I beg your pardon -- it is not going to
affect what happens tomorrow, let's put it that way?
MR GREEN: Exactly.
MR JUSTICE FRASER: Because the timetable of this trial has
already been affected by one or two other matters and
that's my main concern.
My second concern -- I shouldn't say concern but
given the point has been raised I'm going to address it
now rather than tomorrow. In Mr Coyne's
cross-examination he was asked about OCPs and OCRs and
in re-examination it was said, I think, that there were
two and a half thousand that were very recently
disclosed and -- I have got the note somewhere -- that
was also one of those eventful days in late May, is that
correct?
MR GREEN: No. That was 18th April, my Lord. So mid-flow.
MR JUSTICE FRASER: Right. Now did that come with
a covering letter?
MR GREEN: I think it may have done. My Lord would you like
us to send you the reference?
MR JUSTICE FRASER: No, what I would like to do is just
explore now, firstly with Mr de Garr Robinson,
a quantity of documents of that number coming at that
stage in this trial requires an explanation.
MR DE GARR ROBINSON: Yes. Perhaps I can give it now?
MR JUSTICE FRASER: Well, you can but by all means don't
feel obliged because I'm going to ask for a witness
statement, but by all means tell me the explanation.
MR DE GARR ROBINSON: My Lord, the position is this: the
OCPs and OCRs are maintained on the Fujitsu system and
they were disclosed when they were disclosed back in
January. My Lord, so far as Post Office were concerned
that was that. Then much later Fujitsu discovered
an old database that had been copied more than ten years
previously on a system somewhere and told Post Office
that they had found this collection of documents.
Post Office, within a matter of days, realising they
were disclosable, I'm not sure there was any order for
disclosure but realising it was appropriate for those
documents to be disclosed voluntarily in the way that
the previous OCPs and OCRs had been disclosed, Post
Office immediately wrote to Freeths in order to explain
that they had learned from Fujitsu that this unexpected
cache of OCRs -- it should be remembered we are talking
about OCRs not OCPs, these aren't document relating to
changes which might have been made directly to branch
accounts -- but that information was provided as quickly
as could be done and, my Lord, as I say, the rest is
history.
MR JUSTICE FRASER: Right. And that's what led to the
documents being provided on the 18th April?
MR DE GARR ROBINSON: Yes.
MR JUSTICE FRASER: Let me put myself neutrally, it does not
necessarily surprise me that they have come from Fujitsu
rather than documents that the Post Office already had,
but it seems to me a witness statement of explanation is
required for my purposes. I have looked in the H bundle
and I have not found a letter which explains that
situation to me the way you have explained it.
MR DE GARR ROBINSON: There is correspondence about this.
MR JUSTICE FRASER: I have seen quite a bit of
correspondence about it but I rather ran out of steam
when I had looked at about 10 or 20 letters.
MR DE GARR ROBINSON: That is entirely forgivable if I may
say so.
MR JUSTICE FRASER: I'm not going to impose a draconian
deadline on you and it is not going to affect tomorrow
at all, but I would like please a witness statement of
explanation about that tranche of disclosure.
The MSC cross-examination creation document scenario
doesn't bother me in the least. I used to do the same
myself and sometimes data that's already in documents is
more usefully packaged in different forms. I don't
intend to say anything more about that. Mr Green can
explore that if and when he wants, when he makes his
closing submissions if he feels he needs or wants to.
But the disclosure of those documents, albeit coming
from Fujitsu, I would like a witness statement to
explain that.
MR DE GARR ROBINSON: My Lord, that will be done. Can I say
two things. Ms Keating has very helpfully drawn my
attention to two H documents which may be helpful for
your Lordship's purposes.
MR JUSTICE FRASER: Yes.
MR DE GARR ROBINSON: {H/263/1} and {H/273/1}. And my Lord
deadline for the witness statement?
MR JUSTICE FRASER: It is not going to be before noon next
Wednesday. But what I would like it -- I'm not going to
dictate all the information that needs to be included --
but I would like to know the dates when the
Post Office's solicitors or the Post Office was told and
in accordance with the rules of the CPR, if the
information is coming from Mr X or Ms X at Fujitsu, it
should say "I was contacted by Mr X or Ms X". It should
not say --
MR DE GARR ROBINSON: Sources of information.
MR JUSTICE FRASER: Well in modern witness statements now
often one just finds "I understood from company X" and
that's not good enough. 12 o'clock next Wednesday is
fine. We will put that in its own separate box for the
moment.
MR DE GARR ROBINSON: Thank you.
MR JUSTICE FRASER: There is one other point since we are
having a sort of general round up and this isn't for
tomorrow and it is probably not even for the closings,
save the end of day 2 of the closings. There are two
case management conferences in the court diary for this
case going forward still from the timetable as it was
set down before March. I will just remind you what they
are. One is 23rd July and one is 18th September.
They were directed as part of what was the intended
2019 progress of this action which has obviously not
unfolded exactly as one would have expected and at the
end of day 2 of the closings I think we are just going
to have to have a brief stock-take about the shape of
the remainder of this calendar year, and I was going to
mention again that tomorrow but on the basis we are
dealing with other matters, I thought I would mention it
to you now. Neither of you need to say anything about
it, but it is just something we have to think about.
So 10.30 am tomorrow. Thank you very much.
(4.41 pm)
(The court adjourned until 10.30 am on Friday,
14th June 2019)
(10.30 am)
DR WORDEN (continued)
Cross-examination by Mr Green (continued)
MR DE GARR ROBINSON: My Lord, housekeeping. Bundle of
PEAKs and KELs referred to during Mr Coyne's
cross-examination with, I believe, an index. Could
I hand that up to your Lordship?
MR JUSTICE FRASER: Of course. Thank you very much.
(Handed)
So that's those referred to last week.
MR DE GARR ROBINSON: Last week.
MR JUSTICE FRASER: The one that I handed back, which was
referred to in the evidence of fact, what's happening
with that?
MR DE GARR ROBINSON: My Lord, that was handed up I think to
your clerk at close of business on Tuesday. So you
should have that.
MR JUSTICE FRASER: I see, yes.
MR DE GARR ROBINSON: My instructing solicitors went through
it and put in a proper index.
MR JUSTICE FRASER: You are right --
MR DE GARR ROBINSON: So you should now have --
MR JUSTICE FRASER: So I have now apart from this week,
which one wouldn't necessarily expect. That's very
helpful. Thank you very much.
MR GREEN: My Lord. Just one very quick point before we
resume, if we may. There was a letter that I think may
have been copied to the court sent by Wombles yesterday
about the status of the recently disclosed documents
which include information from the MSC spreadsheets
which were disclosed on 21 December.
MR JUSTICE FRASER: Yes.
MR GREEN: And what is being said there is that from the
email that I sent the court --
MR JUSTICE FRASER: Well, I have read the email and I have
read the letter.
MR GREEN: I'm most grateful.
MR JUSTICE FRASER: Do we need to pursue this now rather
than at the end of the day, given we have Dr Worden
there, or do you want to --
MR GREEN: I'm happy to do it at the end of the day.
MR JUSTICE FRASER: If it is not going to affect what
happens during today, I think the best thing, if you
have any points arising on that, we will revert to it at
the end of the day. Let's get on with the
cross-examination of the witness.
MR GREEN: I'm most grateful.
MR JUSTICE FRASER: All right.
MR GREEN: Dr Worden, could we look first please at {C1/1/1}
which is the Common Issues.
A. The Horizon Issues, right.
Q. Sorry, the Horizon Issues, I do beg your pardon. The
Horizon Issues agreed list.
A. Sorry, could I just put in one thing first? I would
like at some stage, at your convenience, at any time, to
make two corrections to the evidence I gave on Tuesday.
MR GREEN: My Lord, is it convenient to do that now?
MR JUSTICE FRASER: I would have thought it is quite
important to probably deal with them first.
A. Right. The corrections are concerned with the issue of
claimant branch sizes, which if you remember we spent
some time on, and there are two points in which, looking
back at my evidence, I think it needs to be corrected or
improved. Those points are in the transcript at
pages 183 and 181 {Day18/181:1}. You will recall that
at the time I said I was not very clear about what I had
done because the history is, as you well know, that
I addressed the issue of claimant branch sizes both in
my first report and in my supplemental report and the
calculation of claimant branch sizes for my first report
was done about nine months ago, and for my supplemental
report, I have looked it up, and the calculations were
done six months ago. And I will admit, I had not gone
back and refreshed my memory about these before Tuesday
but obviously I did so yesterday.
There are two issues on which I would like to
correct my evidence. One is the factor 1.7 where, as
you recall, we were discussing the distinction
between -- what are they called -- customer sessions and
transactions, and I mentioned I was uncertain about this
factor 1.7. And I shouldn't really have mentioned that
because the uncertainty I had about the factor 1.7 was
some time earlier than my first report, and by the time
of my first report I had satisfied myself in my mind
what the factor 1.7 was and it has nothing to do with
the distinction between transactions and customer
sessions.
Now, my opinion at the time of my first report was,
and it is now, that there are three terms in use. There
are customer sessions, there are transactions and there
are baskets, and my opinion is they all refer to the
same thing. And particularly if you look at all the
stuff there is about recoverable transactions and
cancellable transactions, it becomes quite clear to me
that a customer session is the same thing as
a transaction.
Now, the figure 1.7 was a figure I had come across
earlier in a document which I think is TD Arc 0039, and
I think it is called Horizon Architecture Summary, or
something. We could go to that. But the reference to
that is 1.7 is the average number of products which
a customer buys in a basket and we could find that
reference if you like.
MR JUSTICE FRASER: So the first correction is the 1.7 that
you referred to on Tuesday is the average number of
products which a customer buys in a basket.
A. Yes, it is nothing to do -- and I believe that customer
session and transaction is the same thing. So that is
the first correction.
MR JUSTICE FRASER: And the second correction?
A. The second correction is a sort of history one, that
Mr Green took me to the Angela Van Den Bogard
spreadsheet and pointed out that there are only I think
496 lines in the spreadsheet whereas there are 561
claimants, and so this would make a difference of
approximately factor 10 -- 10%, sorry, a difference of
10% approximately to the answer.
Now what I would like to clarify there is that in my
first report I did make a mistake. I did not take
account of the fact that there were only 496 lines in
the spreadsheet but there are 561 claimants. Now,
I have since gone back and looked at the calculation
which I made on December 28th, I got the spreadsheet for
the supplemental report, and it is evident from that
spreadsheet that I did the summation of the number of --
it is a different calculation because it is three
different years and it is done differently and so on,
but it is evident from the spreadsheet that for each of
those years I actually did the sum of the number of rows
in the spreadsheet, so I corrected that error.
So the result was that while I thought the
difference, the change in my answer from 0.37 to 0.45,
which is a 21% change, I think, while I thought that
change arose from my change of method, in fact it arose
partly from my correcting that error.
MR JUSTICE FRASER: Right, Mr Green.
MR GREEN: Well, we may have to come back to some of those
points.
A. Absolutely yes.
Q. Let's start with a simple one. You are saying now that
you have reflected overnight on what was put to you
yesterday about the difference between transactions and
sessions?
MR JUSTICE FRASER: Tuesday.
Q. Sorry, yes, on Tuesday, about the difference between
transactions and sessions, that they are the same?
A. I believe and I believed at the time of my first report
that they are the same, yes.
Q. And the problem with thinking something that's
completely wrong is that it undermines the basis of any
calculations that you thereafter make on that basis, in
theory, if you were wrong?
A. I had an uncertainty in my mind well before my first
report. What I'm saying to the court is that by the
time of my first report that uncertainty was cleared up
and is my current opinion.
Q. I'm struggling slightly, Dr Worden, to make sense of
this.
Can you tell the court now whether you enquired into
that difference specifically and found out the answer
with confidence before you gave evidence today -- before
you gave evidence on Tuesday?
A. When I gave evidence on Tuesday I had done those
calculations nine months before, I hadn't gone back and
revised it, and I said in court that my memory was
unclear of the time order.
Q. No, no. I'm talking about the distinction between
sessions of transactions.
A. Yes.
Q. Now, had you, before you came to court on Tuesday, at
any time satisfied yourself of the distinction between
transactions and sessions and found there was none?
A. Yes, before my first report.
Q. Before your first report?
A. Yes.
Q. And how did you do that?
A. Well, I considered the nature of recoverable
transactions and cancellable transactions, which in my
mind addresses all the cases.
Q. Well, that came up in the case of Mrs Burke, didn't it?
A. It comes up in all sorts of places. It is a very
important issue of the trial.
Q. Yes, and so a proper understanding of that issue and
whether or not a transaction is the same as a session
would be necessary to any properly formed opinion about
the problem, wouldn't it?
A. No. Proper understanding of a transaction is necessary
for understanding of recoverable transactions and
cancellable transactions. On that basis, I concluded
before my first report that a transaction and a customer
session are the same thing.
Q. So why would there be this reference to 1.7 in
a document that you had previously seen but hadn't
mentioned before Tuesday?
A. Because my memory was confused and I recall that at some
time in the past I had been concerned about this figure
of 1.7, and not having gone back and recalled the
history of my calculations of customer branch size
I mistakenly associated the factor 1.7 with this issue,
and that was my mistake in evidence which I have
corrected.
Q. Okay. Let's look at {F/1461/1}, please. The F bundle
takes a moment to load so it will come up in a second.
(Pause)
This is a receipt in Mrs Burke's case.
A. Yes.
Q. You will see about halfway down the receipt,
"Disconnected session", do you see that?
A. Yes.
Q. In capitals?
A. Where are we?
Q. Halfway down, "Disconnected session". Do you see that?
A. This is a disconnected session receipt, yes.
Q. Then it says:
"Do not attempt to reverse any transaction from this
session."
A. Yes.
Q. They are not the same?
A. The word "transaction" gets used in lots of ways and
obviously here a transaction means a part of what
a customer did, and that's a different sense of
transaction from recoverable transaction which is
a whole thing. This is a recoverable transaction that
had to be recovered.
Q. Not the same?
A. No, there are different uses of the words "transaction".
There is the technical use in terms of computer systems,
there is the use in terms of Horizon, and there is
probably the use that subpostmasters have. But it is my
opinion that a transaction as recorded on Horizon -- it
is my opinion that statistics on customer sessions are
recorded on Horizon and they are synonymous with
transactions, Horizon transactions.
Q. You got the statistics for the number of transactions
from Angela Van Den Bogard's witness statement, didn't
you?
A. From various places. I think there are various
documents which also have transaction volumes in them.
Q. But you took -- you said it was in her second witness
statement, it was actually in her first.
A. For the claimants' branches I got them from her witness
statements. For the mass of branches I got them from
various places.
Q. That is not right actually. You say you took the
figure, the 48 million -- we went through this on
Tuesday -- from Angela Van Den Bogard's witness
statement and note Mr Coyne used the same figure. On
Tuesday I put to you that actually it is her first
witness statement, it is 47 million, and Mr Coyne says
47 million. That's what I put to you on Tuesday. Do
you accept that?
A. I remember that distinction --
Q. Right. Let's look at Angela Van Den Bogard's second
witness statement at paragraph 14.2 at page {E2/5/4}, I
think.
MR JUSTICE FRASER: Which paragraph?
MR GREEN: 14.2.
MR JUSTICE FRASER: I think it does start on page {E2/5/4}.
MR GREEN: I'm most grateful. You can see there, halfway
down, on the left-hand side:
"If there is a payment due to or from the
customer --"
A. Sorry, I haven't got there yet.
Q. About halfway down on the left-hand margin:
"If there is a payment --"
A. Sorry, I just haven't found it. Ah, right down at the
bottom. Halfway down the last paragraph. I was looking
halfway down the page.
MR JUSTICE FRASER: I think, Dr Worden, if you look at
paragraph 14.2 and count down six lines from the top of
that paragraph.
A. Yes, I have got it now. Thank you.
MR GREEN: You will find the words:
"If there is a payment due to or from the customer,
the session (ie the transaction or transactions sitting
in the stack that have not been completed) is settled to
cash and a receipt is automatically printed."
A. Yes.
Q. That is the witness from whom you took the figure for
the number of transactions, isn't it?
A. I took from her spreadsheet, yes. As I say, there are
various uses of the word "transaction" in currency and
I felt that the only thing that could be automatically
measured by Horizon was the number of transactions which
are the same as customer sessions. Now if I'm mistaken
about that, I was mistaken at the time of my first
witness statement, but I still -- it is still my opinion
that a transaction and a customer session, particularly
from the definitions of recoverable transaction.
A recoverable transaction consists of a customer session
in which all these things happen, and then it goes wrong
when some contact has been made with the bank, and the
whole recoverable transaction has to be recovered. And
that's the sense in which I think a transaction is the
same as a customer session.
Q. Dr Worden, I'm going to suggest to you that you were
embarrassed at what we saw on Tuesday and what you have
just come up with this morning is an answer of
convenience to cover up your embarrassment?
A. That's not the case.
Q. We will return to some of the other points later on that
you have canvassed this morning but for present purposes
can we start again at {C1/1/1}, please.
A. Yes.
Q. Now, Issue 1(b) on the Horizon Issues --
A. 1(b) yes.
Q. Yes?
A. Mm.
Q. Is:
"The extent to which it was possible or likely for
bug, error or defects ... to have the potential to (b)
undermine the reliability of Horizon accurately to
process and to record transactions ..."
Yes?
A. Yes.
Q. And you chose to answer Issue 1(b) separately in your
reports?
A. That is right. It is some subsection of 8.
Q. If we look at paragraph 574, please, at {D3/1/138}.
A. It is worth my getting this one out. 574? Oh.
Q. On page 138.
A. Part (b), yes.
Q. Do you have 574 there, Dr Worden?
A. I have it there, yes.
Q. I'm really taking you to this just to be fair to you, to
re-orient you in your report where you dealt with it.
Okay?
A. Mm.
Q. So 574 is your summary where you say:
" ... the Horizon core audit process was designed to
create a secure, accurate and immutable record of what
was entered into Horizon at the branch, and to record
verifiably who entered it."
Yes?
A. Yes.
Q. "In my opinion, regardless of any other processing done
in other parts of Horizon, the core audit database was
an accurate record of transactions entered in the
branch. It was carefully designed, and I have seen no
evidence that it ever failed in service. Therefore in
any case of doubt about processing done in other parts
of Horizon, this record was available to establish the
true state of any branch accounts, based on transactions
entered in the branch."
Yes?
A. Yes.
Q. And that's the substance. Then you deal with it as
being a highly reliable record at page {D3/1/191},
paragraphs 848 to 850.
A. Sorry, are we coming to that? Yes. Okay. Part (b)
again. Right.
(Reads to self)
Right.
Q. Yes? And you explain that we actually have to go back
to two different parts of the report from there, at 849?
A. Sorry, can I get to that?
Q. Yes. We are looking at it.
A. In 4.4 and 6.2.6 I describe the audit system, right.
Q. Yes? You say "highly reliable record of transactions
entered" into the branch, yes?
A. Yes.
Q. And that's your robustness countermeasure of secure
kernel hardware?
A. Yes, and we talk about the secure chain of
communication.
Q. Indeed. Okay? Then from there to get to 4.4 we go to
pages 45 to 48 {D3/1/45}.
A. So we've got more about the audit database here.
Q. Exactly. And it is 173 to 179.
A. 179? Right, okay.
Q. Can we pause on that -- sorry, my fault entirely --
A. So they are the pictures. Yes, okay.
Q. But just pausing there, we see again the phrase in the
second line of 173, "an accurate and immutable record",
don't we?
A. Yes.
Q. Yes. And then we -- "of any activity which can affect
the branch accounts"?
A. Yes.
Q. And then at section 6.2.6, which is on page {D3/1/73},
paragraphs 267 to 271 is where you deal with it again.
A. Again.
Q. Just to trace through. I would like you to look,
please, if you would, at paragraph 270.
A. 270. Yes, okay.
Q. It is over the page on page {D3/1/74}.
A. "... KELs indicates that use of the audit database was a
backstop, and rarely used ..."
Yes.
Q. Now, you have drawn an inference there about the reason
for not using the audit database?
A. Yes.
Q. That's actually a matter in dispute between the parties,
isn't it?
A. Well, Mr Coyne suggested the audit database should have
been used more and differently and that is a difference
between the experts, yes.
Q. But when Mr Coyne suggested that, it was positively put
to him that it was quite expensive and labour intensive
as a justification for not using it?
A. Not using it for every TC, I believe that is
a justification, yes, but every TC and every bug is
a different matter.
Q. Let's look at Day 15 of the transcript, if we may,
please, {Day 15/71:21}.
A. Page?
Q. We are looking at page 71, line 21.
A. "... labour intensive ... expensive ..."
He says he can't imagine why it would be labour
intensive.
Q. Do you remember listening to that?
A. Yes, I think I can --
Q. We can see on the same screen at the bottom of 73:
"Question: And the charge that's made over the
allowance of 720 a year, it is over £200, are you aware
of that?"
Do you remember --
A. Yes, I've always been aware of this figure in the
ballpark of £250, yes.
Q. So the figure you have always had in mind is £250?
A. Something like that.
Q. In that ballpark.
Let's pause there. It seems that -- it appears to
be agreed that the allowance for ARQ requests was 720
a year?
A. I don't recall a precise figure but I am sure you are
right.
Q. I can just show you quickly, {E2/8/4}. That's the
witness statement of Ms Mather at {E2/8/4}. You will
see at paragraph 19 -- yes?
A. Yes, number of ARQs.
Q. She says that she has spoken to a colleague called
Christopher Knight who has confirmed that Post Office
gets an allowance of 720 data queries a year, yes?
A. Yes.
Q. "He is not aware of any fees or penalties having been
paid by Post office, nor anyone being deterred from
making ARQ requests because of fees that might have to
be paid ..."
Just focusing on the number at the moment.
A. Yes.
Q. 720 appears to be right. Let's look please at
{F/1092/1}. You can see underneath "Financial Benefits"
the second point:
"ARQ ... retrieval process ..."
A. Yes.
Q. And you can see 720 requests there, can't you?
A. This is subsumed without breakdown.
Q. Yes. But you can also see there that the figure that's
referred to there is £450 --
A. Yes.
Q. -- per unit, can't you?
A. Yes. Well, I think it's the division gives that answer.
Is that right?
Q. Well, let's take it in stages. What was put to Mr Coyne
without any document or any particular basis was the
figure was over £200?
A. Well, I think -- I would imagine there are two different
figures. In other words, there is a bulk price for your
first 720 and that works out. You have paid that
already and you can get 720 for that, and so the average
of those is that much. Then if you go beyond that, for
each one you pay a different figure.
Q. And you think the £200 is the extras?
A. I suspect so, yes. But there are those two figures and
I haven't really gone into the detail of that because
250/450, you know, it doesn't seem to me hugely to
influence my opinion --
Q. It is just a bit more than double, isn't it?
A. Yes.
Q. And that's not an order of magnitude that would bother
you from an engineering perspective --
A. -- it's not a thing that feeds into any of the numbers
I have tried to calculate really.
Q. But it might feed into whether or not cost was
a disincentive to seek ARQ requests?
A. Well, as I say, the issue Mr Coyne raised was seeking
ARQs for every TC, in other words 100,000 a year, and
that's rather different from seeking evidence for
a suspected buyer.
Q. Well, what about -- if we just focus at the moment on
looking at ARQ data where in every case the
subpostmaster queries the transaction.
A. Yes.
Q. If the cost was half, you would be able to get twice as
many, wouldn't you, for the same amount?
A. For the same budget, if you choose the same budget on
that, yes.
Q. Yes. So it makes a bit of a difference?
A. Yes, I agree it does.
Q. And --
A. But as I say, my impression is ARQ, you know, is
a backstop basically. And normally one can investigate
these issues without going to ARQs and one can arrive at
a position of understanding what happened without going
to the ARQ because MISs are designed to do that.
Q. Let's take it in stages, if we may. Just eyeballing the
figure of 384,000 and dividing by 720, that's actually
about £533, isn't it?
A. Oh really? Right, yes, okay.
Q. And what was put to Mr Coyne was it was over £200?
A. Mm.
Q. Would you say that's consistent with it being 450 or
533?
A. Well, it is consistent -- consistent to me means not
contradictory --
Q. Yes, so it is consistent?
A. And that's consistent, yes.
Q. So it is literally consistent but quite misleading for
purposes of trying to work out whether it is
a disincentive, isn't it?
A. I'm not sure who is misled.
Q. I'm just saying if someone is saying cost is a
disincentive because you are charging over £200, it
doesn't really tell the whole story if the true price is
450, 436 or 533, does it?
A. But the 450 was paid upfront so, you know, however many
you go towards your 720, it doesn't make a difference
what Post Office paid, so it wasn't a disincentive for
them.
Q. Dr Worden, you are making it up as you're going along.
A. I'm not. I'm answering your questions as you put them
to me.
Q. The true answer is you have no ideas about these figures
and you're guessing what they might be.
A. No, I'm not. I'm answering your questions.
Q. You don't know any of this.
A. I'm trying to answer your questions --
Q. I understand --
A. -- on an issue I have not looked at in great depth.
Q. That's rather the point. I'm not disputing you are
trying to answer the questions, I'm putting to you that
you have no foundation for doing so. Do you agree with?
A. My knowledge of the price of ARQs is not very precise
because I haven't focused on them in my -- that price in
my reports. So I'm trying to do the best I can to
answer your questions.
Q. It is perfectly okay to say "I have no idea about that".
A. That wouldn't be true.
Q. Then what idea do you have?
A. I have an idea that I have seen some of these figures
and I know it is in the ballpark of £250/£300 --
Q. Yes, but let's focus on a particular thing that you have
given evidence about. You say there is a distinction
between the ones you get all paid for in advance, which
you were saying would be the £200 price, £200 a unit?
A. No, the ones you get more for in advance are the £450 --
Q. Sorry, quite right. And you say you pay £200 for the
additional ones?
A. That's been my understanding, yes.
Q. Where do you get the £200 for the additional ones from?
A. I can't recall exactly. My understanding of these
things builds up from all sorts of documents I read and
I can't, I'm afraid, always point to say: this document
is where I got it.
Q. Well, I'm positively putting to you, Dr Worden, that you
are giving answers that you think are consistent with
what has been put as part of Post Office's case rather
than from any actual facts you have?
A. That is not true.
MR JUSTICE FRASER: I'm going to ask a question to clear it
up and then I'll ask Mr Green to move on.
In the last couple of minutes you have mentioned
a number of different prices and I just want all costs.
I think you said £200 and at one point you said ballpark
£250 to £300. Do you know how much the requests in fact
cost?
A. I don't know in detail. The figure I have always had in
mind is ballpark 250.
MR JUSTICE FRASER: Mr Green.
MR GREEN: If we look please at {F/994.1/2}, this is
an email which is at or about the same time as the 2012
document we were looking at a moment ago.
A. Right.
Q. And you will see on that second page, if you come
two-thirds of the way down, do you see "Monthly
Reporting"?
A. Yes, I see that paragraph.
Q. Okay. Just below that:
"We have always worked on the belief that a single
ARQ costs now about £450 each ..."
Do you see that?
A. Yes.
Q. Just pausing there. The first point is that
an organisation is going to take its decisions based on
the beliefs it has whether they are right or not, aren't
they? If everyone believes it costs about £450 --
A. That seems to have been the consensus view amongst
various people in Post Office, I'm not sure what
population of people it is.
Q. Okay. This is what is said by Mr Laycock here. He
says:
"... in that I have costs from 2004 that identified
an uplift of an additional 390 at a cost of £170,000."
A. Yes.
Q. "This indicates a large unit cost of £436 per
enquiry ..."
A. I take it that the division works.
Q. It does, I think it is 435.8.
"So the cost we have assumed now to be in the region
of £450 ..."
And then:
" ... although Sue has stated 'there is provision in
the contract to increase the maximum number of queries
and if we do so the charge would be £207 per query.'"
So if they were to change the contract they would be
able to get additional ARQs much more cheaply?
A. Yes, this is sort of buy more get a discount.
Q. So would you accept, first of all, that this appears to
be the position that they were working on?
A. Yes. I mean this is a snapshot of what they thought at
a certain time.
Q. Right. Let's go, please, if we may, now to {F/728/1}.
This begins at the back of this change. This relates
to --
A. This is 2010. What was the last one?
Q. 2012?
A. So this is a bit earlier.
Q. This is a bit earlier. This begins at the back of the
chain. I will take you, if I may, to the last actual
text which is on page {F/728/12}, other than
Michele Graves' name and contact details.
A. So this is at the bottom. It starts with the first or
the last in the chain, sorry?
Q. Now, do you see the second paragraph of the "Hi Lin"
email?
A. Sorry, could I ask, this is an email chain where the
first email is at the bottom?
Q. Yes, it is.
A. Right, okay.
Q. The second paragraph under "Hi Lin" at the bottom:
"Moving forward, can you confirm what your next
steps are re the points she has raised. I know you are
waiting for the audit trail of the transaction events.
Re the comment about the two auditor visits monitoring
her work and apparently also having a problem with the
figures, are you obtaining a report from the auditor? If
this escalates we will need to answer the apparent
discrepancies in the figures on his laptop & horizon."
A. Yes.
Q. Pausing there, that's a reference to the fact that the
auditor had figures on his laptop that he had worked out
that were different from the ones on Horizon?
A. Yes, and presumably he had done this by making a visit.
Q. Yes.
A. Right. Okay.
Q. So there is a discrepancy between the figures the
auditor thinks Horizon should show and what's on
Horizon.
A. Yes.
Q. And they are asking about whether they are getting
a report. If we go up to the email above --
A. "I have changed it slightly."
Do you know what "it" is?
Q. Let's just focus on the next paragraph:
"In terms of the points raised we do have a report
from the auditor but it is probably not detailed enough
to cover all the points, so we will probably need to go
back on this as part of the contractual case. In terms
of the audit trail via Horizon we are waiting for Mark
Dinsdale to authorise the case as he holds the budget.
"Nigel has today referred the case to Jason Collins
requesting their involvement given the level of losses -
I will forward e-mail separately. Need to see where this
gets us before we can move the case forward or start to
answer her detailed questions."
A. Yes.
Q. So you can see the genesis of this.
A. Okay.
Q. So this is a classic case where the ARQ data might well
be helpful, isn't it?
A. It looks like it. It looks they are considering getting
the ARQ data, yes.
Q. And it is particularly acute, the need for the ARQ data
here, because you have got the subpostmaster asking
detailed questions and challenging what's being shown.
You have got an auditor with figures that he says should
be on the system?
A. Yes.
Q. And those are differing from Horizon?
A. Let me check --
Q. That's the premise of this enquiry?
A. The differing from Horizon, yes, that was in some
previous paragraph.
Q. Yes exactly, just setting the stage. So this is
a particularly important example of when you might wish
to seek ARQ data to resolve what's happened?
A. It sounds like it, yes.
Q. That's reflected on page {F/728/11}, if we go back to
that.
A. Yes. We are on 12 now. Go to 11. Yes.
Q. "Thanks Lin:
"Have made suggested changes & sent:
"If we can encourage Mark Dinsdale to authorise the
audit trail, I feel it would be beneficial given the
current interest in Horizon from media & MP's."
A. Right.
Q. Now, was it your impression when you drew the inference
in your report that they would get the audit data if
they needed it? Was it your impression that they would
be tipped over the edge into trying to get it if there
was media interest or interest from MPs?
A. I wasn't concerned with that.
Q. No?
MR JUSTICE FRASER: I think he answered two questions
together there, Mr Green. I wonder if you could put
them separately.
MR GREEN: I'm grateful.
Dr Worden, did you think that Post Office would only
think about getting ARQ data because of interest from
media and MPs when you were looking at the inference you
drew?
A. Which inference?
Q. The inference that the reason they didn't get ARQ data
was because they had every other information source they
needed?
A. Well, we must distinguish between -- what I was mainly
looking at was investigating potential bugs and
mysteries, and that is a mixture of Post Office and
Fujitsu. I was certainly not concerned with Post Office
business decisions about whether media attention or
political attention made it more important or not.
I was not concerned with that.
Q. Because here, Mrs Stubbs' case, not only have we got the
problem itself, militating in favour of getting ARQ
data, but on top of that we have got an extra layer that
they seem to be giving weight to on the face of that of
current interest in Horizon from media and MPs, haven't
we?
A. Yes.
Q. So that is a further reason for them to be apparently
motivated to get it. Let's go, please, now forward to
page {F/728/9}.
A. Right, we are moving back, so this is --
Q. There is an email from Mark Dinsdale, do you see that?
A. Right, and he says it'll take three weeks, yes.
Q. That's not really the point, is it, because if we read
on it says:
"Has Jason agreed to take this case on, because we
don't hand over Horizon logs to a spmr."
A. Where are we?
Q. Just after "3 weeks" where you stopped reading.
A. Yes, he says that.
Q. Why would they not give Horizon logs to a SPM who was
concerned about discrepancies in their branch?
A. I don't know. I haven't looked at it.
Q. "It needs an expert to understand what it says, and
usually this requires one of the investigators."
A. Yes, um --
Q. "I'll give Jason a call in the morning ..."
I will just read it to you and then ask you
questions, if I may?
A. Yes.
Q. "... then I will raise an ARQ from Fujitsu."
Then he says this:
"Is this for our benefit, as there is a cost
attached to ARQ requests, we do get a supply free of
charge as part of the contract but we usually don't have
enough, therefore we usually charge the defence
lawyers."
A. Yes.
Q. Cost was a disincentive for Post Office based on this
email, wasn't it?
A. Well, I mean on this email they are saying we charge the
defence lawyers, so it is not actually a cost for them,
but I have to read this email carefully to answer that
question.
MR DE GARR ROBINSON: My Lord, I do rise to ask whether this
line of cross-examination is productive with this
witness? He is an expert giving evidence about the
operation of the Horizon system, and my learned friend
wishes to put a story to him, but isn't this a matter
best left for submissions rather than taking time up in
cross-examination?
MR JUSTICE FRASER: Well, as you know from last week I am
relaxed about how counsel uses their time, but you are
correct, that last question was in fact submission
because it was asked about the thought processes within
the Post Office.
So Mr Green, if you would like to put the point
based on this expert's view of cost incentive or
disincentive. And the point, as Mr de Garr Robinson
says, effectively boils down to one of submission, so
I would not necessarily spend very long on it, but as
you found out last week I will let both of you during
your cross-examination spend as long as you want on any
points you might think are useful to each of you.
MR GREEN: I'm grateful.
You didn't consider this before you formed the view
that you have expressed in your report, did you?
A. No, because -- I didn't consider it -- I didn't see this
email chain before I formed my view.
Q. You accept that what you have seen here would be
relevant to forming the inference that you have
expressed in your report, wouldn't it?
MR DE GARR ROBINSON: Which inference? Could you --
MR GREEN: The inference which was the beginning of this bit
of the cross-examination about the reason for not
looking at ARQ data.
A. Can we go to that inference? That was that MISs were
normally sufficient for the purpose, I think.
Q. Right.
A. And what did I say in my report that we are referring
to?
Q. Let's look back. Paragraph 270 on page {D3/1/74}.
A. 270:
"... audit database was a backstop, and rarely used
..."
Yes.
"... other comparisons of data were usually
sufficient to diagnose the problem."
That was my inference, yes.
Q. And I positively put to you that was an inference you
drew, yes?
A. Yes.
Q. And you drew the inference about the reason for not
looking at the audit database?
A. That was a technical inference based on quality of data.
Q. I'm going to suggest to you, Dr Worden, that you and
Mr Coyne found that the audit data was very rarely
referred to. That's agreed?
A. I think so, yes.
Q. And you felt the need to explain that away, and that's
why you said there that it was:
"... because other comparisons of data were usually
sufficient to diagnose the problem."
A. I would not put it as explain away. I was trying to put
in context the way audit data was used and I felt that
was part of the description.
Q. Having seen the documents I have just put to you, do you
accept that the cost of these was a disincentive to
Post Office using the ARQ data which you should have had
regard to, or now do accept you will have regard to, in
relation to that issue?
A. My view has always been that in the context of TCs, the
cost of retrieving ARQ data would be a disincentive
because they need 100,000 TCs a year and it would have
been prohibited.
Q. I'm asking you about what I have shown you and I have
given you the example of Mrs Stubbs, who was not dealing
with TCs, she was dealing with problems with her branch
accounts, and I have shown you the other documents.
Last chance. Do you accept that it appears on the
face of these documents for the purpose of any such
inference that cost was a material disincentive?
A. It appears from these documents it was, yes.
Q. Thank you.
Now, we had disclosed on the Tuesday before the
trial started some further ARQ data, that's 28th May,
which was described as going back to 2004. There is
a year missing from that which is still being pursued,
so I may have to come back to that with you, Dr Worden.
But you hadn't looked yourself at the number of ARQ
requests made in any particular year, had you?
A. No.
Q. You heard Mr Coyne's evidence about system design,
didn't you?
A. Yes.
Q. And just stepping back for a moment, it seems that
Fujitsu had negotiated for themselves a contract where
Post Office couldn't actually see the data in the audit
store or read it in real time. That is correct?
A. The audit store, yes.
Q. It could not be read in real time?
A. That is right, not designed --
Q. And that was the arrangement?
A. Well, that was the business requirement that apparently
Fujitsu and Post Office had agreed.
Q. That's what they agreed. And I think we saw in the
Peter Laycock email we went to earlier, I didn't point
it out to you, but they were paying about £11 million
a year for their data centre and ARQ service and it was
from that budget that the ALQs were provided.
Nonetheless there was a limited number of requests they
could make and they had to pay about £450 or so they
thought. So that is where we got to, yes?
The matter that was being put to Mr Coyne was that
it was expensive and therefore it was reasonable not to
do it. That's a consequence of the way the relationship
has been designed and what they have agreed, isn't it?
A. Well, to my mind it is the consequence of the fact that
there are 100,000 TCs a year --
Q. I'm not talking about doing it to every TC, I'm just
talking about whether you have access to read the audit
data, and I'm saying what we have established was the
position, you would fairly accept, of the consequence of
the way the arrangement had been set up between
Post Office and Fujitsu --
A. It is a consequence of the way the Post Office had
defined their business requirements, and Fujitsu and
Post Office had agreed requirements and had built the
Horizon system this way. It was a consequence of that.
Q. Yes. So it is a consequence of the design and build of
the system --
A. Yes.
Q. -- based on the business requirements that Fujitsu and
Post Office had agreed between themselves?
A. Yes.
Q. And if we look, please, at Day 15 of the transcript at
page 87 {Day15/87:1}. I'm going to ask you to --
A. 87?
Q. Yes, page 87. If you look at lines 1 to 14.
A. Yes, can I read all that through? (Pause)
(Reads to self)
Yes.
Q. You have heard of the acronym WORM, haven't you?
A. Yes.
Q. What does it mean?
A. Write once read many.
Q. And that's not an idiosyncratic acronym of Mr Coyne,
that's a standard industry --
A. No, I think that is pretty common.
Q. Pretty common?
A. Yes.
Q. Mr Coyne says there, when it is put to him that it has
to be cracked open hundreds of times a day, the separate
seal core audit store, His answer is:
"Answer: I think the word 'sealed' is misleading
and the concept of cracking something open to get access
to it I think is misleading as well.
"Things in an audit store are only -- can be written
to and only written to once, and the term that's often
used is write once read many, WORM. So the process is
written to once, but people can read from that store on
many occasions."
Now, that is not an uncommon system for that kind of
data, is it?
A. I think it is fairly common, yes. I'm not --
Q. Hence the acronym, actually?
A. Yes.
Q. And if we look at page {Day15/84:6} to line 14, you can
see him, Mr Coyne, explaining the purpose of an audit
store.
"Answer: Well, the purpose of having an audit of
what happens at branch counters is so that if there is
a dispute over what has happened that somebody,
presumably this will be Post Office, can have a very
quick look at what happened and find out the truth.
That's the purpose of having an audit store. There is
no other reason for it other than looking back at what
actually happened. It is my perception that that look
back was available to people at the Post Office."
A. Yes.
Q. Yes? Now, that is right so far as it goes?
A. Let me see.
Q. Subject to cost etc and time to get the ARQs from
Fujitsu?
A. Sorry, can I read that paragraph again?
(Reads to self)
Now, "very quick look" is not what was intimated.
It is not what Horizon did.
Q. Well, it was open to Fujitsu to at least look back when
they eventually did get the ALQ data, wasn't it?
A. Well, the business requirement had been stated and
agreed that here is this audit store and it does these
things. A quick look was not one of them.
Q. Do you have any practical experience yourself of working
in or designing audit stores for different systems?
A. Let me think. Not this kind of audit store.
Q. No, because Mr Coyne says he does at page {Day15/82:2}
to line 14.
A. Let's look at this. Page 82, line?
Q. Do you see that?
A. (Reads to self)
Okay.
"... they don't have to work in the way ..."
Q. Yes. And he agrees with you, they are:
"... often very easily accessible to be able to be
read by certain users ..."
Hence the WORM acronym.
A. Sorry, what does he agree with me?
Q. Well, do you agree with him that audit systems of the
WORM type are:
"... often very easily accessible to be able to be
used by certain users ..."
There's nothing inherently difficult about that if
you design it that way?
A. If the business requirement is that and you design it
that way, then it is possible, yes.
Q. Yes. And if you don't design the system that way, it is
not?
A. That is right, yes.
Q. And if we look at {D3/1/102}, paragraph 400.
A. Yes, right.
Q. You say:
"I have not had much personal involvement in
building secure kernel software ..."
MR JUSTICE FRASER: Which paragraph?
MR GREEN: Paragraph 400:
" ... or computer security techniques, although I'm
familiar with the underlying mathematical specification
methods."
And that's fair?
A. I said it.
Q. Now, just focusing on the gold standard or tamper-proof
nature of the information in the audit store now. You
have described it as a gold standard in your expert
report?
A. Yes.
Q. And you say it is a highly secure and tamper-proof
record of what's entered into Horizon at the counter,
etc, as a gold standard for comparison for data held in
other parts of the Horizon estate, etc, supporting the
diagnosis of software errors.
Now can we agree that the point where the accuracy
of the audit store data matters is the point at which it
is actually being looked at for comparison with what's
there at the branch or on the auditor's laptop?
A. Well, accuracy matters in any context it is used.
Q. Okay, in any context it is used?
A. I think so.
Q. But you would accept that its accuracy matters within
the audit store?
A. Yes.
Q. Because if it is wrong there it is just wrong?
A. Yes.
Q. And its accuracy matters when it is being looked at
after it has been extracted, yes?
A. Yes.
Q. Because if it is not still as accurate as it was in the
audit store you have got another problem?
A. Yes.
Q. Mr Dunks gave evidence on this, Mr Miletic
cross-examined him on that. Were you there for that?
A. I do not think I was, actually.
Q. Can we look at {F/1716/43}, please.
A. "Extraction client", right.
Q. So this is a page of the audit extraction client user
manual.
A. Right.
Q. And we want page 43, if we may.
A. Could I just clarify. There are two stages in an audit
extraction, there is getting the xml raw data out and
then there is converting it to spreadsheets. Is this
referring to both --
Q. Well, it looks as if it is looking at the process
overall but we will take it in stages.
It says:
"TMS and BRDB messages --"
A. Sorry, where are we?
Q. At the top of the page.
A. Okay.
Q. ""TMS and BRDB messages are numbered in sequence for
each node. During filtering any retrieved audit message
data is analyzed to determine what message sequences are
present in the data and whether there are any gaps or
duplicates in those sequences. A gap in a message
sequence may indicate that a message is missing from the
audit data."
A. Yes.
Q. "Duplicates may indicate that an audit file has been
gathered twice."
A. Yes.
Q. Do you see that? And if you look at the actual dialogue
box that would be on the screen, on the right-hand side,
can you see "Gaps Found (shown in red)", and "Duplicates
Found (shown in blue)"?
A. Yes.
Q. Then underneath that, do you see "Seek assistance from
audit support"?
A. Yes.
Q. Then the text below the diagram or figure 27:
"When gaps are found, the gaps are shown in red in
the message ... list ..."
And so forth.
"When duplicates are found ..."
And so forth?
A. Yes.
Q. Did anyone tell you or give you -- direct your attention
to the transcript of Mr Dunks' cross-examination about
this?
A. No, I don't think so. I think I have read that
transcript though.
Q. Had you seen this document before you --
A. I certainly looked at this document, yes.
Q. This page?
A. I'm not sure about this page. I was more concerned with
the process of getting from the xml to spreadsheets and
the different spreadsheets I might get out.
Q. Let's pause. You would accept that this introduces
a more complete aspect of the picture as to whether or
not the audit data is a gold standard, doesn't it?
A. It obviously clarifies understanding audit data, yes.
Q. And the fair inference from the document is that gaps
and duplicates do occur?
A. No. I think the fair inference from the document is
that if gaps and duplicates occur you should be
concerned.
Q. So you are not prepared to accept that the fair
inference from this document is that gaps and duplicates
do occur in the audit database?
A. I do not think that's a fair inference. I think the
fair inference is that they are not supposed to and if
they do you should seek assistance.
Q. So in fact even if you had seen this, it wouldn't have
changed your view about gold standard, would it?
A. No, it doesn't. I'm saying that gaps and duplicates are
something to worry about, therefore raise the alarm.
Q. Pausing there. If there were gaps or duplicates, they
could arise on the journey of the data to the audit
store to the point of being committed, couldn't they?
A. Yes.
Q. They could arise on the journey out of the audit store
as a result of the extraction process itself?
A. That sounds less likely but possible.
Q. Possible but less likely. Or there could be some sort
of bug, error or defect or form of remote access that
might make the underlying data unreliable?
A. What do we mean by that?
Q. Well, let's just -- let's take for example the
piggy-backing into the counter, and if you accept for
a moment that if that means that a transaction can be
done remotely that looks as if it is being done in
branch, the data in the audit store is going to record
what was shown in branch, which is that it was done in
branch when in truth it was done remotely?
A. Firstly, nobody has ever explained to me what
piggy-backing is and I'm uncertain as to what
piggy-backing means, it is not a technical term --
Q. I understand, but I'm just asking you to assume that's
what it means, not to challenge it.
A. You say what's shown in branch. I mean ... I'm
struggling with this question a bit. In other words,
the audit store has been designed to record what
happened in branch and normally that's what happens.
Now you are asking me what else might have happened, and
normally I would expect any process of remote access to
branch accounts to record in the transactions, for
instance with counter 32 as one mechanism, that
something different had happened and therefore I would
expect that to go to the audit store.
Q. Let me put it this way, Dr Worden. If it didn't record
that, that's what would go to the audit store?
A. If there was a bug or a fault in the software that was
used to piggy-back for instance, and piggy-backing did
not leave a trace in transactions, then that would be
the case.
Q. If piggy-backing itself did not leave a trace in
transactions that's what would show up in the audit
store?
A. Absolutely, yes, that is right.
Q. Now Mr Dunks couldn't assist on the cause of potential
gaps and duplicates when he was asked about it.
A. Mm.
Q. But what we can see is their suggestion that one should
seek assistance from audit support if gaps or duplicates
were found?
A. Yes.
Q. Do you know anything about that process that audit
support would use?
A. I haven't looked that deeply, no.
Q. Do you know that it was a semi-automated process?
A. As I say, I haven't looked into it.
Q. Because we know from the Seema Misra case that it was
referred to by Mr Jenkins in a witness statement to the
court which, just for your Lordship's note, is
{F/676/2}. It is referred to as a semi-automated
process to remove duplicates, for example.
A. What stage was Mr Jenkins referring to?
Q. What had happened in the Seema Misra case was ARQ data
had been obtained, it had duplicates in it, they were
spotted, and then there was what was described as
a semi-automated process to remove them.
A. Yes, I believe this -- what was the date of this ARQ
data?
Q. As at 2010 I think.
A. That was the Seema Misra case at that date, was it?
Q. Yes, but you don't know anything about this?
A. I have an approximate awareness that at some stage
duplicates can arise because of two correspondence
servers, for instance, and that they have to be removed
at some stage. That's as far as I have gone.
Q. What about gaps?
A. Gaps are rarer, I would suspect, and they are -- again
I haven't looked in depth at the process by which gaps
might occur but I believe they are not supposed to
happen.
Q. Because a few minutes ago you were saying neither were
supposed to happen?
A. I believe that is right, but "happen" may refer to
several locations in the process, and by the time it
gets in the audit store I believe it is the intention
that duplicates and gaps should not be there.
Q. That sentence encapsulates one of the biggest
differences between you and Mr Coyne, doesn't it,
Dr Worden?
A. I don't know.
Q. What Mr Coyne has observed is your report is written
from the point of design aspiration: this is the
intention and I'm going to assume that the intention is
achieved. And Mr Coyne has taken a different approach
of trying to see on the ground whether it was. Do you
accept that as a fair characterisation of your two
different approaches?
A. No, I don't. I have looked at testing a lot, I have
looked at in service a lot, so I have not looked at
design aspirations only.
Q. So do you feel that you looked in relation to the bugs
that you and Mr Coyne discussed, which we will come to
later, do you feel that you looked at that carefully to
form a view about that, did you?
A. I looked -- I mean, I looked for bugs. We both looked
for bugs and we both did as carefully as we could.
Q. I see.
MR JUSTICE FRASER: But this document that's still on the
screen is about extracting the data from the audit
store.
A. Yes.
MR JUSTICE FRASER: And as I understand what you have said,
and I just want to check in case I have misunderstood,
duplicates may occur, they shouldn't, but they may
because of the use of two correspondence servers.
A. On the way.
MR JUSTICE FRASER: Is that on the way out or on the way in?
A. I would expect that duplicates coming out are not
intended whereas duplicates are somewhere on the way in,
and somewhere on the way in duplicates are removed.
MR JUSTICE FRASER: But they could occur both on the way in
and on the way out, is that right?
A. Well, on the way in I think they are perhaps more to be
expected. On the way out they are a sign that something
is wrong.
MR JUSTICE FRASER: And what about gaps?
A. Gaps on the way out I think are again a sign that
something's wrong.
MR JUSTICE FRASER: And what about on the way in?
A. It is not clear whether they may happen. For instance,
if a counter gets isolated, you get maroon transactions,
you might get gaps on the way in.
MR JUSTICE FRASER: All right. Thank you very much.
Mr Green.
MR GREEN: I'm obliged.
Can we look at audit data reversal indicators. If
we can look please at {F/829/1}, it is a document from
11th August 2011, and it is a document that records that
ARQ don't identify transaction reversals.
So this is a PEAK, it is PC0211833. If you go to
the bottom of page {F/829/2}, please.
My Lord, we have got a ring binder with this first
one in for Dr Worden to add the ones we do as we go
along.
MR JUSTICE FRASER: All right.
MR GREEN: As we pass them up, is it all right that
Mr Donnelly --
MR JUSTICE FRASER: Yes, of course. What, goes and puts
them in the file, or hands them up?
MR GREEN: That is right.
MR JUSTICE FRASER: Of course.
MR GREEN: I'm most grateful.
Dr Worden, if you look at page 2.
A. Right.
Q. At the foot of page 2?
A. Yes.
Q. Do you see "Impact on Operations" in capitals about five
lines up?
A. Yes.
Q. Underneath it says:
"Spreadsheets supplied by the prosecution team miss
out an indication as to whether a transaction is
a reversal."
A. Yes.
Q. And it appears to be thought that that's relevant there?
A. Yes.
Q. And that is -- what's being spoken about is the
extraction process of data from the ARQ logs?
A. That is right.
Q. Underneath it says:
"The prosecution team are well aware of the problem;
we hope to have a release out in a few days; a KEL is
therefore not required."
A. Yes.
Q. So it looks as if this was being taken in hand.
If we go over the page to page {F/829/3}.
A. Yes.
Q. Do you see "FASTARQs" at the top?
A. Sorry? Fast ARQs.
Q. Exactly. It says:
"They just need to run fast ARQs with all the
various queries and check that the HNG-X spreadsheets
all now have a reversal column."
A. Yes, right.
Q. It says under "Risks":
"There are a few risks with this fix. It must be
got out or prosecution evidence is incomplete."
It is clear, isn't it, that what the ARQ data would
show would depend on how it was going to be extracted?
A. Yes, I mean --
Q. That's fair?
A. -- to fill this in a bit, extraction is getting out the
xml and then running various programmes to convert the
xml into various different possible spreadsheet forms,
and I believe there is more than one, and these xql
files are xml query files that take xml and extract
stuff from it.
Q. But the answer to my question was yes?
A. Yes. I was just adding a bit of clarification.
Q. If we can now go please to {F/1082/1}. So that was
August 2011. This is 12th June 2013. This is the
document that has been referred to as the Helen Rose
report.
A. Mm.
Q. Is this a document you have seen before, when it comes
up?
A. Certainly the Helen Rose report, when it comes up,
I would have seen before.
Q. You are familiar with it?
A. I'm fairly familiar with it, yes.
Q. Now, it is at {F/1082/1}, and if we look please at page
3.
Let me give you the context. Look at the bottom of
page {F/1082/2} first.
A. Now the blue is Gareth Jenkins in this, I believe.
Q. That is right. At the bottom of page 2 you see a
question:
"I can clearly see the recovery reversal on the
fujitsu logs received, but would this have been clear
had we not previously discussed this issue."
Do you see that?
A. Yes.
Q. As you say, the blue is Gareth Jenkins. When you had
your conversation with Mr Jenkins about the receipts and
payments issue, did you also discuss this?
A. No, not at all.
Q. Okay. If we go over the page please to {F/1082/3}, and
you look at Mr Jenkins' answer in blue --
A. At the bottom.
Q. At the bottom.
A. Yes.
Q. "I understand your concerns. It would be relatively
simple to add an extra column into the existing ARQ
report spreadsheet, that would make it clear whether the
Reversal Basket was generated by recovery or not."
A. Yes.
Q. "I think this would address your concern. I'm not sure
what the formal process is for changing the report
layout. Penny can you advise ..."
And so forth.
Then at the foot of the page:
"May recommendation is that a change request is
submitted so that all system created reversals are
completely identifiable on both Fujitsu and Credence."
Now, Angela Van Den Bogard gave her evidence that
she didn't think this had been acted on, this
recommendation. You haven't seen anything to indicate
that it has in relation to the extracted audit data,
have you?
A. I certainly don't know. I should say that if it had
been acted on, the way I would imagine it would be acted
on is to produce a change in some of these xql files
which do the conversion to spreadsheet.
Q. And that is a relatively simply thing to do as
Mr Jenkins said?
A. I think so.
Q. So there is no sensible reason not to do it, is there?
A. I don't know.
Q. Well, if it is something you want to do and it's
important and relevant, you explain it's easy to do, can
you think of a sensible reason why you shouldn't do it?
A. No, I can't. But I don't know what the priorities were
or what the business considerations were or anything
else, I just know I don't know whether it was done or
not.
Q. Now, we have looked at your approach to Issue 1(b) which
is to focus on the audit store data?
A. Yes. I think that is not my only conclusion on
Issue 1(b).
Q. Would you fairly -- because I don't want to take you
back to your report -- accept that is the focus of your
answer to 1(b)?
A. Well, if we go back to my report there were several
paragraphs in 8 point whatever it was.
Q. I haven't got time to show you every document again but
let's focus on this. You agree with Mr Coyne that
Horizon does not record disputes. That's agreed?
A. Yes, that's agreed.
Q. So the Horizon system does not record whether one of the
parties involved in the transaction, namely the
subpostmaster, agrees that a figure is correct or
disagrees?
A. Well, disputes are disputes between presumably the
postmaster and the Post Office about what happened.
I was not -- that's what I was referring to.
Q. There's no dispute button on the screen?
A. No.
Q. No. And were you aware that the suggestion of a dispute
button being on screen was considered and rejected in
2008?
A. I wasn't aware of that, no.
Q. Furthermore, where an amount is less than £150, you are
aware, aren't you, that an SPM can't settle centrally?
A. Yes.
Q. So in relation to individual items of £150, even if
disputed, the SPM has to make them good by cash or
cheque?
A. I think that is right.
Q. And there could be more than one of those?
A. In a month or in what?
Q. In a trading period.
A. Well, my understanding is that in a trading period, if
the aggregate amount is less than £150, then it's got to
be cash on the nail. If it is bigger it can be suspense
account.
Q. We will come back to that.
The points relevant to the reliability of the
Horizon system to record transactions are essentially
these, that in certain cases the Horizon system will
record a figure which is in dispute. That follows from
what we have just said?
A. The Horizon system is recording loads of figures and
some of those figures may be in dispute, yes, certainly.
Q. And because of your view about transaction corrections
being necessary as part of the overall system, those
transaction corrections are at some point in time
correcting figures on Horizon which would otherwise be
wrong?
A. Yes. Certainly.
Q. So without those transaction corrections the figures
shown on Horizon are wrong?
A. They could be wrong for a variety of reasons, all sorts
of reasons --
Q. The answer is yes?
A. TCs try and correct all sorts of errors.
Q. The answer is yes?
A. Yes, but I'm saying there are lots of causes.
Q. I'm not asking you about --
A. I'm saying yes.
Q. And it might be that the subpostmaster knows or believes
the figure to be wrong?
A. Yes.
Q. It might be that Post Office or possibly Fujitsu believe
the figure to be wrong?
A. There are all sorts of investigations, yes, which can
lead to views about figures being wrong.
Q. And it might be that two or more of those parties will
think that the figure is wrong?
A. Yes.
Q. But it is still the figure on Horizon which requires
a transaction correction later?
A. Yes.
Q. So even where everyone agrees that a transaction
correction is necessary, the figure shown on the Horizon
system itself is wrong?
A. Intermittently wrong, and the point of the transaction
correction is to make sure that in the long-term Horizon
is right.
Q. Indeed. Now picking up from Tuesday in relation to
transaction corrections and the time that they take to
issue --
MR JUSTICE FRASER: Are you onto -- is this a convenient
moment?
MR GREEN: I'm so sorry. Yes, that would be a convenient
moment.
MR JUSTICE FRASER: I get the sense we are moving on to
a new topic.
MR GREEN: Indeed.
MR JUSTICE FRASER: Possibly because you said picking up
from Tuesday.
Right, we will have 10 minutes, Dr Worden. Same
score as before. You know the drill. And we will come
back in at 12 o'clock.
(11.50 am)
(A short break)
(12.00 pm)
MR GREEN: Dr Worden, picking up from Tuesday in relation to
TCs and the time they took to issue, can we look please
at {F/1324/1}.
A. Yes, right.
Q. Is this a document you have seen before or --
A. I'm not familiar with this one, no, sorry.
Q. When you wrote your report did you have any factual
knowledge about how long it took to issue TCs?
A. Rather little. My impression was --
Q. No, pause there.
A. Yes.
Q. Did you actually know any facts?
A. I didn't have any data.
Q. Thank you. Let's look at page {F/1324/9}, please. If
we look at 3.1.4, do you see what's being proposed there
is 95% of transaction corrections within four months?
A. Yes, right.
Q. Then 3.1.5, 95% of transactions within six months?
A. Let me just see the categories here. Okay.
Q. You can see?
A. Yes.
Q. So there are different timescales for different ones.
If we go over the page to page {F/1324/10}, you can see
that there are provisions there at 3.1.10 for
"Aged/large volume/value transaction corrections"?
A. Yes.
MR DE GARR ROBINSON: I don't mean to be difficult but
I don't know what this document is. Has that been
explained to the witness?
MR GREEN: Have you seen any of these before?
MR DE GARR ROBINSON: What's "these"?
MR JUSTICE FRASER: All right, let's go back to page
{F/1324/1}. I assume it is a Post Office document, is
it?
MR GREEN: It is, my Lord, yes.
MR JUSTICE FRASER: Why don't you just explain to the
witness what the document is.
MR GREEN: This is a working agreement between the financial
service centre and the network.
A. And what's the date?
Q. It is I think 10th March 2015.
A. Right, okay.
Q. If we go to page {F/1324/8}. Paragraph 3, there is
a heading "Working Agreement."
A. Yes.
Q. This reflects the working agreement between FSC and the
network and --
A. And the pages we have looked at before are after this
page, is that right?
Q. Hold on.
A. Sorry.
Q. This reflects the working agreement between FSC at
Post Office and the network, so an internal working
agreement, which was heralded by the title of the
document, the title being a working agreement --
A. Yes.
Q. -- between FSC and the network.
A. Yes.
Q. And at paragraph 3.1 it says:
"The following section sets out the standard
timescales for the issuing of transaction corrections to
branches by FSC."
A. Yes.
Q. Then if we go over the page {F/1324/9}, we see the
provisions there. My question to you was you hadn't
seen any -- you hadn't said you hadn't seen this
document and you said you didn't have any data.
A. That is right, yes.
Q. Did you know of guidance like this from any other
documents as far as you know?
A. I do not think I did, no.
Q. Thank you.
Then if we go to {C5/11/14}, please. This is part
of a request made by Mr Coyne for further information.
We are looking at paragraph 15.2. Mr Coyne asks:
"Please describe the average duration of resolution
for transaction corrections where other statistical
might not be found in relation to causes of TCs."
Yes?
A. Yes.
Q. You did not support that request, did you?
A. I didn't, no. What time was this request?
Q. This is dated -- give me one second. Mr Coyne makes
this 4 June 2018?
A. So quite early, yes.
Q. You didn't support it, did you?
A. No. TCs were --
Q. So that might have provided some data for you about that
topic?
A. I didn't feel that my supporting requests led to them
being acted on any faster, really.
Q. Is that why you didn't support so many of the requests
by Mr Coyne?
A. It was not the centre of my focus of interest at the
time.
Q. Let's look at your transaction correction calculations.
The context in which I think you consider them is Issues
5 and 15, and then you effectively then reconsider them
for the purposes of Issue 1.
A. How do I do that? I mean they do interact with
Issue 1 --
Q. And 3?
A. -- but where's the implicit linkage?
Q. Would you accept that is a fair summary?
A. Well, TCs calculation does not enter into my numerical
estimates on Issue 1, I don't think.
Q. Let's pause there. Let's have a look at Mr Coyne's --
your criticism of Mr Coyne, as it were. Let's look at
paragraph 891 at {D3/1/198}.
A. This is my chapter 9, is it?
Q. Yes, your chapter 9.
A. Which paragraph? 8?
Q. At 891.
A. Yes.
Q. So you note that:
"Mr Coyne has gone further than the above scope."
A. Yes.
Q. Because he had actually referred to the possibility of
further error in the Horizon system where
an inappropriate method of fix was selected or the
possibility of transaction corrections being issued as
a result of error, yes?
A. He had referred particularly to the possibility of
errors in the manual process involved in transaction
corrections.
Q. And that's what you felt was out of scope?
A. Yes.
Q. And you then explain at 891 that for balance, in 9.6 you
provide your own commentary without prejudice to your
understanding of the scope of Issues 5 and 15?
A. Yes, right.
Q. If we look at what Mr Coyne says in his expert report,
you refer to it -- if we go to the next page of your
expert report just for a moment {D3/1/199}, the
particular points that you have picked out at
paragraph 893 --
A. That's 3.13.
Q. -- are 3.13 and 3.28. Let's go to those. It is
{D2/1/27}. There are two separate points here. 3.13 is
the first one we are looking at now.
A. Yes.
Q. And he says:
"The reconciliation process ultimately presents the
possibility of further error within the Horizon system
whereby an inappropriate method of fix was selected,
and/or the corrective fixes may have been carried out
erroneously."
A. Mm.
Q. Now, that's not actually particularly limited or focused
on transaction corrections, is it?
A. ""The reconciliation process ultimately presents the
possibility of further error within the Horizon system
whereby an inappropriate method of fix was selected ..."
It seems to me that fix does have a bearing on
transaction corrections.
Q. Okay, that's how you understood it?
A. Yes.
Q. Then if we look at 3.28 -- sorry, can we just stay on
that page one second.
Just in terms of substance, you agree that that's
a fair comment by him, whether it is in or out?
A. Well, I have difficulty understanding the bounds of the
Horizon system there because a method of fix being
selected is a human process.
Q. Okay. Subject to that you would accept the substance of
what he is saying, subject to the bounds of the Horizon
system?
A. "... corrective fixes may have been carried out
erroneously."
Again, that seems to be a human process we are
talking about.
Q. The bounds of the Horizon system you're referring to
exclude the process of issuing TCs?
A. Well, it seems to me that this statement is referring to
some human processes.
Q. And you don't include those in the Horizon system?
A. No, not part of the system.
Q. If we look at {D2/1/30}, which is the other paragraph to
which you expressly referred, 3.28.
A. (Reads to self)
Yes.
Q. He says:
"It is also possible that transaction corrections
were issued as a result of error in Horizon transaction
data processing."
A. Yes.
Q. Just pausing there. In/out, whatever you like to do
with it, whatever its status going to the Horizon
Issues, you agree that that's possible?
A. It is possible, yes.
Q. So at least on that point there's no disagreement of any
substance?
A. No. I would obviously --
Q. Just yes or no at the moment.
A. No, there is no disagreement.
Q. And you note in your report, {D3/1/199} at
paragraph 892.3, you say there:
"Whenever the comparison revealed any discrepancy,
there appeared to be a human process of deciding where
to allocate responsibility for the discrepancy this had
to be a human process and was therefore subject to
errors."
A. Yes.
Q. So that's entirely consistent with you accepting the
point that Mr Coyne made there?
A. Yes.
Q. On any definition of what consistent means?
A. Well, I say consistent means not contradicting, yes.
Q. You are actually agreeing with him properly, aren't you,
there?
A. 3.13 or 3.28?
Q. 3.28.
A. I think I am, 3.13 I think I am, yes.
Q. And then you then devote a substantial section of your
report, section 9, to calculating your upper limit on
the magnitude of discrepancies --
A. This is 9.6 I think, yes.
Q. -- arising from erroneous TCs.
And if we go to paragraph 895 at {D3/1/199} we can
see that you have sought to calculate what in line 2 you
call there:
"... an upper limit on the magnitude of
discrepancies in claimants' accounts arising from
erroneous TCs ..."
A. Yes.
Q. You have focused on the claimants' accounts rather than
the subpostmasters generally?
A. I have adopted that scaling factor, but to my mind the
advantage of using numbers is if that scaling factor is
not the right one it is easy to convert to another
scaling factor.
Q. It is a yes or no answer --
A. Yes, I have adopted that scaling factor.
Q. And you have looked at annual volumes, distribution of
types of TC, proportions of TCs disputed and proportion
of disputes upheld?
A. Yes.
Q. That's a new exercise that you have done that Mr Coyne
hadn't done?
A. Yes.
Q. And none of the Horizon Issues particularly asked you to
do it?
A. You could say the robustness asked me to do it, because
they are a user error correction, they are a form of
robustness.
Q. But the errors in TCs, your express position is that
that's out of scope, manual errors in TCs?
A. I'm saying the causes are out of scope. There are a lot
of things where the causes are out of scope but the
robustness is how the effects are dealt with.
Q. Let's look at page {D3/1/205}, paragraph 928. You
identify in paragraph 928 a table of volume of TCs by
year?
A. Mm.
Q. Did anything odd strike you in the data when you were
eyeballing it?
A. Yes, there is a funny year where if you look at "Value
of TCs", then 2015 is rather peculiar. It jumps up
above the others.
Q. Yes, it is about five times the average of the
surrounding four years.
A. I didn't get to understand the final reason for that.
Although there was another piece of data where
a particular month they had some lumps in the number of
TCs which may be related but I never investigated that.
Q. You have no idea whether that was a catch up on lots of
old ones that had gone wrong or whether it was
a disastrous year in some respect, or there was
a specific problem or anything else, do you?
A. I don't know the causes of that lump, no.
Q. When the claimants' solicitors specifically asked
a question about the TCs in correspondence -- for
your Lordship's note {H/69/2} -- were you asked about
that?
A. No, I don't think so.
Q. And so you were relying I think on Mr Smith's evidence
as you say at paragraph 931 on {D3/1/206}, is that
right?
A. Particularly for disputed TCs I was relying on his
evidence, yes.
Q. And you were here for Mr Smith's evidence?
A. Mm.
Q. Sorry?
A. I think I was, yes.
Q. I am just checking because earlier on, on Tuesday, you
said you thought you were here for all the defendant's
evidence, and every time I put someone to you, you say
you were not here.
A. I agree that's confusing. I was certainly here for
certain key defendant witnesses, like Mr Parker and
Mr Godeseth. The others I can't be quite so sure about.
Q. Because if you rely on someone's evidence it is pretty
interesting what they say in cross-examination, isn't
it?
A. I read the transcripts if I'm not there.
Q. And you have had the transcripts --
A. Yes.
Q. -- since Tuesday to consider before you came back today?
A. Yes.
Q. Did you read the transcript of Mr Smith's evidence?
A. I believe I did, yes.
Q. And it is right that your analysis in 206 is essentially
premised on Mr Smith's evidence being accepted?
A. It is, absolutely.
Q. You in fact say that, you say:
"If this evidence is accepted it enables me to
calculate the approximate financial impact of errors in
processing TCs."
If we just look a bit further down at 934, you have
just referred again {D3/1/207} to disputed TCs and
upheld TCs in Mr Smith's witness statement?
A. I have jumped somewhere.
Q. Sorry.
MR JUSTICE FRASER: I think you need to be on {D3/1/207},
I think.
Are you going to paragraph 934?
MR GREEN: My Lord, I am.
We have just looked at some other figures from
Mr Smith, and you say:
"I proceed on the assumption that these figures,
which are the only ones available to me, are accepted by
the court."
A. Yes.
Q. Mr Smith had presented the figures for Santander in
a way that had misled both you and Mr Coyne, hadn't he?
A. That is correct, there was a change in Mr Smith's
evidence. And also I made another calculation of TCs in
my supplemental report as you are aware.
Q. Did that rock your confidence in his knowledge of the
subject matter at all?
A. If you look at my second calculation of TCs, I isolated
three principal categories, that was Camelot and remming
and Santander online banking, and Mr Smith's correction
was not about Santander online banking, it was about
Santander manual deposits.
Q. Yes, but I mean Mr Smith's Camelot figures were
specifically relied on by you, weren't they?
A. Camelot figures, yes.
Q. And I think we see that at paragraph 936 and footnote 29
on page 207.
A. Yes. And I think in my subsequent calculation, when
I had the three columns for the different kinds, Camelot
TCs were not a large contribution to the ultimate
result.
Q. Let's have a look at that, paragraph 49. The figures
that Mr Smith gave --
MR JUSTICE FRASER: Where are we?
MR GREEN: I'm so sorry, paragraph 20 of Mr Smith's witness
statement which is {E2/9/5}. Do you see paragraph 20
there?
A. Yes. I remember those figures, yes.
Q. There actually weren't any figures for Bank of Ireland
retracts and lottery for the number of TCs disputed or
compensating TCs, so they had been estimated?
A. They are estimated figures, yes.
Q. Did you pick up the fact that they had been estimated
when you were relying on his evidence in your first
report?
A. Well, I'm always conscious of the limitations of
evidence and this introducing of uncertainty, that's
a further dimension of uncertainty in the analysis.
Q. But you had assumed they had been estimated based on
some sort of knowledge?
A. I assumed if somebody made an estimate it was a sensible
estimate, yes.
Q. But based on some facts or knowledge that they had?
A. Yes.
Q. And in his cross-examination, if we go to that,
{Day6/186:19}, starting at line 19. It is page 186 at
line 19.
A. I'm not there yet.
Q. Don't worry, it will come up in a moment.
A. Okay.
"Question: ... under 'BOI retracts' and 'Lottery'
the number of TCs issued for those two is very different
..."
Right.
"Question: But the number of disputed TCs
apparently is estimated to be the same?
"Answer: It appears so, yes."
Right.
Q. You see:
"Question: And the number ... is ... estimated to
be identical?
"Answer: It appears so, yes.
"Question: Do you have any feel at all from your
own knowledge as to whether those figures are even
remotely reliable?"
A. Well, my own knowledge --
Q. No, I'm just asking you to look at the transcript for
the moment. I'm just reading out the question I said to
Mr Smith. Do you see line 4 on page 187?
A. I don't have feel for my own knowledge --
Q. No, I'm not asking you the question --
A. I thought that's what you were asking me.
Q. No. Could you please just look at the transcript and
then I'll ask a question in a minute. It's my fault for
not making it clear.
MR JUSTICE FRASER: I think what Mr Green is doing is he is
just going to read out some questions and answers from
Mr Smith and then he is going to put a question to you.
A. Right, okay.
MR JUSTICE FRASER: Mr Green.
MR GREEN: I'm most grateful.
If you look at line 4 on {Day6/187:4}, and he says:
"Answer: The number of issued TCs I would suggest
are very accurate. The number of TCs disputed is not
something that I can comment on at this stage. I do
know that prior to having our case management system in
there was no consistent method of recording the method
of disputes."
A. Yes.
Q. So on that footing the figures that you were looking at
and the person giving them doesn't seem to have been
hugely well placed to give reliable figures, does he?
A. No.
Q. Now if we look at TCs of different types on page 207 of
your first report {D3/1/207}, at paragraph 938, bottom
of the page, you refer to a TC summary --
A. Yes.
Q. -- from a TC reporting pack from November 2012. If we
look at the following page {D3/1/208} you will see table
9.3.
A. Yes.
Q. "Volume of TCs by origin".
A. Yes.
Q. For 2011/2012. Do you see that?
A. Yes.
Q. If we look at the source document from which you have
taken that, could we please open {F/987/1}. It is
an Excel spreadsheet.
Do you remember you got that from an Excel
spreadsheet, Dr Worden?
A. Yes, plenty of tabs I remember.
Q. That is right. We are going to look at a tab called
"Summary by period" when that comes up. It is
{F/987/1}.
We can't see it now, but presumably you looked
carefully at the data on the Excel spreadsheet?
A. I poked around that spreadsheet a bit.
Q. You poked around a bit?
A. Yes.
Q. There are quite a few tabs so it is important to see
what you are dealing with.
MR JUSTICE FRASER: Pause for one second. We are still
waiting for F/987.
MR GREEN: We are.
MR JUSTICE FRASER: Which I imagine is quite a big
spreadsheet which is why it's taking a while to load.
I can see it there but it has not gone on the common
screen yet. Is that F/987? Here we go. (Pause)
MR GREEN: Shall I just ask you, Dr Worden, while we are
waiting for that, I will just take you to a different
paragraph, if I may.
A. Yes.
Q. If we look at paragraph 942.
A. Yes.
Q. On page {D3/1/209}.
A. I will try my paper copy, I think.
MR JUSTICE FRASER: If we do that, we are moving away from
the spreadsheet, is that right?
MR GREEN: My Lord, I will come back to that spreadsheet.
MR JUSTICE FRASER: Maybe at 1.55 pm ask for it to be loaded
up and it will be there at 2 o'clock.
MR GREEN: I'm most grateful.
If we look at paragraph 942, you proceed on various
assumptions to reach a calculation that:
"If there were 2% of TCs issued in error, which were
resolved incorrectly against the branch, the net effect
on branch accounts would be £6 per branch per month."
A. Yes.
Q. "As described above, in my opinion this is a
conservative upper limit on the magnitude inaccuracies
introduced into branch accounts - which could be of
either sign."
A. Yes.
Q. We go down. 943, you have got your assumption that
branches are affected equally, yes? Which takes us back
to our Penny Black example which we won't revisit.
And then at 944 we have got:
"This figure is to be compared with the mean
shortfall per month claimed by the claimants - which, as
I described in section 8 ..."
Then you say:
"A maximum of £2 per month from erroneous TCs is
less than 1% of this amount."
A. Yes, that's just arithmetic.
Q. Yes? So in fairness to you, Dr Worden, you later in
your second report revise the figure from £2 per month
to 1.50 per month?
A. Yes, there is a complete new calculation in the second
report.
Q. And that change of 50p was significant for your
calculations on an engineering approach?
A. Well, I think I summarised in the second report it was
£2 again. I can't recall exactly whether I presented it
as £2 or 1.50. But my belief is that figures in that
range are interesting to the court, whether it is £2, £3
or whatever, so I didn't feel the need for high
precision in that figure. But I think I summarised it
somewhere in my supplemental report as £2 in spite of
the fact the arithmetic had come a bit lower. I can't
recall.
Q. And the effect of the figures that you put forward is,
you say, to show that the probability of a claim by
a claimant being correct is extraordinarily low?
A. I was just converting from this average of £2 a month to
what it would look like if the £2 came in lumps. If the
£2 came in thousand pound lumps then that would
obviously have to happen one every 500 months to create
the right average. So I was doing the arithmetic of
probabilities.
Q. Yes, but my question to you is that the effect of what
you were doing was to show, on your approach, that the
chances of a claim being made by a claimant that they'd
lost £200 in one month due to errors in TCs, in the
absence of further evidence the probability of that
being correct was about 1%?
A. Yes.
Q. So very unlikely?
A. That is the arithmetic, yes.
Q. And that's the effect of what you were showing there?
A. Yes.
Q. And you weren't asked in any of the Horizon Issues by
the court to give your view of the likelihood of
a claimant being right about a claim for £200 being lost
from an erroneous TC, were you?
A. No, but I was asked about discrepancies of various kinds
and I felt, rightly or wrongly, that this was a useful
way to present the figures.
Q. Okay. In fairness to you, let's show you your second
report at paragraph 32. It is on {D3/7/98}. If we look
at paragraph 32 on that page and there you say that your
revised figure is £1.50 per months rather than £2 per
month?
A. Yes.
Q. And you say at the end of that paragraph:
"So in my opinion, errors in TCs cannot account for
even a small part of the claimed shortfalls."
A. Yes.
Q. So it is not just the effect of the calculation, it is
what you reach a conclusion on?
A. Yes.
Q. So can we just do another statistical analysis. Let's
look at a worked example of Mr Abdulla's case. Have you
seen information about his case?
A. I have. I'd need to recollect it.
Q. Let me -- assume I'm guiding you correctly about the
facts.
A. I am sure you are.
Q. Your average for TCs per branch per month is £1.50.
A. Mm.
Q. And you say that when your average per branch per month
was £2 the chance of a £200 erroneous TC is 1%?
A. Yes.
Q. And so when the average per branch is £1.50 the chance
of a £200 erroneous TC in month is 0.75%, isn't it?
A. That is right.
Q. You also assumed that the likelihood of TCs -- erroneous
TCs hitting a branch were equal across the board?
A. Per volume of transactions, yes.
Q. Per volume of transactions. And so the chances of
an erroneous TC of £1,000 would be what, roughly?
A. We started with £200 so it is five times lower.
Q. So if we divide 0.75% by 5, the chances of one erroneous
TC of £1,092, will you take it from me, is 0.14%?
A. That feels about right.
Q. Feels about right?
A. Yes.
MR JUSTICE FRASER: To two decimal places.
MR GREEN: Thank you. What is the chances of that happening
in two months in a row, Dr Worden, on your analysis?
A. Let me consider this carefully. If you believe the two
months are independent statistically then clearly the
probability is multiplied, but there may be correlation
factors, who knows?
Q. Yes, and there are two points there. Let's leave
correlation factors aside for a moment. If there were
no correlation factors, yes?
A. Yes.
Q. Or other factors, and they were independent variables?
A. Yes.
Q. The answer is 0.14% x 0.14%.
A. Yes.
Q. So about a seventh or something of a percent of
a seventh of a percent?
A. Well, what is it? It is 1 part -- I mean 0.14% is 1
part in -- sorry --
Q. It is 1.5 parts in a thousand, isn't it, roughly?
A. So the square of that is 2 parts in 1 million, I think.
Q. So that is the chances of two erroneous TCs --
A. In two identified consecutive months, say.
Q. Two identified consecutive months?
A. Yes, or non-consecutive months. I would be more
confident about con-consecutive months because I think
consecutive months might have correlations.
Q. And you have not factored in the possibility of
correlations or indeed concentrations of TCs or any
factors of those sort in your calculations, have you?
A. I haven't, I do not think, gone on to calculate these
commentorial things about N months at a time. I could
have spent a lot of time going about distributions of
three months here and so on. I didn't go into that,
I just went into that one result.
Q. Do you accept that looking at what appears actually to
have happened is quite a good way of testing
a theoretical model that you constructed?
A. Well, the theoretical model -- the conclusion is in the
absence of other information, and then when we have
other information we have to consider how that other
information meshes with our original model and so that's
complicated.
Q. So is it fair to assume that in fact the extent to which
the reality presented by the claimants departs from your
theoretical model is likely to be explained by
information you have not considered?
A. Well, when we get to individual claimants, as doubtless
we will in future trials, we will consider all that and
we will: think what are the circumstances and how does
that alter the basic model and so on? We will do that
calculation, presumably, but that was not my purpose in
this report.
Q. You accept that your theoretical model is not an obvious
fit with the facts of Mr Abdulla's case if indeed he did
receive two erroneous TCs running?
A. I have not compared my model with Mr Abdulla's case.
Q. I know you haven't, that's why I'm asking you to do it
now?
A. I can't do it now. I don't know enough about
Mr Abdulla's case.
Q. Well, on the theoretical basis you agree that what we
see in Mr Abdulla's case does not fit at all with your
predictions in general so that you would look for some
explaining factor?
A. I haven't done the analysis of Mr Abdulla's case
compared with my general model. If I did, I'm not sure
what I would conclude.
Q. But if we just read your report, the chance of
Mr Abdulla being right about even one erroneous TC
having been issued is vanishingly small?
A. No, because he was in -- I mean the sort of factor one
has to consider is how many months the claimant was in
post, for instance. And as I say, comparing the general
model with a claimant is a complicated exercise which
I haven't -- and I hesitate to jump in there now.
Q. But you have said at paragraph 32, you have reached
a conclusion that errors in TCs cannot account for even
a small part of the claimed shortfalls?
A. That's about the claimants as a population.
Q. But you have done that without the sort of facts that
you are now wishing to consider in Mr Abdulla's case?
A. I have not considered the claimants as individuals, and
when we get round to that it will be a whole new set of
considerations.
Q. I suggest to you, Dr Worden, that the assumptions that
you have made, including the even incidence of TCs
across the subpostmaster population based on
transactions, is a false premise to arrive at a reliable
analysis of the type which you have done?
A. I don't agree with that. I would like to know why you
say that.
Q. We gave the Penny Black example on Tuesday, didn't we?
A. We did indeed, we went into that.
Q. And someone I think tweeting about the case suggested
a different example which was very similar?
A. I haven't read the tweets, I'm afraid.
Q. Let me suggest it to you and see if you accept this one:
based on lottery winners, a very small chance of winning
the lottery, you walk into a room and everyone in the
room says to you, "Oh yes, I won the lottery", "I won
the lottery", "I won the lottery", and that seems very
unlikely, doesn't it, until you see the sign on the door
that says "Lottery Winners' Reception".
A. In the Penny Black example and in the example that you
have just given me we are going into the issue of
supplemental information and how that alters your
conclusions based on a base model. We are also going
into complicated statistical issues about selected
populations. We are going towards advanced statistics.
Q. That's what you are an expert in.
A. I was very careful in my reports not to use advanced
statistics. I was trying to keep it at undergraduate
level, if you like. So I'm quite happy to answer
questions about advanced statistics but in doing so
I shall be very careful and I need to know the question
very clearly.
Q. I'm going to put a point to you that I'd be happy to put
to my 13-year-old daughter, which is that when you look
at a statistical sample the first thing you should do is
look at the nature of the sample and how they were
selected?
A. Yes.
Q. And that is what the Penny Black and lottery examples
are about, isn't it?
A. Well, the Penny Black example led to a conclusion which
in my cross-examination I queried on one ground, and the
one ground was that it seemed to me that to follow your
argument I would have to base my analysis on the
assumption that the claimants were right, and that
seemed to me strange and not a thing I could do as
an expert. But since then I have thought more about it
and there's another much stronger reason for not taking
that example, and the point you were putting to me was
that the claimants were a self selected population and
you need to deal with them differently, and that is
an advanced statistical point. But why it is not
relevant to my analysis is that the claimants are
a self-selected sample and they selected themselves long
after they suffered their shortfalls.
So the point you are putting to me effectively is
these people selected themselves and that somehow caused
Horizon several years previously to rain bugs on them.
And so the causation is completely the wrong way round
between Horizon affecting the claimants and the
claimants self-selecting. It doesn't make sense.
Q. But, Dr Worden, I'm going to put to you that that is
a comical explanation.
A. It is not comical at all. It is commonsense that
causation can't go backwards in time.
Q. No one is suggesting that causation goes backwards in
time.
A. Well, I think that's the suggestion that was explicit in
your Penny Black --
Q. I will clarify it to you. The Post Office's case is
that large numbers of subpostmasters are perfectly happy
with the Horizon system and do not feel they have
suffered from unjustified shortfalls.
A. Yes.
Q. But others do feel they have.
A. Yes.
Q. How many of the former group do you think you would
expect to join a group action complaining about
something they haven't suffered?
A. I don't know the answer to that question but I would not
expect many.
Q. No. Zero or close to zero?
A. Yes.
Q. If you were aggrieved because you believed that you had
in fact suffered in that way and you were afforded the
opportunity of redress, do you think the fact that you
believe you have suffered in that way is a material
factor in your decision whether to join the group action
or not?
A. It is a material factor, and it is not a material factor
in whether Horizon during your tenure caused bugs to
you.
Q. But Dr Worden, just because you join doesn't mean that
we go back to the future with the professor in the
DeLorean and Horizon causes problems in the past?
A. Exactly. That is precisely what I'm saying.
Q. But you do recognise, don't you, that you accepted that
identifying how a sample has been selected is important.
Take it in stages. You accepted that?
A. I accepted that and --
Q. And the importance of the sample in this case is you are
capturing what Post Office themselves call a small
minority of people who, whether they are right or wrong,
are all people who feel strongly enough to join the
group action that they have suffered these shortfalls?
A. Yes. They have self-selected.
Q. Yes. So there is a factor which applies to them which
does not apply to people, the vast majority --
A. But that factor did not apply when they were suffering
from shortfalls.
Q. You genuinely can't see, are you saying, the relevance
of the sample you're dealing with --
A. I'm saying the causation is back to front, and causation
is what's at issue here.
MR JUSTICE FRASER: All right. I'm going to bring this
sequence of cross-examination to an end, Mr Green.
I think it has probably gone on long enough.
MR GREEN: I understand. My Lord, may I just put what
techniques the expert said he had in fact applied in
that?
MR JUSTICE FRASER: Yes.
MR GREEN: Can we look please to {Day18/10:6}. You were
asked about having your CV and you have given evidence
in software development methods and advanced statistical
techniques. You said yes.
You were then asked at line 13:
"Question: The phrase 'advanced statistical
techniques' reflects the application of the expertise
that you have just been talking about?
"Answer: Absolutely. I believe that the statistics
I have applied as a scientist particularly but also as
an engineer goes to the point of advanced statistical
techniques."
A. Yes.
Q. Do you now say that you have not applied advanced
statistical techniques in the approach in your reports?
A. What I say is I was encouraged and I took the advice
that the techniques I have applied in my reports are
elementary statistical techniques.
Q. Who encouraged you to do that?
A. The Post Office lawyers were telling me to keep it
simple, basically, and I was encouraged -- and I felt my
duty was to provide explanations to the court which the
court could readily understand, so I did not want to go
into advanced statistics for that purpose.
Q. A final question on this, Dr Worden, and then we will
move on. Did you come up with the idea of an even
distribution across all claimants or did somebody else?
A. I did.
Q. Can we move forward, please, to Issue 4, for which we
will go back to {C1/1/1}, please.
You can see Issue 4:
"Controls and measures for preventing/fixing bugs
and developing the system."
A. Mm.
Q. That's the general heading, and then the specific
question at question (4) is:
"To what extent has there been potential for errors
in data recorded within Horizon to arise in (a) data
entry, (b) transfer or (c) processing of data in
Horizon?"
I want to ask you about (a), data entry first,
please. Data entry clearly includes the potential for
mis-keying, doesn't it?
A. It does.
Q. And at {D3/1/63} you say there -- you refer to -- at
paragraph 222, under the heading at 6.1.1 "Detection of
User Errors" or DUE, you say:
"In the design of the Horizon counter user
interface, there are large numbers of measures to
prevent user errors."
A. Yes.
Q. "Many of these measures have by now become common
practice in the design of user interfaces - such as the
use of menus and buttons, rather than free text input
..."
A. I was there referring to a common practice rather than
specifically Horizon, I guess. Horizon has plenty of
buttons, not so many menus.
Q. So having a screen with a first class stamp button on it
is one of the factors that you think is helpful?
A. For instance, yes.
Q. As an example.
A. Yes.
Q. And you haven't actually had any regard to the specific
layout of the individual screens, have you?
A. I haven't tried to redesign screens myself or to
consider how they might have been better. I think that
is a very dangerous exercise for an IT engineer to do
actually.
Q. Because it is not your field of expertise?
A. Well, I have run a field of -- a team of user interface
experts and we did user interface design for things like
air traffic control, and the one thing that I learnt is
the designer's prejudices about what is a good user
interface or not are not to be trusted, and one thing
you have to do is user trials to find out what works.
Q. Yes. And that is a very important part of having
a robust system?
A. Yes, user interfaces should be tried out and evaluated.
Q. Yes. And if you get it wrong that increases the
potential for mis-key errors, doesn't it?
A. It would do, yes.
Q. At paragraph 224 {D3/1/64}, you say:
"The Claimants have drawn attention to the user
error of 'mis-keying', to the question of how well
Horizon prevented mis-keying, and whether Horizon might
have prevented it more effectively."
Yes? And at paragraph 226 you refer to the
Mis-Keyed Project Feasibility Study, 2012?
A. Right.
Q. Which you deal with in appendix C1.
A. Yes. I haven't read that lately, I'm sorry.
Q. If we look at {D3/2/40} and we look at paragraph 131,
there you say:
"The Post Office internal feasibility study makes it
clear that Post Office were concerned at the costs
incurred as a result of mis-keying."
Yes?
A. Yes.
Q. You say:
"However, the background section of the report makes
it clear that the costs of concern were Post Office's
central costs, and were not costs or discrepancies in
accounts in the branches."
A. Yes.
Q. Did you actually read that document or did someone else
write that for you?
A. I read it and wrote it.
Q. So you read that. You read the document, the background
document, and you wrote this that we just --
A. Yes. My strong impression from the background document,
reading the whole of it, was that the emphasis was
central costs in Post Office.
Q. And you feel you read that document with the same care
that you read other documents you read in the case?
A. I think so, yes. I mean --
Q. Let's look at it {F/932/1}. Let's look at the front of
it first. "Mis-Keyed Project Feasibility Study", this
is the one.
A. Okay.
Q. And we will find the background section to which you
referred on page 4 {F/932/4}. Let's look at the first
paragraph of the background section to which you have in
fact expressly referred. It says:
"As part of the P&BA centre of excellence drive, one
of the areas of concern is the number of instances of
mis-keyed transactions that occur and much to the
detriment of P&BA. A mis-keyed transaction occurs when
an incorrect value is input by the counter clerk, which
causes a poor customer experience."
Then this:
"The mistake can have a significant impact on the
branch and resource is required in P&BA to manage the
client and address the error. A very large value
mis-keyed transaction will put the viability of a branch
in doubt."
A. Mm.
Q. Why did you not mention that impact in your summary of
the background?
A. The last sentence I agree I did not -- it didn't
register with me, but it seemed to me that poor customer
experience and impact on the branch, and it seemed to me
that basically mis-keying can lead to errors and it
leads to costs having to correct those errors, and
certainly large impacts in my opinion are very likely to
be corrected.
Q. Taking your evidence on its face first, the passage that
you have referred to absolutely does identify that costs
and discrepancies in branch accounts were of concern.
A. It says "impact" on the branch. And it does -- I agree
with you the last sentence does say that it has impact
on the branch, but the general tenor of the document
seems to me that it is saying, look, this stuff occurs,
we can correct it, but it is costing us money to correct
it --
Q. Are you being scrupulously fair in your answers,
Dr Worden, on that point?
A. I agree with you that that last sentence of that
paragraph I had not paid attention to in my summary.
Q. I'm going to suggest to you that that is not
a scrupulously fair answer. Do you agree?
A. I think I have answered your question fairly.
Q. Is it scrupulously fair?
A. Scrupulously fair? I'm trying to be as fair as I can,
certainly.
Q. Are you? Can I suggest you might wish to try harder
when we look back at what it actually says in the first
paragraph.
Come four lines down. If you look -- if you come
four lines down, about two inches in from the left-hand
side margin:
"The mistake can have a significant impact on the
branch."
A. Sorry, where are we?
Q. Four lines down.
A. "... impact on the branch ..."
Yes, that --
Q. No, no. Do you see?
A. Yes, I have got that sentence.
Q. You have got the sentence that says:
"The mistake can have a significant impact on the
branch ..."
A. Yes.
Q. And you were trying to limit your agreement in answer to
my questions only to the last sentence which says:
"A very large value mis-keyed transactions ..."
A. Yes, but that sentence which you quoted to me goes on to
say:
"... resource is required in P&BA to manage the
client and address the error."
So the impact on the branch in that sentence is not
assumed to be but is implied to be a temporary impact
because it gets corrected.
Q. It does not say correct the error necessarily, does it?
A. "Address the error", I mean obviously addressing is
trying to correct.
Q. The other point you have not mentioned in this document
is recommendations on the document weren't in fact acted
on, were they?
A. I didn't follow through, no.
Q. Did you know that Post Office had not acted on the
recommendations in this document when you wrote your
reports, either of them?
A. I cannot recollect exactly what I knew or did not know,
but I have not paid attention to whether the Post Office
actually acted on the recommendations because, as I say,
user interface issues are very complicated and
I hesitate to be an armchair critic, if you like, of
somebody's user interface design and what steps they
took to improve it. That is a complicated issue when
you look at -- say somebody said "We can improve the
design. What do we do about it? Let's run some
trials". And what's the virtue of changing the design
versus the virtue of keeping it stable? For all those
postmasters who are using it perfectly correctly, you
want to keep user interface stable over the years. So
there are those trade-offs, all of which I haven't
looked at.
Q. Last question. Despite having done a lot of work on
user interfaces, you didn't actually try to analyse how
user friendly or prone to mis-keying the interfaces
were, did you?
A. I felt it was a difficult thing to do precisely for the
reason I have said --
Q. Yes or no?
A. No, I did not.
MR GREEN: Thank you very much.
Is that a convenient moment, my Lord?
MR JUSTICE FRASER: I think it is. This doesn't affect you,
Dr Worden. But if you want to go back to that
spreadsheet, I suggest one of your colleagues or you
maybe -- I would say based on my experience of the
bigger documents when I access them from my desk, five
minutes is probably ...
Thank you, 2 o'clock.
(1.00 pm)
(The short adjournment)
(2.00 pm)
MR GREEN: Dr Worden, at 2 minutes past 1 today we received
a big spreadsheet about ARQ requests in 2013. Is the
number of ARQ requests something that you know much
about?
A. No.
Q. Okay, I will leave that.
MR JUSTICE FRASER: Did that come with a covering letter, by
any chance?
MR GREEN: I think there may be one, my Lord.
MR JUSTICE FRASER: All right. Let's move on.
MR GREEN: I'm most grateful.
Picking up where we left off before lunch. Can
I ask you please to look at {F/1848.8/1}.
A. This is the big spreadsheet, is it?
Q. Yes, it is the big spreadsheet. This seems relatively
old in the sense it was disclosed on 31st May of this
year, but it is a draft input and information -- it is
"Draft Input & Information Provided to Support the
Post Office Internal Process" -- sorry, this is the
wrong one. Sorry. Can we get 1848.8.1, please? We
will come back to the table in a minute. We are after
{F/1848.8.1/1}, please.
MR JUSTICE FRASER: Are you looking at the common screen?
MR GREEN: Yes.
MR JUSTICE FRASER: Is that not what you were expecting?
MR GREEN: No. My Lord, it is a normal document.
{F/1848.8.1/1}. That's very kind, thank you.
Now, you see this is a -- this document is headed
"Draft Input & Information Provided to Support
Post Office Internal Process".
A. Yes.
Q. Now, this is a document relating to an incident on
4th March 2019.
A. Right.
Q. So it is a recent matter in that sense.
A. Yes.
Q. And if we look at page {F/1848.8.1/2} and we look at the
box that says "What's the issue?", do you see that?
A. Right, okay.
Q. Just pause. Have you seen this document before or not?
A. I think there is something familiar about it actually.
I remember being puzzled about the phrase
pre-announcement interface and I'm still puzzled about
it.
Q. Okay. Let's just see what we can understand about it:
On 4th March an incident was raised that there were
failures in the pre-announcement interface to Horizon.
"The result of this was that branches had to
manually key the value of pouches received into Horizon
on receipt, rather than scanning a barcode for automatic
population of data including the value."
A. Yes.
Q. "This led to some manual keying errors where the wrong
value was keyed into Horizon."
A. Yes. So pre-announcements are something to do with
remming cash.
Q. Let's not focus too much on pre-announcement, let's look
at what the problem is, if we may?
A. Sure.
Q. Let's take that bit in stages. The advantage of having
a scanner and a barcode is that if the system is working
correctly it will correctly rem in that patch?
A. Yes.
Q. So in a sense, that is a desirable aspect of a system in
general?
A. Yes.
Q. And that wasn't working, we can see?
A. As a result of the pre-announcement failure, yes.
That's interesting.
Q. So the branches had to manually key the value of the
pouches received into Horizon on receipt?
A. Yes. So they had to count the cash, it feels like --
Q. No, they had to key in the value.
A. So there is a label which says --
Q. Yes. Okay? This led to some manual keying errors where
the wrong value was keyed into Horizon.
Then if you look in the "Impact", it says:
"Branch: some manual keying errors resulting in
overstated sterling or foreign currency positions."
Yes?
A. Yes.
Q. You see there is no number of branches identified there,
next to that?
A. That is right, yes.
Q. And under "Impact" you see in brackets:
"Include number of branches impacted and the detail
of the impact."
A. Yes.
Q. And the financial accounting impact is:
"Holdings at branches needed to be corrected."
A. Yes.
Q. So at this stage what is showing on the face of the
Horizon system is wrong as a result of what has
happened?
A. Yes.
Q. And it says:
"Some manual keying errors ..."
Yes?
A. Yes.
Q. Resulted -- as a result the wrong value was keyed in,
yes?
A. Yes.
Q. Just pausing there. Would you regard that happening as
a problem with the system or would that be the
subpostmaster to blame? From your perspective as
an expert looking at the reliability of the system?
A. Well, obviously failures in pre-announcement is some
sort of failure in the system which causes a higher
propensity to keying errors.
Q. Yes. And it looks from that at least that the keying
errors might be those of the SPMs?
A. Yes, it sounds like it.
Q. If we look at page {F/1848.8.1/3} and we go down to the
entry on 8th February:
"This communication to all branches had already been
sent based on a previous incident, reminding them not to
enter decimal places and to take extra care when
entering remittances manually."
A. Yes.
Q. What they say there is:
"When entering a sterling (notes/coin) or foreign
currency Remittance manually onto Horizon NEVER enter
the value by including a decimal point followed by two
zeros."
A. Yes.
Q. That's quite a common way of putting numbers into
systems, isn't it?
A. I must admit it looks strange to me, because I think
somewhere else in this document you get quite a big
error if you put the decimal points in.
Q. Let's look at that. You are obviously familiar with the
document?
A. I have seen the document before, yes.
Q. So taking it in stages, if we may. From a design
perspective if you want to avoid errors of this type,
that set up is not really as you would have designed it
Dr Worden yourself, is it?
A. As I say, I'm very afraid of taking a user interface
decision myself, but it does seem strange to me, yes.
Q. It is bizarre, isn't it, actually?
A. I don't know. There must have been some reason for not
entering decimal points. I don't know what the reason
might be.
Q. Let's have a look. What he says is:
"Doing so will result in incorrect totals being
entered ..."
MR JUSTICE FRASER: Where are you?
MR GREEN: This is at the bottom of that box, do you see?
On page 3.
A. Which box?
MR JUSTICE FRASER: 8th February 2019.
A. Ah yes, sorry.
Q. Sorry, it's slightly --
A. "Doing so will result in incorrect totals being entered
... extra care ..."
Yes.
Q. Do you see:
"Doing so will result in incorrect totals being
entered. Please take extra care when entering
remittances in manually."
Yes?
A. Yes.
Q. If we go over the page, please {F/1848.8.1/4}, you can
see the 5 March. Do you see that?
A. Yes.
Q. "This communication to all branches was sent following
the new pre-announcement interface issue:
"We have seen a higher than normal number of
incidents where Foreign Currency remittances did not
auto populate which required branches to manually key
the amount into Horizon. As a consequence of this we
have become aware of some branches mis-keying either the
wrong currencies and/or amounts into Horizon which will
result in a mis-balance in branch at declaration stage.
This will also mean that your automated currency
replenishments will be affected."
And so forth.
At the bottom it says:
"A general remainder for all branches to take extra
care if they are required to manually enter remittance
values into Horizon."
Do you see that?
A. Sorry, I'm just reading the bullets in between.
Q. Please do.
A. Right, okay.
Q. Now there's no hint there that the problem is about the
missing decimal point, is there, on the 5th?
A. This announcement to the branches doesn't seem to
mention the decimal point issue explicitly, I agree with
that.
Q. If we look, please, over the page {F/1848.8.1/5}, we
have got on -- sorry, can we just go back.
{F/1848.8.1/4}
When it printed out, my Lord, ours looks different.
Just give me one second.
If you look on 4th March at the bottom of that page,
do you see:
"Formal incident ... raised during back office
transformation early life support and issued to
Fujitsu."
Yes?
"Status Update"?
A. Yes.
Q. Then if we go forward, please, a page {F/1848.8.1/5},
you will see there that there is -- if we look at
6th March 2019, if you look down you will see -- they
are not in order, but there is a second 6th March 2019
saying:
"Report showing list of failed pre-announcements
requested --"
A. Oh, yes. It messes the order around.
MR JUSTICE FRASER: Sorry, where are you reading?
A. After the 7th it goes back to the 6th again.
MR GREEN: Yes. Do you see that?
A. "... list of failed pre-announcements requested, to be
cross checked against branch rem-ins."
Q. Yes. If we go over the page {F/1848.8.1/6}, we can see
what the errors actually look at -- look like from
branches that have reported a keying error?
A. Yes. And the interesting thing here is some of them are
a factor of 100 and some of them are a factor of 10,
I think.
Q. Which one is a factor of 10?
A. 3,500 booked as 35,000.
Q. So there appears to be one that looks as though it might
be a factor of 10, but all the others are a factor of
100 --
A. -- I haven't checked it out but there's both there, yes.
Q. So it looks like, for the most part, entering in
10,000.00 euros gives you a mis-keying error by entering
instead 1,000,000 euros?
A. You usually get a factor of 100.
MR JUSTICE FRASER: There are at least two that are a factor
of 10, I think. Meliden Road and New Quay.
Q. But for the most part it looks like they are mostly
multiplied by 100?
A. Yes. And I suppose the factor 10 could be where they
have entered one decimal point.
Q. It might be. That is not an ideal design, is it?
A. It doesn't seem good to me. The only remark I would
make is this was something that was not part of the
mainstream design. The mainstream design was do the
barcode.
Q. Understood. But the barcode failed, and as a result the
system was designed in such a way that if people entered
in what's a perfectly reasonable approach to entering in
a number, they risked a multiplication of the sum by 10
or 100.
A. I agree, this feels strange to me. But I hesitate to do
armchair design of user interfaces.
Q. But I'm not talking about armchair design of user
interface, I'm saying if their report of how the system
reacts is right, that is going to enter into the system
an incorrect figure --
A. Yes, yes.
Q. -- and the figure on the system will be wrong?
A. Yes.
Q. And it will then have to be corrected by a transaction
correction?
A. Well, there's two safety nets here. There's TCs, if it
is discovered centrally, and there's also the daily cash
count which would also pick it up.
Q. I'm not talking about discovery, I'm saying it has to be
corrected by a TC. That's what they say in --
A. Not necessarily -- oh, yes, I think if you are doing
a cash count and you see a discrepancy, you don't -- do
you correct it at the time? I'm not sure. But the
postmaster would see a discrepancy in his daily cash
count.
Q. If you can't reverse a rem in and there is an error, if
you take it from me, on the premise that you can't
reverse a rem in, if that is right --
A. Well, on Dalmellington they did reverse rems.
Q. Let's take it in stages. If you can't reverse a rem
in --
A. If you can't.
Q. -- it has to be corrected by a transaction correction?
A. And you may well ask for one, you say.
Q. If you can, there is an opportunity if you spot it
potentially for the subpostmaster to do it?
A. Yes.
Q. What we know here is that the subpostmaster reported
a keying error, and we can see in this document that, if
we look back at page {F/1848.8.1/2}, in
"Financial/Accounting Impact":
"... needed to be corrected."
Do you see that?
A. Yes.
Q. And if we go forward one page to 27 February,
{F/1848.8.1/3}.
A. I have the 28th.
Q. There we are. Do you see on 27 February:
"Branches who called the to report the issue were
advised to declare the correct cash on hand at branch.
Branches who have made keying errors will receive
transaction corrections processed by the FSC."
A. Yes.
Q. So it is right, isn't it, Dr Worden, that first of all
what we have there is a defect in the system in that the
scanner remming in didn't work?
A. The announcements somehow caused that, yes.
Q. But we had a defect, yes?
A. It does seem to be.
Q. And that caused subpostmasters to have to manually enter
in the figures?
A. Yes.
Q. And do you accept that having that decimal point problem
is also a defect in the system?
A. As I say, it seems a strange user interface to me.
Q. Yes. But come on, it is a defect?
A. It is not good.
Q. It is a defect?
A. I hesitate to say it is wrong. It probably is wrong.
Q. Thank you.
If we can finally look at what I have got as page
{F/1848.8.1/5}, it is 7 March 2019. Let's go back to
that, please.
We looked at this. If you look at the bottom
populated row, 7/3/19.
A. Yes.
Q. "Issue discussed at BOT Steerco. Action logged to follow
up with Fujitsu requested to confirm process and
controls in place to ensure that this is proactively
managed in the future."
That doesn't suggest necessarily a fix, does it?
A. I would have to read the whole thing. And I agree that
if the coder -- supposing there was some error in code,
supposing pre-announcement failure was an error in code
somewhere, which I don't know, and supposing that had
been fixed, then this last comment is -- I would have to
take time to try and understand what that meant.
Q. In your experience of systems of this sort, when we
looked at the communication to the branches, which
didn't actually spell out the decimal point problem
immediately afterwards, is that how you have seen people
generally communicate with their users in the past?
A. Well, I think earlier in here we saw some say -- some
statement that says you must advise the branches not to
do the decimal point. Then we saw another announcement
which didn't refer to the decimal point. And again
I would like to untangle what those two mean together.
Q. Dr Worden, the short point is this: the earlier one
referred to in the 8th February 2019 specifically says:
"... NEVER enter the value by including a decimal
point followed by two zeros."
A. Can we go back to that and see what the status of that
sentence is?
Q. By all means. It is on page {F/1848.8.1/3}, I hope. Do
you see the guidance to the word "never" in capitals?
A. So some communication to branches had been sent on
a previous incident, and that's what's said about the
decimal point, but on this one they didn't for some
reason.
Q. Yes. So we can see what was said on the previous
incident, highlighting the problem and telling people to
avoid a decimal point, yes?
A. Yes.
Q. After the problem actually causing some quite big
discrepancies, the communication that they actually send
out on 5 March, on the next page --
A. Sorry, can we go back. I was just reading that page.
Q. I think we have done 8th February.
A. I'm reading the 18th now.
Yes. Okay, thank you.
Q. {F/1848.8.1/4}. So the 18th February one doesn't say
anything about the decimal point?
A. No, but I think what we seem to have is the 8th February
says don't do this, and the 18th February says if you
have done this and there is a problem, do this.
Q. Well, what it doesn't say is that the problem is
actually -- I mean, if you look at the way it is phrased
in the second line, it says:
"As a consequence of this we have become aware of
some branches mis-keying ..."
A. I'm on the wrong page.
Q. Sorry, go up, please. {F/1848.8.1/3}
MR JUSTICE FRASER: Are we looking at the 5th March entry?
MR GREEN: We are trying to look at the top of the 18th
February, my Lord.
MR JUSTICE FRASER: We need to go back to page 3, please.
A. Right.
MR GREEN: So let's look at the second line there. Well,
let's read the whole thing:
"We have seen a higher than normal number of
incidents where Foreign Currency remittances did not
auto populate which required branches to manually key
the amount into Horizon. As a consequence of this we
have become aware of some branches mis-keying either the
wrong currencies and/or amounts into Horizon ..."
A. Yes.
Q. They don't say that's because of a failure with the
system itself --
A. Sorry, they then say or they don't say?
Q. It does say it didn't auto-populate?
A. Yes.
Q. Then it says:
"As a consequence of this we have become aware of
some branches mis-keying either the wrong currencies
and/or amounts into Horizon which will result in
a misbalance in branch at declaration stage."
A. So this announcement is covering two cases, an error in
the number and an error in the currency.
Q. Well, the announcement is referring to two cases which
we don't seem to see any examples of in the list?
A. We don't in the ...? Sorry, I missed that.
Q. We didn't see any examples of that in the list at the
back here?
A. No, we didn't. We saw amounts only in the list.
Q. And it doesn't refer to the problem with the decimal
point, does it?
A. This one doesn't. As I say, the 8th February says --
Q. Take it in stages. We know the 8th does. This one
doesn't. There has just been an incident. What is
happening is if you put in a decimal point and two zeros
on Horizon in a way that you have accepted is wrong, it
adds the two zeros or the one zero to the number, and it
doesn't say that?
A. This announcement doesn't say that. This announcement
says when this damage has been done here's what you do.
Q. And if you want users to be able to diagnose what is
going wrong, you need to tell them what the problems
with the system are candidly, don't you?
A. I demur from that. Telling users about problems in the
system is -- can be too much information. Telling users
what to do is what I think is most useful.
Q. So were they right or wrong to mention the decimal point
the first time?
A. They were right.
Q. Were they were right or wrong to not mention it the
second time?
A. I don't know.
Q. Dr Worden, when there's just been a flash of people
getting £900,000 discrepancies, things like that, if you
are being candid you say: this is due to a fault, or
whatever you want to call it, in the system by which the
decimal point is ignored?
A. You might say that --
Q. If you were being candid you would --
A. If we return to the point that the first announcement
was don't do this, and the second announcement was if
you have got problems from either amounts or the right
currency here's how to fix them, here's how to sort it.
So the purpose of the two announcements are rather
different and I don't know enough background to say that
the decimal point point should have been repeated.
Q. Let's go to the table, the Excel spreadsheet, which I
think very kindly we have very got prepared to come up,
which is what we were going to look at before. This is
the one that you had a bit of a poke around in?
A. Yes.
Q. To get the table that you have referred to, and we will
have a look at it in a minute, at table 9.3 in your
report?
MR JUSTICE FRASER: Can you just remind me of the trial
bundle reference of this.
MR GREEN: Certainly, I was just about to read it out
{D3/1/208}.
MR JUSTICE FRASER: No, the one on the common screen.
MR GREEN: I apologise, my Lord. It is {F/987/1}.
MR JUSTICE FRASER: Okay.
MR GREEN: You went down to look for the relevant table to
use and had a look around.
A. Yes, but obviously the most relevant table was the one
that appeared in my report.
Q. I understand. That was the one you felt was most
relevant?
A. Yes.
Q. And if we go down to row 46, please?
A. That's a header.
Q. Yes.
A. "Volume net value."
Q. That is the table you reproduced?
A. That's it, okay. The numbers look familiar.
Q. Yes?
A. Yes.
Q. That's the one you reproduced, and it is to do with
branch errors, isn't it?
A. Yes.
Q. You did not reproduce the table immediately below it
which is for other errors, did you?
A. That's true, yes.
Q. Why not?
A. Well, why would I have wanted to? (Pause)
For completeness it would have been useful but
I felt -- as far as the distribution of TCs and the
distribution of erroneous TCs, but I agree I could well
have quoted that last table and it would have been
useful to do so --
Q. I'm going to ask you to give his Lordship a candid
answer: was that a mistake or was it deliberate?
A. It certainly wasn't deliberate. It wasn't, if you like,
an oversight or a wrong editorial decision, if you like.
But the question I'm asking myself is how that adds to
the information?
Q. Isn't it obvious, Dr Worden? TCs that do not arise from
what even Post Office regards as branch errors might be
highly relevant to any analysis that you might wish to
conduct?
A. Well, my intent in looking at this top table was to get
an idea of the proportions. Now, if we find that the
proportions in the bottom table radically alter the
overall proportions, then that is a problem. But I was
looking at the proportion -- what I was looking at was
how big is this, how big is that, and so on. And indeed
I overlooked some issues in my first report. I didn't
spot the fact that Santander online banking, while small
in volume was huge in value, and that's an important
point in my second report.
So I was looking for overall proportions to say what
are the important things here.
Q. If we just look, the bottom table is the table that even
in Post Office's mind relates to TCs which were not
branch errors?
A. Yes, absolutely.
Q. It is rather what this litigation is concerned with,
isn't it?
A. No, I do not think so. That is not -- TCs arising from
other areas is TCs arising from something not in the
branch, but that TC is probably correct and therefore
not imputed on the branch.
Q. So cash rems to branches, 2011/12 out-turn. The fact
that there are 4,093 TCs, which even in Post Office's
mind are not the result of a branch error, is not
relevant to your analysis of how the system works?
A. Well, 4,000 as opposed to 21,000 in the table above. It
is an interesting figure, that, and I hadn't really
drawn my attention to it at the time of my first report,
I agree.
Q. We know that. That is the premise of my question. When
you answered my earlier question you said it was either
an oversight or an editorial decision.
A. I was not very conscious of that second table. In other
words, I said what's the table to put in as the summary
of the proportions, and I chose that table.
Q. The word "chose" suggests it was a conscious choice
between the two. It wasn't. You just found one and
popped that in --
A. I found one which I thought was indicative of the
proportions and I used that one, yes.
Q. Let's move on.
Now, you gave evidence earlier I think, and I think
this is common ground, that you and Mr Coyne adopted
slightly different approaches. You adopted more of
a top down --
A. The whole thing, to the whole --
Q. Yes. And started the architecture and looked into the
KELs, and Mr Coyne was looking through the KELs and
PEAKs and so forth trying to identify --
A. Well, I should say I started the architecture, looked at
the processes and looked at the KELs, yes.
Q. I think you started with the 75 documents Mr Jenkins
gave you?
A. That is right, there was an early tranche --
Q. Was he able to describe those documents and what to look
at when you spoke to him?
A. No, it wasn't Mr Jenkins who gave me those 75. I had
this early tranche of documents which was mainly high
level architecture stuff.
Q. Do you know who those were provided by?
A. Just lawyers said "Look at these", you know, it was
really early months.
Q. I see. And in the second --
A. I mean they said "More's coming but here's something to
go on".
Q. I understand. In the second joint statement I think you
and Mr Coyne, if we look at {D1/2/28}, that's the second
joint statement. If we look on page 28 at item 1.8.
A. "Extent".
Q. You make the point at 1.8 with regard to extent, yes?
A. Yes.
Q. You say:
"In order to address Horizon issue 1, it is
necessary to define measures of the extent of bugs with
possible impact on branch accounts."
A. Yes.
Q. So you appreciated that was necessary for the purpose of
Horizon Issue 1?
A. That's my view, yes.
Q. And having some sort of idea for the order of magnitude
of something is obviously quite a good starting point,
isn't it?
A. Yes.
Q. Is it 1 or 10 or --
A. Also, I mean not only the question is it 1 or 10, but
what's the scope with which -- in other words, if I'm
asking a question about likely, what is the scope of
likely that is interesting?
Q. We will come to that. But if you look at a particular
bug and you are just looking to try and identify the
data, it is helpful to know whether it affects one
branch alone or perhaps 10 or 20?
A. Absolutely, yes.
Q. Because that is a significant difference for the
purposes of what you might infer from it. And we agreed
on Tuesday that if it has actually impacted a branch and
the branch accounts, it obviously had the potential to
do so. Yes?
A. I agree with that, yes.
Q. But in order to have the potential to do so it is not
necessary to find that it actually did in a particular
case?
A. I think potential is wider than actual, yes.
Q. Exactly. I want in a moment to take you to some of the
bugs specifically and go through them, but can I just
clarify one point first in relation to paragraph 650 in
your first expert report at {D3/1/153}.
A. 650, I will just get that. Yes, "Receipts/Payments
Mismatch". Okay, that is the beginning of the analysis
of the receipts/payments mismatch, yes.
Q. If we look at page {D3/1/153}, you will see there that
in paragraph 650 you are referring to the receipts and
payments mismatch issue, yes?
A. Yes.
Q. You refer to where it is in Mr Coyne's report, you say:
"It involved a bug in Horizon which was triggered by
a rare circumstance (which one would not expect to be
exercised in testing) and which had an effect on branch
accounts."
Then you say:
"If Mr Godeseth's evidence about this bug is not
accepted, I shall revise my opinions accordingly. They
are based on written evidence - particularly on a
written analysis by Gareth Jenkins ..."
Yes?
A. Yes.
Q. "... as well as the second witness statement of
Mr Godeseth."
Pausing there. Were they not also based on the
conversation you had specifically had with Mr Jenkins
about the receipts and payments mismatch bug?
A. That helped to clarify my understanding of the
documents. I could read the documents I think with
a little more confidence once Mr Jenkins had explained
some things. I was particularly interested in double
entry accounting and how that applied and the
conversation with Mr Jenkins did clarify that.
Q. What was Mr Jenkins able to add that we don't find in
the documents, if anything?
A. It was not so much that he added anything, it was that
I had -- not in the documents -- I had started from my
own experience and my own thoughts about system design
and I had thought double entry accounting might be
applied in a certain way. And it appeared, it emerged,
as Mr Jenkins' document made clear, and he I think
reinforced to me, that double entry accounting is not
applied to the roll over in quite the way I had
understood.
Q. And what was the difference between what you had
understood and what he told you?
A. That certain operations in the roll over were not double
entry.
Q. And which were those?
A. It was to do with calculating a final month figure from
an initial month figure and adding all the transactions,
as I recall. I realised, reading Mr Jenkins' document
again in the light of that conversation, that double
entry accounting was applied in Horizon in more
complicated ways than I had understood.
Q. Did you set that out -- set out that more nuanced
understanding in your report somewhere?
A. I believe I did. If we look at DEA in this section
I believe we will find the reference to the fact that
DEA -- here we are. 654.2 is pretty much it.
Q. That's what came from Mr Jenkins, did it?
A. That's what came from my final understanding of the
documents, having had a few words from Mr Jenkins which
made it clearer to me and made me think about how double
entry accounting might be applied in such a system and
the fact that, for accumulation exercises like that, it
may well be sensible not to apply double entry
accounting in the kind of direct way which I had first
thought was appropriate. So this was a matter of my
experience versus the documents, if you like.
Q. So you were expecting double entry accounting to apply
across the board and you discovered --
A. I was expecting it to be more comprehensive and more
immediate. Obviously at the end it applies because it
goes to POLSAP, and POLSAP does (inaudible) accounting,
but I was expecting it to be rather more immediate.
Q. Within Horizon you were expecting?
A. Yes.
Q. And what other operations were apparently not double
entry operations? Can you remember?
A. I can't think of any off the top of my head but my
feeling is that customer transactions are double entry.
Q. You can't remember others that aren't?
A. I can't remember offhand.
Q. That's a fair answer. Sorry, that is a matter for his
Lordship.
So can we look now please at Callendar Square --
just before we move off receipts and payments mismatch,
Mr Jenkins didn't give you any details on the phone of
how and exactly when and indeed whether every single
person in the receipts and payments mismatch bug had
actually been compensated, did he?
A. No, we didn't talk about that aspect.
Q. So you have no more information about that than we have
in the documents?
A. No.
Q. If you can move to Callendar Square, please. Can
I understand, when you wrote your first report you had
obviously had to look into some of these bugs?
A. Yes.
Q. And you had been told about how many by Post Office in
your instructions?
A. Well, I had been told about the three. I was looking
for more. But the three were the three obviously that
were a focus of those --
Q. And they were the three acknowledged bugs that
Post Office had acknowledged in its letter of response?
A. Yes.
Q. So the suspense account bug?
A. Yes.
Q. Callendar Square?
A. Yes.
Q. And the receipts and payments mismatch?
A. That is right.
Q. No one at Post Office had told you about any other bugs?
A. I wasn't relying on Post Office to tell me about bugs or
Fujitsu. I mean I was relying on me digging around.
Q. So you were left to see if there were any more than
those three and dig around?
A. That was the exercise I understood I was doing, yes.
Q. I understand. If we look please at {D3/1/156} in your
first report, and if we look at -- just to give you
context to see where you are, do you want to go back to
the previous page, very kindly, just to show Dr Worden.
{D3/3/155}
Dr Worden, you can see this is under your heading
8.6.2, "The Callendar Square ..."
A. Can I just remind myself.
Okay, yes.
Q. Okay? Over the page at 663 {D3/3/156}, after describing
how stock would disappear from the sending stock unit
and not appear in the receiving stock unit, which is
662:
"... a failure of double entry accounting which was
not evident to the subpostmaster at the time."
You go on to deal with this.
So this is another aspect, isn't it, in which on
this occasion there was a failure of double entry
accounting rather than an absence of double entry
accounting, is that fair to distinguish between the two?
A. I'm not quite sure. I mean, a failure rather than
an absence ...
Q. Well, what I'm really asking you is in relation to your
conversation with Mr Jenkins you told the court that you
identified an issue there where the operation concerned
was not governed by double entry accounting?
A. Yes.
Q. And here, on the face of it, it looks as if this did
not -- you can see, if you look at 663 you see:
"In my opinion, under the later Horizon Online
software this failure of DEA might have been immediately
manifest as a failure to send a zero-sum basket to the
BRDB. But in old Horizon, apparently it was not
immediately detected, so in this respect Old Horizon was
possibly less robust than Horizon Online."
A. Yes.
Q. That follows from 662 where you have identified that the
result of the problem, which was a time out or locking
problem somewhere inside the Riposte product, was that
the stock would disappear from the sending stock unit
and not re-appear in the receiving stock unit?
A. Or there might be a double -- I think it might have come
in twice on some occasions as well.
Q. Just focus on this point that you are dealing with at
662 first, if we may. You say at 662:
"... a failure of double entry accounting which was
not evident to the subpostmaster at the time."
A. That is right, yes.
Q. Just pausing there. What actually is happening is that
what Horizon is showing on the system is wrong?
A. Showing to whom? You mean storing in its database?
Q. Yes. What Horizon is recording is wrong?
A. Yes, I think so. I mean I think Callendar Square
typically was, you would transfer out of a stock unit
once and because of these Riposte problems you might
transfer in twice.
Q. Okay. Let's look. You see at 662, the sentence I'm
asking you about is on the second line, after the dash:
"... a failure of double entry accounting ..."
Yes?
A. Yes. I mean double entry accounting is something goes
out of one stock unit into another and they must exactly
balance, so if they go in twice, as appears to happen at
Callendar Square, that is a failure of double entry
accounting, yes.
Q. Yes. Because the initial failure was not evidence to
the subpostmaster, you say that at 662?
A. Yes. He didn't see it immediately and it wasn't brought
to his attention straightaway.
Q. Exactly.
So let's look at 664 and you say:
"While the failure was not immediately visible to
the Subpostmaster at the time of the stock transfer, it
would always be visible later when balancing stock
units."
A. Yes.
Q. You see that?
A. Yes.
Q. You say, referring to Mr Godeseth:
""It was also, as Mr Godeseth says at paragraph 13.7
of his Second Witness Statement, soon visible to Fujitsu
in two different ways (a flag from overnight processing,
and a system event)."
Yes?
A. Yes.
Q. And you identify that as potentially one of your
robustness measures?
A. Yes.
Q. You then say:
"So in the normal course of events, the
Subpostmaster would see a discrepancy of some large and
easily identifiable sum (because stock unit transfers
generally involve larger sums than customer
transactions) and would know, since he had not made any
mistake to call the help desk. This was countermeasure
MID."
A. Manual inspection by the postmaster of his stock, yes.
Q. Yes. So the point you are making there is that what you
have described at 665 is the countermeasure of manual
inspection of data?
A. That's a part of it. It can be manual inspection by
lots of different people.
Q. Yes.
A. It can be back office or it can be the postmaster or --
Q. And you say:
"As is shown by the PEAKs, the presence of the
Riposte error was easily identifiable from system logs
so the help desk would know it was not a user error and
Post Office could correct any discrepancy if it arose in
the branch accounts."
A. Yes.
Q. It actually doesn't sound that bad?
A. Well, we always have this issue of if there is
a discrepancy, how obvious is it and therefore how much
can one infer about whether it is likely to have been
corrected or not? And receipts/payment mismatch, which
I think this eventually led to, is a pretty prominent
red flag to Fujitsu. And so a lot of receipts/payment
mismatches I would expect -- you see them in PEAKs when
they occur and you see the amount involved, so I would
expect on a high proportion of cases generally
R/P mismatches would be sorted out.
Q. On 662 you fairly observed it wouldn't be evident to the
subpostmaster at the time, that's when it happens, yes?
A. That is right.
Q. If we go over the page to 667 {D3/1/157}, you say there:
"At paragraph 15 of Mr Godeseth's Second Witness
Statement, he says that this bug had impact on branch
accounts in 20 [branches]."
Yes?
A. Yes.
Q. You then go on to reason as follows:
"For the receipts/payments mismatch bug, there is
evidence that affected branches were compensated."
A. Yes.
Q. We will come back to that.
"Because of this evidence, and because Fujitsu could
always spot any occurrence of the bug in event logs, and
because neither Post Office or Subpostmaster wanted
Subpostmasters to suffer shortfalls from bugs in
Horizon, I would expect the Subpostmaster to be left
with a shortfall (i.e. not compensated) in only a small
minority of cases, if any cases."
A. Yes.
Q. Now, pausing there, have you actually seen any evidence
of any actual repayments to the subpostmasters and
subpostmistresses who suffered in the receipts and
payments mismatch bug?
A. No, I've seen that there was careful tabulation of the
discrepancies, that's all I've seen. The actual
compensation process is outside the PEAKs and so on,
so --
Q. Let's have a quick look while we're on the point and
then we can take a break, if we may, when I finish this
point, my Lord.
{F/1001/1}. You have seen this document?
A. When it comes.
MR JUSTICE FRASER: Is it 1001/1 we are going to?
MR GREEN: It is, my Lord.
A. This one, yes. Fine.
Q. "Receipts/Payments Mismatch issue notes". Attendees are
from service delivery, security, network, IT, POL
finance and Fujitsu:
"Discrepancies showing at the Horizon counter
disappear when the branch follows certain process steps,
but will still show within the back end branch account.
This is currently impacting circa 40 Branches since
migration onto Horizon Online, with an overall cash
value of circa £20k loss."
A. Yes.
Q. Do you see that?
A. Yes.
Q. If we go over the page {F/1001/2}, we see halfway down:
"Note the Branch will not get a prompt from the
system to say there is Receipts and Payment mismatch,
therefore the branch will believe they have balanced
correctly."
Do you see that?
A. Yes.
Q. This is just a subpoint in relation to receipts and
payments mismatch. That is not the system alerting the
subpostmaster or subpostmistress to what's going on, is
it?
A. I agree that is different from other cases where I think
receipts and payments mismatch shows in a trial balance
or something that the postmaster sees.
Q. Honestly, Dr Worden, does that bit take you by surprise?
A. It does a bit actually.
Q. I'm grateful.
My Lord, is that a convenient moment to pause?
MR JUSTICE FRASER: Yes. Come back in at 3 o'clock.
(2.52 pm)
(A short break)
(3.00 pm)
MR GREEN: So Dr Worden, just picking up where we were
before the break, this was in the context of your
inference for the purposes of Callendar Square that
given the experience in the payments mismatch case, you
had confidence broadly in the matter being corrected.
A. I would say when an R/P mismatch is evident, in my view
there is a high probability that it will be sorted out,
the effects will be sorted out.
Q. I understand. Just to clarify the position, if we look
at this document that we are looking at now {F/1001/3},
if we go back up one page, please {F/1001/2}, just under
"Impact" it says --
A. Sorry, can I -- sorry to do this, but can I go back.
{F/1001/3}
The statement that surprised me said the branch will
not get a prompt from the system.
Q. Yes, that's just above.
A. So he has to look at two numbers to see there is
a mismatch rather than it being hidden from him.
Sorry about that. Let's get on, sorry.
Q. Isn't the true position on receipts and payments
mismatch that it will appear to balance when it hasn't?
Isn't that the real problem? Not that he has to look to
find out, it is not just the absence of a prompt.
A. I do not think that's it. I think there is -- he gets
a report and it has receipts on it and payments on it
and the two figures are not the same.
Q. Well, this receipts and payments mismatch issue is not
that, Dr Worden. Look at the very page we are looking
at now. {F/1001/2}
A. Yes.
Q. The sentence I was about to take you to, under "Impact":
"The branch has appeared to have balanced ..."
A. Okay, yes. Sorry about that.
Q. "... whereas in fact --"
A. "Appeared to have balanced" seems to be that it appears
to balance, yes.
Q. Pausing there. It wouldn't be apparent to the branch,
would it?
A. It sounds like it, yes.
Q. And that's a fundamental point about this bug?
A. It doesn't appear to the branch.
Q. Yes.
A. Yes.
Q. If we look what they say underneath, they say:
"Our accounting systems will be out of out of sync
with what is recorded at the branch."
A. Yes, so --
Q. That's obvious?
A. RDS will pick it up.
Q. And it says:
"If widely known could cause a loss of confidence in
the Horizon System by branches."
A. Yes.
Q. "Potential impact upon ongoing legal cases where
branches are disputing the integrity of Horizon data."
A. Yes.
Q. "It could provide branches ammunition to blame Horizon
for future discrepancies."
A. Yes, okay.
Q. You see those?
A. Those last three points are kind of ramifications on --
Q. Now, if you are going to rely on your users to help you
monitor what's going on with the system, is being candid
with them about a clear problem to be expected for that
countermeasure to work properly?
A. Yes, but I think for a problem one has to decide in
terms of communication with users how many are affected
and how many are likely to be affected and whether
therefore you are going to confuse the great majority of
users by telling them about some problem that occurs to
a tiny minority. So there are trade-offs there about
how you communicate with users.
Q. And in terms of the inferences you might draw in your
professional opinion about the effectiveness of the
approach we see on this page?
A. Yes. So the approach is?
Q. Post Office's approach to this on this page appears to
be regarding at least as material or influential factors
worries about loss of confidence in the Horizon system
if it gets out that this has happened, ongoing legal
cases, and branches getting ammunition to blame Horizon
for future discrepancies.
A. Yes.
Q. Would you normally expect those factors to feature in
your idea of the UEC countermeasure of how it should
work ideally?
A. Those three bullet points are kind of psychological
points about how it would influence mindsets and they
don't seem to me to have a very direct bearing on UEC.
Could you spell it out?
Q. Dr Worden, I probably didn't ask the question well
enough.
If Post Office is being held back from telling
people about established bugs in the system on that
basis --
A. I see.
Q. -- they are not making the best use of UEC, are they?
A. I see. So you are saying that these psychological PR
implications in their mind may influence their decision
whether to talk candidly with users.
Q. That appears to be the case. It is what they are
saying.
A. Well, they are saying here are some impacts. They are
not saying these impacts affect our decision. They are
pointing out that here is a possible impact.
I'm not being ingenious, really.
Q. You might have given the game away there.
Dr Worden, the reason they are listing those impacts
is because they are the impacts they had in mind in
weighing up what to do, because you can see the next
heading is "Identifying the issue and forward
resolution".
They are factors to which they are giving more or
less weight but they are factors?
A. They are factors that they are pointing out in this
summary of the whole impact of the incident. I'm not
clear whether they are saying these factors affect our
decision how to communicate with postmasters, I can't
draw that inference --
Q. Okay. Let's go over the page to {F/1001/3}. Top line:
"The Receipts and Payment mismatch will result in an
error code being generated which will allow Fujitsu to
isolate branches affected this by this problem, although
this is not seen by the branches."
A. Yes. This is the 902s and 903s I think referred to.
Q. And the "not seen by the branches" appears to confirm
what we have seen on the page above?
A. Yes.
Q. They say:
"We have asked Fujitsu why it has taken so long to
react to and escalate an issue which began in May."
A. Yes. So this is about September, isn't it?
Q. September/October time.
A. Right.
Q. And they are going to provide feedback.
If we just go down, the next paragraph begins
"Fujitsu", the one after that says:
"The code fix will on stop the issue occurring in
the future, but it will not fix any current mismatch at
branch."
A. Yes, I think it is obvious that you can't go backwards.
That fix is a code fix for future, yes.
Q. So the state of play as at the date of this document,
before they have decided what to do with affected
branches, is that the Horizon system is recording the
wrong figures. There is a difference between the
figures that the Horizon system is recording and the
ones at POLSAP which it should be recording?
A. There are discrepancies, yes.
Q. And the Horizon system has the wrong figures on them?
A. There are lots of figures around the place. Some of
them are wrong, yes.
Q. Look at "Proposal for Affected Branches", if you would:
"There are three potential solutions to apply to the
impacted branches, the groups recommendation is that
solution two should be progressed."
So that is just the recommendation at this stage.
"Solution one - alter the Horizon branch figure at
the counter to show the discrepancy."
So that would be, it looks like, dialling into the
counter and altering the figure that would show on the
counter?
A. "... alter the ... branch figure at the counter to show
..."
It is not clear to me which branches that applies to
at any given moment.
Q. They are talking about impacted branches as we can see,
because the heading says "Proposal for Affected
Branches", and the line underneath says:
"There are three potential solutions to apply to the
impacted branches."
So we know they are talking about the branches that
have been affected by this bug, don't we?
A. Yes.
Q. Then they say:
""Solution one - alter the Horizon branch figure at
the counter to show the discrepancy. Fujitsu would have
to manually write an entry value to the local branch
account."
A. Yes, that looks like, as you say, remotely going into
the branch.
Q. Okay, so that is something they were able to do and were
considering doing?
A. That was a possibility yes.
Q. "Solution two - P&BA will journal values from the
discrepancy account into the Customer Account and
recover/refund via normal processes. This will need to
be supported by an approved POL communication. Unlike
the branch 'POLSAP' remains in balance albeit with an
account (discrepancies) that should be cleared."
Yes?
A. Yes.
Q. "Impact - Post Office will be required to explain the
reason for debt recovery/refund even though there is no
discrepancy at the branch.
"Risk - could potentially highlight to branches that
Horizon can lose data."
A. Yes.
Q. So we can see that that is the adverse factor militating
against solution two?
A. Yes.
Q. Notwithstanding at this stage there were recommending
solution two, yes?
A. Yes, and they're saying solution two has this drawback
in that it draws attention.
Q. Yes. And then:
"Solution three - It is decided not to correct the
data in the branches (ie Post Office would prefer to
write off the 'lost'.
"Impact - Post office must absorb circa £20K loss.
"Risk - Huge moral implications to the integrity of
the business, as there are agents that were potentially
due a cash gain on their system."
So the point is although Post Office can decide what
it wants to do as one corporate body, there are lots of
different post offices and sub-post offices involved.
Some will have losses, some will have gains?
A. Yes, I can't fully interpret solution three.
Q. Okay. The short point we get from this document,
Dr Worden, is that the correction of what had gone wrong
was not automatic exactly, was it? It was discretionary
as to how they did it and whether they do it?
A. Yes, but this does refer to "recover/refund via normal
processes", as though there were processes to do it.
Q. It is not that there weren't processes. The question,
which I think you fairly accepted, was it was
discretionary rather than automatic?
A. Well, they were choosing how to sort it out. They had
three ways --
Q. And that was a discretionary choice that they had?
A. They had a choice of three ways to sort it out, yes.
Q. Now if we look at the joint statement for a moment
{D1/4/5} at 3.22.
A. Yes:
"... the same effects as a user error ..."
Yes.
Q. What you and Mr Coyne agreed is:
"Many software bugs can have the same effects as
a user error (as illustrated, for instance, by the
Dalmellington bug, which produced a remming error)."
A. Yes.
Q. And a remming error might look like a user error?
A. Absolutely.
Q. And that's why you refer to that?
A. Yes.
Q. Pausing there. I think you were here for Angela Van Den
Bogard's evidence, can you remember?
A. I do not think I was, actually. Sorry about this. But
I certainly read the transcripts.
Q. Did you see a reference to UEB in her cross-examination?
A. No, you would have to take me to it.
Q. User error --
A. Oh, UEB. It is a strange acronym.
Q. Yes, user error bias. It was put to her whether she
accepted that Post Office suffered from UEB or user
error bias from time to time in relation to --
A. I have never seen that acronym myself.
Q. I understand. But for the moment if it is right that
Post Office suffers from user error bias in its dealings
with subpostmasters, it is quite important, isn't it, in
the context of what you and Mr Coyne have agreed at
3.22, because you have agreed that many software bugs
have the same effects as user error. So they look
similar, and then the subpostmaster is faced with
dealing with an organisation that has a bias in favour
of assuming it's user error when they look the same?
A. If a software bug looks like a user error, the resilient
processes will compensate regardless of which one it is.
Q. Let's have a look and consider this in a little bit more
detail. If we go please to {H/6/3}, turning to
Callendar Square now. This is a letter of
11 January 2017.
A. Yes.
Q. If we look at page 3 of this letter, do you see 7.8.1 at
the top of the page?
A. Yes.
Q. This is Post Office's solicitors, Wombles, writing to
the claimants' solicitors in January 2017.
A. Yes.
Q. And there they say:
"The Falkirk/Callendar Square issue was only known
to have affected that one branch."
A. Yes.
Q. And you have identified that it affected 20 branches in
your report, that is correct?
A. Yes.
Q. If we look at how the Callendar Square story develops.
If we look at {F/297/1}, please. You are just going to
be given a hard copy of this, Dr Worden. This is
PC0126042. If we just go down to -- do you see
15/09/50, 10.28, just after halfway down?
A. "Unable to find relevant KEL."
That one?
Q. Yes. And underneath "Unable to find relevant KEL" is:
"Information: Faye at nbsc states that she went
through 2 hours of checks."
A. Yes.
Q. If we go down to "Recommend", which is about seven lines
down from the bottom?
A. Yes:
"Please investigate ..."
Q. " ... as to why the stock unit aa on node 3 and node 4
are showing varied amounts on counter daily reports."
If we go over the page very kindly {F/297/2}, we
have got at the top "Stock units vary on counters."
Sorry, it is not stock units, "SU cash amounts vary on
counters".
A. Yes.
Q. And we come down to the fifth box, "Cheryl Card",
underlined.
A. Yes.
Q. 15 September 2005 at 16.12.27:
"Due to the Riposte errors on 14/09/05 from 15:30
onwards (see call E-0509140700), messages were not
replicated on counter 3. As a result, 3 transfers in to
stock unit AA were done twice, initially on other
counters then again on counter 3. The transfers in were
for:
"3000.00 (cash)
"400.00 (cash)
"89.69 (cheques)
"This has resulted in a loss of 3489.69 in CAP 25 to
the outlet, which POL may need to correct via an error
notice."
A. Yes.
Q. "Phoned the PM to explain what the problem was. He is
concerned about other transactions which he has input
twice (3 Giro deposits and another cheque) because of
the replication problem. Have advised him to contact the
NBSC as this is a business issue."
Do you see that?
A. Yes.
Q. We know eventually that it was actually a bug?
A. Yes.
Q. But what he is being told here is at least for part of
this to contact the NBSC because it is a business issue?
A. Yes. I mean what seems to have happened here is that
because he had this stock problem which was caused by
a bug the postmaster started thinking I need to re-enter
these transactions, which was not to do with the bug.
He thought I have to re-enter these transactions. So it
is a little confused to me.
Q. The approach you have taken in your report is that
Post Office would -- you say:
"Neither Post Office or subpostmaster wanted
subpostmaster to suffer shortfalls from bugs in
Horizon."
A. Yes.
Q. Because that was in paragraph 667 which I took you to.
A. 667.
Q. It is on page 157. If we go back to that for a second.
A. Yes.
Q. You say there:
"Neither Post Office or subpostmaster wanted
subpostmaster to suffer shortfalls from bugs in
Horizon."
Yes? And it is obviously right that subpostmasters
didn't want to suffer shortfalls, did they?
A. That is right.
Q. But if Post Office was gaining money at the expense of
subpostmasters --
A. Yes.
Q. -- that in itself would not be an incentive to try and
give the money back, would it?
A. Well, I was asked to consider Post Office's motivations,
and in that context I think that one of Post Office's
motivations is to keep down the administrative problems
of things recurring and not being sorted, and if you
don't sort the discrepancy and the postmaster keeps
coming back and so on, your admin costs will soon rise.
So it is a complicated -- there is a lot of motivations
at play there.
Q. There are a lot of motivations at play. If
subpostmasters are, let's say hypothetically, pressured
to pay regardless of who is at fault and they just pay
up because of the way they are asked, hypothetically,
that reduces your admin costs a lot, and if they have
suffered a loss you don't have to give the money back,
so that meets two objectives?
A. That is part of the trade off. There will be the ones,
as you say, that just knuckle under and take it, and the
ones that keep banging the table will cost you a lot of
money.
Q. Just on that point, were you aware of any general
Post Office suspense accounts in --
A. Central suspense accounts?
Q. Yes.
A. Yes, there are I believe, and they may be to do with all
the dealings with some client.
Q. Okay. Well, what about -- because elsewhere in your
report, I don't want to stray too much at the moment,
but you also mention micro bugs, small bugs, being
unlikely because you would expect to see large sums of
money somewhere --
A. Money that disappears somewhere has to pop up --
Q. It's got to come back somewhere else, it's got to pop up
somewhere else.
Have a look at {F/333.1/1}, please. Dr Worden, I'm
asking you just to look at this to see whether you were
aware that an issue had been raised about it, not
evidence of it itself, yes?
A. Yes.
Q. This is the Second Sight report which you must have
seen?
A. The part two report I have seen, yes.
Q. You have. Let's look at page {F/1333.1/46}, please, and
if we look at 22.11.
A. Yes. (Reading to self)
Q. It says:
"We note that Post Office's control and
reconciliation procedures rely on correct information
being supplied by third party clients. It follows that,
if incorrect information is provided by any client
company, this can give rise to a loss being charged to a
branch. We also note that, for most of the past five
years, substantial credits have been made to Post
Office’s Profit and Loss account as a result of
unreconciled balances held by Post Office in its
Suspense Account."
Now I'm not asking you about that as evidence of
itself, I'm just asking were you aware that that was
a concern that Second Sight had raised about substantial
credits being made to Post Office's profit and loss
account as a result of unreconciled balances held by
Post Office in its suspense accounts?
A. I read the Second Sight reports and the Post Office's
reply.
Q. But did you spot that?
A. I didn't spot that, no.
Q. Just whilst we are on that, if you will forgive me,
going to the micro bugs point very briefly. If we look
at {D3/2/211}.
A. Yes.
Q. This is appendix F 2, your appendix F 2, and we are
going to look at paragraph 460 in relation to micro
bugs.
A. Yes.
Q. You say:
""Because POLSAP uses double entry accounting, in my
opinion any effect of micro-bugs on branch accounts must
also show, aggregated over all branches, in some Post
Office central account. If that effect were significant,
then in my opinion it would inevitably have been noticed
by some Post Office manager or external auditor."
A. Yes.
Q. But you weren't aware of what I have just shown you when
you wrote that?
A. No, no.
Q. And having seen that now, that would be at the very
lowest a line of enquiry that you would wish to follow
up before continuing to hold the opinion you have
expressed there?
A. I would like to kind of reconcile those two paragraphs
and work out how much I knew about Post Office central
accounts and that is limited.
Q. It would make a bit of a difference how substantial the
sums were as well, wouldn't it?
A. It would. I mean substantial -- one would like to know
what are the sums that Second Sight were referring to
versus what are the sums that micro bugs might add up
to. One might want to make that comparison in order to
drill further into that issue.
Q. Dr Worden, can I bring you back now to Callendar Square
because we are really looking at Callendar Square and
how it starts in the context of what you said you would
expect to happen.
Now, I have shown you what happened on receipts and
payments mismatch --
A. Any receipts and payments?
Q. No, the particular --
A. The particular one, right.
Q. And it was discretionary how they would approach it.
I have shown you the existence of the suspense accounts.
A. Yes.
Q. Does either of those alter your expectation of how
efficiently and helpfully the Callendar Square bug would
have been dealt with?
A. Sorry, which two points alter my expectation?
Q. The fact that there is a suspense account into which
unresolved unreconciled credits go and are ultimately
credited three years later to Post Office's accounts,
and the fact that it wasn't absolutely automatic that
a transaction correction would be issued, as we have
seen from receipts and payments mismatches. Do either
of those alter your expectations about how elegantly the
problem that Mr Alan Brown suffered at Callendar Square
would be sorted out one way or the other?
A. I think my opinion is if there is a receipts/payment
mismatch it gets noticed in several ways and my opinion
is there is a high probability that therefore it will be
sorted out.
Q. So it doesn't change your view?
A. I do not think that view has changed, no.
Q. I wanted to ask you that because it seems to bear on the
introduction of your analysis of Callendar Square.
Let's see what actually happens at Callendar Square.
We have looked at the PEAK at {F/297/1}, if we go there
you will see it. That was the one where he was
concerned about other transactions, if you look on
page 2, do you remember? It is in the fifth box down.
{F/297/2}
A. Yes, the postmaster had done some other transactions.
Q. Which is input twice, three Giro deposits and other
cheques because of the replication problem, do you see
that?
A. Yes.
Q. That's what he is concerned about. Were you here,
I think you said you were here when Mr Godeseth gave his
evidence?
A. Yes.
Q. You heard I think me take him through the history of
Callendar Square?
A. Yes.
Q. And if we look at {Day8/58:1}.
A. Page 58, yes.
Q. This was in the context -- do you remember that the
suspense account team were not prepared to authorise the
entry of part of the discrepancy into his suspense
account, do you remember that?
A. I don't recall that detail.
Q. I can show you. But let's just, for the moment, look at
his answer. I say:
"Question: So it was not easy for the
subpostmaster, was it?"
MR JUSTICE FRASER: Before you do that, you really need to
start at the bottom of page 57, I think.
MR GREEN: My Lord, I'm happy to do that. Can we go up
a tiny bit. {Day8/57:10}.
A. Right, "the suspense account" probably means the
suspense account for that branch?
Q. Yes, it does. If I can help you with it possibly. Page
57, line 10:
"'This office had severe problems balancing on
[week] 25, resulting in a shortage of £6,414.46. After
checking various reports I am satisfied that the error
is made up of ...'
"And they are then broken down carefully there and
you can see that the SPMR is saying there is a Horizon
software problem and so forth, giving the history ..."
A. Can I ask what that quote is quoting from?
Q. From the document we are just looking at. I can take
you to the document, I'm just at the moment asking you
whether you recall that this was the sort of problem
that the Callendar Square subpostmaster, Mr Alan Brown,
was faced with, or can you not really remember?
A. Well, obviously he was faced with a shortfall, that's
what I remember. Details of suspense accounts and so on
are not so prominent in my mind.
Q. Have a look at what -- the problem is if you look at
line 18.
A. Yes.
Q. It says:
"Question: Then speaking to the Horizon support
centre at the bottom of the page. If we go over the
page, please:
"'They told the SPMR that they would report to NBSC
that they had identified and rectified the problem and
that the amount could be held in the suspense account.
However, as part of the shortage relates to transfers
and no error notice will be issued, then the suspense
Account Team are not prepared to authorise the entry.'
So it wasn't easy for the subpostmaster, was it, you
can see here?"
And Mr Godeseth says:
"Answer: No, indeed, a horrible position to be in."
A. Yes.
Q. So the picture that emerges from the documents in the
case of Mr Alan Brown is not a rosy one, is that fair to
accept?
A. I believe so. I don't know what the suspense account
team were talking about, why they were not prepared to
do it and whether they thought some other mechanism was
right.
Q. Let's have a look at {F/300.1/1}. This is the area
manager intervention log, you can there it is
"19 September 2005 Horizon Problems".
If we could go over the page, please {F/300.1/2}.
You can see the amounts there broken down, £3,489.69
transfers, £2,870 Giro deposits, and £54,52
unidentified?
A. Yes. Do we understand these are stock transfers that
went in twice to some stock?
Q. Exactly. You see there it says:
"The Spmr claims that there was a Horizon software
problem on 14.09.05 from 15.30 onwards. This was picked
up when a member of staff noticed that a transaction,
which had been taken by another member of staff, had not
been entered onto the system, so therefore she put the
transaction through. She checked at the time with her
colleague who said that she thought she had put it
through already however she accepted that she could have
made a mistake."
Pausing there. What's actually happening here is
the fact that Horizon is not correctly displaying what's
happened is misleading the staff in the sub-post office
to make a mistake.
A. What's happening is it is not replicating properly.
Q. Yes. So just to be clear, the Horizon system is not
showing correctly what has happened?
A. Absolutely, because Riposte is not replicating when it
is supposed to.
Q. And we saw they had quite a lot of Riposte problems?
A. A lot of Riposte problems?
Q. -- chuck it over the fence to Escher?
A. I mean there are a number of PEAKs and KELs and so on
where Fujitsu say this is a Riposte problem, we need
Escher to fix it. Callendar Square is not the only one.
Q. If you look at the bottom of that paragraph, it says:
"Following on from that, it was picked up that other
giro business deposits that had been entered had not
come up on the system, so they were re-keyed."
Yes?
A. Where is that below?
Q. It is just at the end of that paragraph that we were
looking at, the big paragraph. Three lines up from the
bottom. "Following on from that", in the middle.
A. "... it was picked up that other giro business deposits
that had been entered had not come up on the system, so
they were re-keyed."
Yes.
Q. So they were re-keyed as well?
A. Yes.
Q. So that is how we got the two lots, the two numbers we
have seen.
"There was also a problem with transfers from one
stock to another, in that they had doubled up."
A. Yes.
Q. "The Spmr made several telephone calls to the NBSC,
telling them about his problems and he was advised to
carry on with balancing and produce his Cash Account."
Yes?
A. Yes.
Q. Is that what, in your expectation of how this process
should work, is that what you would expect to happen?
A. Well I don't know the detail, but in many cases NBSC say
don't try balancing, in some cases they do, and I don't
know the exact rationale for one or the other.
Q. He is told to produce this cash account.
"Whilst doing this a warning came up, however the
NBSC told the staff to continue to roll over. The result
was that the office balanced £6,414.46 short."
Do you see that?
A. That is the sum, is it?
Q. Yes:
"The Spmr spoke to the Horizon Support Centre (ref
E0509150123) who investigated and agreed that there had
been a navigation problem that had now been rectified."
A. Yes, not quite clear what that means.
Q. Then:
"They told the Spmr that they would report to NBSC
that they had identified and rectified the problem and
that the amount could be held in the suspense account."
A. Can we go back, who are "they" now?
Q. The Horizon support centre.
A. Okay. Sorry.
Q. Which is now run by Atos.
A. Yes.
Q. So:
"However, as part of the shortage relates to
transfers, and no error notice will be issued, then the
Suspense Account team are not prepared to authorise the
entry."
A. Yes.
Q. "I telephoned the suspense account team (Ann Wilde) ..."
This is an SPM being assisted here by someone at
Post Office.
" ... who told me that checks could be made with
Girobank after next Wednesday, and if that shows that
duplications have been made, then they will authorise
the amount to be moved to the suspense account, until
the office receives an error notice. However, Ann stands
by what she said about the transfer problems, and that
they would not move this amount to The Suspense
Account."
A. Yes.
Q. Is that how you think the system should work?
A. Well, there's obviously some policy about the suspense
account team and how they work and how certain things
are handled.
Q. I understand, that's obvious. I'm asking --
A. That's what Ann is quoting.
Q. But was it your understanding when you were looking --
did you even know that had happened at Callendar Square?
A. Well, it seems to me that what's happening here is --
Q. Can we just pause. Did you know about that?
A. I was not aware of this detail, no.
Q. In fact we see this in a number of the bugs, that you
are not aware of a huge amount of the detail, is that
fair?
A. The procedural side of how someone was compensated for
a bug and how this team pushed numbers around and so on,
that procedural side is outside the PEAKs and generally
not something I'm -- you know, how the suspense account
team worked, what their policy was, what you could do,
and so on, that sort of stuff I don't know.
Q. But your expectation that it won't amount to a lasting
discrepancy --
A. Yes, is that this procedure will somehow work out and
these teams will decide eventually: you do it, we do it,
we have got to do it.
Q. So you formed a view about how seamlessly or otherwise
this would work and on the basis of that view reached
your opinion about whether there would be lasting
discrepancies or not?
A. My view is that regardless of procedural issues like
this, in the majority of cases if there is
an R/P mismatch it will be sorted eventually.
Q. You formed that view without knowing how the actual
individual person at the Callendar Square branch after
whom the bug is named was dealt with?
A. I didn't know the details of this process.
Q. So the answer is yes?
A. I formed that view not knowing the details of this
process.
MR JUSTICE FRASER: Now Mr Green went through this in some
detail with Mr Godeseth. Can you just remind me, were
you reading the transcript for Mr Godeseth or were you
here?
A. I was here.
MR JUSTICE FRASER: You were here?
A. Yes.
MR JUSTICE FRASER: Okay, Mr Green.
MR GREEN: I will take it reasonably swiftly, if I may,
given that you have not looked at it in this detail.
MR JUSTICE FRASER: I do not think you need to put
everything to this witness that you put to Mr Godeseth.
MR GREEN: I'm certainly not going to do that, my Lord.
Can I identify, please, that at {F/312.1/1}, just to
take a couple of aspects of what happened. If we look
at page 2 of that log -- sorry, page 1, I do
apologise -- do you see at the top.
A. (Reads to self)
I see that's ... yes.
Is AIO area intervention -- oh, A/O? What are they?
MR GREEN: "Area intervention officer knows about it."
A. All right, as opposed to manager --
Q. If we go over the page, please {F/312.1/2} and look at
"Expand on any letter requested/clarify any point",
Do you see the second line:
"Spmr concerned that he has now made a fraudulent
entry in that he has rolled over to the next trading
period and put the loss into local suspense he has then
gone on to state that the cash has been made good, which
it hasn’t. This was done on the advice of the Helpdesk."
A. Yes.
Q. Now, that's because he is being forced to make good part
of the cash that can't go into the suspense account.
Did you know any of this?
A. It seems to be so, yes.
Q. Did you know any of it? Or should I take your answer
before, that you didn't really know this detail?
A. I haven't gone into this detail.
Q. I understand.
If we go quickly to a couple of other points and
then I will move on {F/324.1/1}. This is a telephone
contact, a response by SPM:
"Telephoned the office and Allan said that he was
having problems again with transfers. He has contacted
the Horizon helpdesk who have subsequently come back to
him to say that there is no system problem and that he
should contact NBSC."
Do you see that?
A. Yes.
Q. If we look quickly at {F/332.1/1}, "Response by SPM":
"Alan will continue to log a call each time he has
a problem. I told him that this would help to build
a case for having the alleged faulty kit exchanged."
A. Yes.
Q. Then just taking it forward before I ask you a
compendious question about these, {F/333.1/1}. Now,
this is an email chain. And can I ask you to look
please at page 11, which is where it begins
{F/333.1/11}, and that is the end of an email from
Sandra MacKay as you can see.
If we to the next page quickly, you will see this is
11 January 2006. If we go back to the email below, and
you see at the top:
"You may recall that in September the above office
had major problems with their Horizon system relating to
transfers between stock units the Spmr has reported that
he is again experiencing problems with transfers,
(05.01.06) which resulted in a loss of around £43k which
has subsequently rectified itself."
On your understanding of the Horizon system, is that
something that should or should not happen if it is
working correctly?
A. I think it should not really.
Q. No. If we go forward, please, to page {F/333.1/9}, if
you look at the bottom of that do you see:
"Since then it appears to have happened again,
although Fujitsu are saying no issue could be detected.
I am concerned that there is a fundamental flaw with the
branches configuration ..."
Do you see that?
A. Yes.
Q. So I mean I'm not going to take you through the whole
thing, Dr Worden, but if we -- you would accept,
wouldn't you, that the premise of everything being
corrected is dependent on all these processes working
properly and satisfactorily. That's uncontroversial?
A. I do not think it is quite uncontroversial because in
the process of trying to correct something, there will
be false steps, and I think you have shown me evidence
there have been false steps.
In spite of that I would expect people to persist,
as they you see them persisting here, until things are
sorted out. So false steps on the way, yes, they do
happen, but I would expect when there are false steps on
the way people will persevere until they have got to the
bottom of it.
Q. There are about 30 branches identified in the document
we have for Callendar Square.
A. Yes.
Q. And it suggests that probably 10 of them didn't have
shortfalls?
A. Mm.
Q. So that is how you have derived your figure of 20
branches?
A. Yes.
Q. Did you get a feel in your reading into this problem of
how long this problem had been around for and how many
branches it was actually affecting?
A. Well, there is a real problem about the definition of
what "this problem" is because there is the Riposte bug
and then there's certain event storms which causes
problems in replication, which may be short-term
problems for a few minutes, and then there are event
storms which make them long-term problems, and then
there's what happens in event storms and in particular
the double transfer in. So the whole of
Callendar Square is those things all happening together,
whereas I think some of the 20 PEAKs or 30 PEAKs,
whatever, are different from that, different
combinations.
Q. Let's just go forward one last message in this line of
emails, this is from Anne Chambers at {F/333.1/3}.
I assume you didn't look at this before you did your
report or before today?
A. Sorry, which one? It has not come up yet.
Q. Anne Chambers, halfway down. From Anne Chambers to
Mike Stewart, 23rd February 2006?
A. This is Anne Chambers, right, okay. I have not seen
this email, no.
Q. You have not seen it?
A. No.
Q. Because it might be quite helpful in getting a feeling
for the scale of what was actually going on. It says in
the second paragraph:
"Haven't looked at the recent evidence, but I know
in the past this site had hit this Riposte lock problem
2 or 3 times within a few weeks. This problem has been
around for years and affects a number of sites most
weeks, and finally Escher say they have done something
about it. I am interested in whether they really have
fixed it which it why I left the call open - to remind
me to check over the whole estate once S90 is live -
call me cynical but I do not just accept a 3rd party's
word that they have fixed something!"
Did you have even any conception that this was
an issue which was affecting a number of sites most
weeks for years when you formed the views you did about
the significance of this problem?
A. Well, this is exactly the point. The Riposte lock
problem leads to different things, and the Riposte lock
problem leading through to that double transfer in thing
is not the same as the Riposte lock problem.
Q. Okay. But just re-putting the question, if I may.
A. Yes.
Q. In forming the views that you did in your reports you
were unaware of this email?
A. It looks a bit familiar actually.
Q. You said --
A. As I said, my view has always been that there is a chain
of events and the Riposte lock problem, which is at the
source of the chain, happens much more frequently than
the whole chain.
Q. You were not aware of the scale of that problem as
reported there when you wrote your reports, were you?
A. I expected the scale of the source, the Riposte lock
problem, would be more extensive than the consequence
which required the event storm and required the double
transfer in and so on and so forth, and that must be
more rare than the original Riposte lock problem.
Q. Dr Worden, one last attempt. You were not aware of this
evidence about the scale of the Riposte lock problem
itself when you wrote your report?
A. I was aware of some investigations by Anne Chambers and
the fact that she was looking at this broader scope of
Riposte lock problem, I was aware of that, and I was
aware -- it was my opinion, it still is my opinion, that
the origin of the chain, the Riposte lock problem, is
more frequent, probably much more frequent than the
whole chain occurring.
Q. The KEL that was raised in 2002 and updated in 2010 is
at {F/565/1}. You did actually look at KELs, didn't
you?
A. Not in this format actually.
Q. Can you remember if you looked at this KEL in any
format?
A. I believe I did, yes.
Q. If we look at page {F/565/2}, please. February 2003,
about three-quarters of the way down?
A. Yes.
Q. "We are seeing a few of these each week, on Wednesdays
during balancing. This can lead to problems if the PM is
balancing on the counter generating the events, as it
may not have a full view of transactions done on other
counters."
A. Yes, I mean this illustrates that the cause, the Riposte
problem, has different consequences. For instance, it
stopped transfers for instance in balancing. And what
one expects, depending on the duration of the problem,
obviously an event storm that leads to Riposte failing
to replicate for a long period on some terminal is
different from the lighter cases where Riposte fails to
replicate for some short period, and maybe in balancing
you miss some transactions done in on a terminal in a
that short period. So there are all sorts of scales of
possibility there.
Q. Yes, and it varies?
A. It varies, yes.
Q. In June 2004 we see:
"This event can also give rise to transfer
problems."
Yes?
A. Yes. This is the double stock thing.
Q. If we go over the page {F/565/3}, at the top:
"This problem is still occurring every week ..."
September 2005.
" ... in one case at the same site on 2 consecutive
weeks."
A. Yes, and that might be just a subpostmaster noticing he
has a problem and saying -- ringing up.
Q. If we look halfway down or just before, do you see the
words "reboot" in capitals halfway down that large
paragraph?
A. Yes.
Q. And then you see:
"If they are in the process of balancing, it is
strongly advised that they reboot before continuing with
balancing as they are at risk of producing an incorrect
balance. Warn the PM that if transactions appear to be
missing, they should not be re-entered - they will
become visible after the counter has been rebooted."
A. Yes.
Q. Then it says:
If a reboot/Cleardesk does not resolve this problem,
send the call over for further investigation - SSC can
rebuild the messagestore on the affected counter."
A. Yes.
Q. So that ties in with what we have seen about the way
messagestore was rebuilt by SSC, yes? It is
an example --
A. Yes, it is an example of rebuilding a messagestore.
That sounds like the sort of full replication job.
Q. Now, at Mr Godeseth's second -- just before we move,
they are, at the bottom of that page, still giving
advice on this in 2010, aren't they?
A. Yes.
Q. This was going on for quite a long time?
A. This is on the message correspondence server and it is
a different thing from failure to replicate in the
branch.
Q. Yes, it is another problem but in the same line --
A. It may be the same, it may be different. I'm not quite
sure.
Q. Mr Godeseth at paragraph 15 of his witness statement, do
you remember, he relies on the list from Mr Lenton. We
see that at {F/322.1/1}. Do you remember that list?
A. I'm not there yet. (Pause)
This is the thing Anne Chambers put together,
I think.
Q. Yes. It turns out from the properties we can see it was
Anne Chambers in 2015?
A. Yes.
Q. And what's said there is:
"NB many other branches had multiple events,
preventing replication, but these are the majority of
those which came to PEAK, having either reported
a problem or it caused a reconciliation report entry."
Do you see that?
A. Yes.
Q. So this is a list of the majority retrospectively
compiled by Anne Chambers in 2015?
A. Yes.
Q. So it does not suggest, does it, nor I think does
Post Office or Fujitsu claim, that there was
a systematic problem management system in place to
collate everything into one place and produce this sort
of data automatically?
A. What do you mean by a systematic problem management
process?
Q. Well, we have seen reference to a problem management
system that was considered to be brought in, and
Post Office has given evidence that they didn't bring it
in, that would have produced information of this sort
automatically and collated it?
A. Well, no, that's a rather different document in my
opinion. The problem management document is a high
level strategic generic document about all sorts of
problems whereas this is a specific type of problem.
Q. So she is having to go back in 2015 to try and identify
the majority of branches affected?
A. Yes. Obviously I'm not quite sure of what her search
criteria were to pick these things up.
Q. But fingers crossed?
A. I don't know about fingers crossed at all, she was
a pretty competent woman in my opinion so she would not
wing it.
Q. So she says the competent woman is trying to find -- she
thinks she has got the majority of them?
A. I think she would do the best that can be done and she
has obviously picked up the receipts and payments PEAKs
that have a connection with this kind of Riposte
problem.
Q. Look at the blue box at 26:
"This set reported problems but probably didn't have
losses as a consequence."
A. Yes.
Q. And because she says they "probably didn't have losses",
that's why you have limited your number to 20, is that
right?
A. Yes.
You see lots of consequences here like frozen slow
counter and so on which PMs might report.
Q. Yes. Let's have a look at Mr Godeseth's second report
at paragraph 16, it is {E2/7/6}. At paragraph 16 on
page 6 you will see there that Mr Godeseth says:
"While the issue at Callendar Square was reported by
the Subpostmaster after he spotted a receipts and
payments mismatch, it would have been picked up in any
event by a batch process that is run every night which
picked up the mismatch ..."
A. Yes.
Q. But as we have seen, this is not something that's going
to be corrected overnight, is it?
A. I do not think so, no.
Q. You would agree that it arose, from what you have seen,
in or about 2000?
A. Yes, the first occurrence of the Riposte problem I think
was around there.
Q. And it certainly persisted until 2006?
A. I think so. It seems it wasn't finally fixed by Escher
in all that time.
Q. And it looks as if there may have been the same or
a related problem in 2010 but we don't know exactly?
A. We don't know.
Q. Do you regard this as a significant failing in the
system?
A. It is obviously significant but what one means by that
word ... It has been significant in this case,
obviously, and in my investigations.
Q. Riposte was part of the Horizon system, wasn't it?
A. It was, absolutely.
Q. Central to it and fundamental?
A. It was part of the supporting software. It was like
a database layer actually at the time.
Q. But it was very important?
A. It was very important. Replication was absolutely key
to how it did it --
Q. Now we discussed the difference, identifying the
difference between a bug that has affected one branch
and one that has affected ten?
A. Yes.
Q. And the Dalmellington bug affected 112 -- had 112
occurrences over 88 branches?
A. Yes.
Q. That is pretty significant as a bug?
A. It is significant in terms of the lasting effect is not
significant.
Q. We have your point on transaction corrections. We are
trying to focus on the system first.
A. It was a bug and it affected 112 branches, we can agree
that.
Q. Let's leave aside, if we may, your point on transaction
corrections one day correcting something?
A. Well, transaction corrections or reversals by the
postmaster in this case.
Q. Let's focus on whether the Horizon system itself goes
wrong, and taking a view about that, at the beginning of
the Callendar Square questions I asked you: it is
important, isn't it, to get a feel for whether something
has affected one branch or perhaps ten?
A. Yes.
Q. And you accepted that is a significant difference?
A. Absolutely.
Q. And it would be equally important to work out whether it
has affected ten or 88?
A. Yes.
Q. And this bug did in fact cause errors in branch accounts
that were then required to be corrected?
A. Yes.
Q. And so what Horizon was showing before it was corrected
was wrong?
A. Error correction was needed, yes.
Q. What Horizon was showing before it was corrected was
wrong?
A. Yes.
Q. Why did you not mention the number of occurrences and
the number of branches in either of your reports? Is
there a reason for that?
A. Yes, there is a reason, and the reason is because the
Dalmellington error was -- looked like a user error and
was corrected in the normal event of things, it did not
lead to Fujitsu investigations and PEAKs, and therefore
the normal mechanisms for detection -- therefore my
views about how many branches are affected and how
Fujitsu can detect the number of branches affected are
not affected by that, because Fujitsu were not called up
about Dalmellington for good reason, because it looked
like a user error of which there were 20,000 a year
which got corrected.
Q. Let's take it in stages. In trying to assess whether
there was in fact a bug in Horizon which had the
potential to affect a number of branches it is important
to look at Dalmellington, isn't it?
A. It is a useful example to look at, yes.
Q. In your appendix at {D3/2/118}, appendix D3 to your
first expert report, you are dealing with 62 KELs
referred to by Mr Coyne, aren't you?
A. Yes.
Q. And at 5.23 is the Dalmellington KEL?
A. Which I didn't recognise as Dalmellington at the time.
Q. You didn't recognise it and you hadn't been told that
there had been a Dalmellington bug by anyone?
A. Well, I had read Mr Coyne's report which had three
different references to Dalmellington but they weren't
actually connected, and the reference to this KEL didn't
say -- it was one of the three references that didn't
say it is Dalmellington, so that's why I didn't
recognise it as Dalmellington.
Q. But you didn't recognise this was the Dalmellington KEL
either, did you?
A. No, I didn't obviously. It's not there. I recognised
it was a remming KEL and so that was the basis of my
opinion.
Q. Now, you explain why you didn't recognise it in your
second witness statement at page {D3/6/43} at
paragraph 163.
You say:
"The reason I did not recognise that KEL acha621p
related to Dalmellington was that I was responding to Mr
Coyne's reference to the KEL - and in the two paragraphs
in which he referenced the KEL (paras 5.23 and 5.130 of
his report) he did not relate either of the paragraphs
to Dalmellington (addressed at his paras 5.16 - 5.19),
or to each other. It was not evident from Mr Coyne's
report that these three separate extracts all referred
to the same incident."
Yes?
A. Yes.
Q. And so what we see in your table is you say that:
"Any error will be corrected so there is no
permanent effect on branch accounts."
If we go back to {D3/2/118}.
A. Let me just read that. (Pause)
MR JUSTICE FRASER: Do you want on the common screen
{D3/2/118}, Mr Green, is that right?
MR GREEN: My Lord, yes, please.
And you are looking at 5.23.
A. Yes.
Q. And third paragraph you say:
"As above, when physical cash is counted and monthly
balancing is done, any error will be corrected."
As a result of that reasoning you conclude:
"So there is no permanent effect on branch
accounts."
A. In this case there are several safety nets. There is
the postmaster who recognises that he has done a double
rem in and he reverses one rem. That's one safety net.
Then there is the postmaster who does a cash count and
recognises his cash is wrong and does some reversal.
And finally there is a TC. So there are three safety
nets there.
Q. It is common ground that there were transaction
corrections for the Dalmellington branches or at least
most of them?
A. I can't remember the exact numbers.
Q. We will come to that.
A. The report says they were fixed by either reversal or
TC.
Q. We will come to that.
You say on your table just below there:
"The Peak implies that the problem may have been
around for some time. Some Subpostmasters spotted it and
reversed the error immediately those who did not spot it
would see the discrepancy later, when they counted cash,
and have to correct it in their monthly balancing."
You obviously had to look at the PEAK to form that
view, didn't you?
A. Well, I had a fairly general view that this is how cash
transfers and remming work.
Q. Pause there, Dr Worden. You say "The PEAK implies", so
you must have read the PEAK?
A. I did read the PEAK, yes.
Q. It is not referenced in your table which PEAK it is, but
you do reference other PEAKs. Is that just
an oversight?
A. Just an oversight.
Q. Let's look at the KEL at {F/1426/1} please. You see the
problem described there?
A. Cash remmed in; recorded; yes.
Q. "... received at an outreach branch and scanned into
Horizon. The manual process was followed and 2 Delivery
Receipts printed."
Yes?
A. Yes.
Q. In the middle:
"They were then able to press Enter again and
another Rem In slip was printed -- And the same amount
of cash was recorded a second time."
A. Yes.
Q. "They may have repeated several times before using
Cancel to escape, resulting in much more cash being
recorded on the system than they actually have."
A. Yes.
Q. You see at the bottom:
"Known problem should now be fixed so any further
occurrences need to be investigated - send call to
Peak."
A. Yes.
Q. "Outreach branches can avoid the problem by making sure
that they do not press Enter again after they have
printed both Delivery Receipts and the Rem In slip - if
they find the Rem In screen is still displayed,they
should press Cancel to get out of it, ignoring the
mental that not everything has been printed."
Pausing there. The system is telling them that
nothing everything has been printed which is why they
are progressing rather than --
A. The system is misleading them.
Q. Correct. And it says:
"However they are unlikely to notice immediately
that they are on the wrong screen, and will probably.
Have duplicated the Rem In before realising
something is wrong."
A. Yes.
Q. It says:
"We have seen some outreach branches apparently
resolve the problem by remming out the excess amount but
NBSC should advise on this. The cause of the problem is
being investigated but it will not retrospectively
correct the accounts at affected branches."
A. Yes. I think that is the usual statement that, fixing
the code, we will do it in future but not for the ones
that have already suffered from it.
Q. At this stage you had seen the KEL. This doesn't
actually say that transaction corrections will be
issued, does it?
A. KEL doesn't say that. No.
Q. No. So on what basis when you were looking and writing
your report did you know that these had all been
addressed by transaction corrections?
A. Well, at some stage I read the document which says here
are 112 and so many had been fixed and so on and that
was explicit, but before that my expectation was that
this is how remming happens. There are 20,000 remming
TCs per annum, therefore, my expectation is that that
would have happened.
Q. So you inferred from a KEL that didn't say it that
transaction corrections would be issued?
A. I mean very often one has to infer from KELs things that
are not said. They are written by people who know
things that we don't know and they are not sort of
written for us.
Q. You have spread that across other KELs which don't
mention transaction corrections and reached the same
inference, haven't you?
A. I have made that same inference in several cases, yes.
Q. And Mr Coyne found this bug by chance, didn't he?
A. I can't remember.
Q. Let's look at {D2/1/58}, paragraphs 5.16 to 5.19 on
page 58. Here you can see there the Dalmellington bug
at the foot of the page?
A. Yes.
Q. £24,000 discrepancy. Over the page {D2/1/59} we can see
at 5.19 he concludes that:
"The fact that Atos made a change to the Horizon
system to prevent re-occurrence is therefore consistent
with this being a software bug."
A. Atos made a change to the Horizon system is a bit
peculiar, but it is consistent with the fact that there
was a bug(?).
Q. So what Mr Coyne was doing was trying to identify
whether there had in fact been a bug or defect in the
Horizon system that had the potential to impact branch
accounts here, yes?
A. Yes.
Q. And he seemed to think that that was relevant and he was
right about that for that question?
A. Well, I was looking for bugs which had a lasting effect
on branch accounts and therefore we had different
criteria.
Q. If we look at {F/1394/3}. You can see there that it
says:
"Please can you help. A very strange case."
October 2015. You can see it says there:
"... the remittance team in Chesterfield are aware
of this fault and can issue a transaction correction for
the 'extra' remittances... They can see that the one
barcode accepted the £8000 remittance four times (even
though there was one item). They are unable to issue a
transaction correction to her Outreach as it doesn't
have a unique number. My understanding is that they have
told her if she rems out to her core branch the
non-existent £24,000 loss this error has created, they
will correct/remove it from her suspense account."
So they are well aware of this in 2015 and if we
look please --
A. This is the Chesterfield team.
Q. Yes. If we look please at {F/1425.1/1}. I'm not going
to take you through this Dr Worden, but had you looked
at this email before you wrote your report?
A. It doesn't look familiar to me I must admit.
Q. Let's go forward to {F/1495.2/1} please. This is
an email looking into effectively the Dalmellington
error which you see halfway down:
"Subject: The Dalmellington Error in Horizon."
A. Yes.
Q. It says:
"Dalmellington error in Horizon [then a vertical
slash mark, then all one word] "problemswithpol". It is
referring to a blog by Tim McCormack campaigning against
PO and Horizon.
A. Yes.
Q. It says the blog is independent from Sparrow but clearly
related and so forth --
A. Sorry where are we?
Q. Bottom paragraph --
A. Sorry, I haven't got that blog independent paragraph.
Where are we?
Q. It is the bottom of the page.
A. Right. "Independent of Sparrow" whatever Sparrow is.
Q. It says:
"I'm most concerned that we/our suppliers appear to
be very lax at handling £24k. And want to know we've
rectified all the issues raised, if they happened as Tim
explains."
A. Yes.
Q. Then --
A. That's chief exec.
Q. Yes and then what's happening there is, second from the
top, an urgent review and then at the very top:
"Can you stand down on this please?"
A. So Sharon Gilkes says "Can you stand down?"
Q. Yes.
A. I don't know who -- sorry, the top email, who is it
from?
Q. It is from a chap called Rob --
A. That's Rob Houghton, right. Both of them from him.
Yes.
Q. So it is clear that at least through 2015 and 2016 there
was a considerable amount of investigation into this?
A. Yes.
Q. Were any of the documents about the investigation into
Dalmellington drawn to your attention in your
instructions?
A. No.
Q. Was Mr Coyne's first report the first time when you
learnt of the Dalmellington bug?
A. I think it must have been. Obviously I had seen the KEL
and I had formed the opinion it wasn't a lasting bug,
when I equated the two then --
Q. Your first report was 7th December 2018?
A. Yes.
Q. The second witness statement of Mr Godeseth and the
first witness statement of Mr Parker were
6th November 2018 and you had had sight of those before
you wrote your first report?
A. Yes.
Q. 16th November 2018 was their witness statement?
A. Yes, that is right. It was quite close to the wire in
terms of getting a report together.
Q. When you get things close to the wire it can cause
difficulties, can't it?
A. Yes.
Q. You get hundreds of thousands of KELs or PEAKs or that
sort of thing?
A. Well, those witness statements were quite close to --
Q. I see. Do you remember whether you considered them
before you did your first report?
A. I did consider them, yes, I'm saying it was --
Q. You specifically relied on them in relation to various
issues, didn't you?
A. I think I did.
Q. Mr Godeseth gave in his second witness statement
evidence on four bugs, Callender Square, receipts and
payments mismatch, local suspense accounts and
Dalmellington, didn't he?
A. Yes.
Q. Mr Godeseth's second statement at {E2/7/9},
paragraph 34, he says:
"Bugs:
"In addition to the Callendar Square issue I have
been asked by Post Office to explain how the following
three bugs came to light and were resolved."
A. Yes.
Q. "The receipts and payments mismatch in September 2010.
"The local suspense account issue in 2011;
"and an issue which occurred at the Dalmellington
branch in October 2015."
A. Yes.
Q. So he had been asked by Post Office to explain that in
addition to Callendar Square. There had been three bugs
one of which was Dalmellington?
A. Yes.
Q. And you expressly relied on Mr Godeseth's evidence in
relation to those three bugs, didn't you?
A. Mr Godeseth's evidence on Dalmellington really didn't
add much to my previous view that it was a remming
problem, these would get corrected by TCs and that's --
remming problems in my mind don't generally lead to
lasting effects on branch accounts.
Q. Will you accept from me, Dr Worden, that you expressly
relied on Mr Godeseth at paragraph 649 of your witness
statement?
MR JUSTICE FRASER: Expert report.
MR GREEN: I'm so sorry.
A. Can we go to 649 and see what it is?
Q. Certainly. {D3/1/153}. 649.
A. "... and reaches conclusions similar to my previous
conclusions."
Yes.
Q. Yes and you then refer again to him in relation to
receipts and payments mismatch?
A. Yes.
Q. Paragraph 650.
A. Yes.
Q. And then in relation to Callendar Square we saw you have
done the same thing at paragraph 667, which I do not
think we need to go to.
A. Yes.
Q. And suspense account bug paragraph 681 {D3/1/160}
MR JUSTICE FRASER: You are going quite quickly.
MR GREEN: Sorry, my Lord.
MR JUSTICE FRASER: Just out of fairness to the witness.
MR GREEN: The short point, Dr Worden, is you go through
every bug in Mr Godeseth's witness statement apart from
the Dalmellington bug which affects 88 branches, despite
relying on his witness statement expressly for the other
three, why is that?
A. Because my opinion has been since long before that that
this was not a bug with a lasting effect on branch
accounts and therefore, in terms of the scope of my
investigation, was not an important bug because it
doesn't leave a subpostmaster with a lasting shortfall.
Q. But it was an important bug because of the scale of the
branches it affected which then required corrections?
A. Well it affected this 100 and so branches that is
correct.
Q. And that was an important number to have a feel for to
look at the scale of branch impacts that are possible
from bugs in Horizon?
A. No, it is not because I'm looking at the scale of impact
from bugs that don't look like something that's normally
corrected. If something is normally corrected then the
investigation of it will not lead to the same result as
something -- you see what I mean? Something that's --
the other three, there's real discrepancy and had to be
investigated. The Dalmellington one never came to
Fujitsu for a good reason.
Q. Let's have a look. {F/1415/1} we have just got time to
look at this. This is the Fujitsu presentation and did
you see that presentation?
A. I have seen that one, yes.
Q. On the first page it is for "PO's internal purposes
only", confidential.
On the second page {F/1415/2} two potentially
separate issues at play, the combination of which may
lead to the scenario above. Yes?
A. Yes.
Q. On the third page {F/1415/3} clear findings about 112
occurrences?
A. Yes.
Q. And detail there. Do you see at the bottom:
"4 items still to be confirmed."
A. Yes.
Q. Then on page {F/1415/7} we see "Detailed Preliminary
Findings"?
A. Yes, this is the by year findings.
Q. By year. 65 incidents in 2010 to 2011. On page
{F/1415/8} we can see 0 calls raised with Fujitsu.
A. Yes.
Q. 0 calls raised with Fujitsu, 2012. 2013, 0 calls raised
with Fujitsu and that's where we pause and see two
unknown outcomes: value £25,000 and £2,500. Did you
notice that when you were doing your report, Dr Worden?
A. When I was doing my report it seemed to me that the main
point was that 108 out of 112 were corrected as part of
the normal process. I was therefore not so concerned
about the two which there has been a lot of subsequent
discussion about and I believe has now turned out to be
a different effect.
Q. Well, can you just answer the question just quickly.
When you were doing your report, did you notice that
there were two unknown outcomes, one of £25,000 and one
of £2,500?
A. Well, I read this document and I must have noticed it
but, as I say, my feeling of the importance of it in the
context of the overall analysis of remming bugs was not
important because things at the edge of a sample -- a
sample of 108, four things at the edge, it is difficult
to know what the detail to those four cases are, so
I was concerned with the majority.
Q. Dr Worden, if you had seen and noticed those figures,
you should have included this bug in your report for two
reasons: (1) the large number of branches affected (2)
the size of the two unknown outcomes, do you accept
that?
A. No. The large number of branches affected is similar to
the large number of branches affected by manual remming
errors, much larger number. So I don't have to -- no,
the fact that some software errors look like human
errors and those human errors are corrected, very much
alters the significance of different errors, and I was
concerned with the overall significance of Dalmellington
and my opinion was and remains that remming errors get
corrected.
MR GREEN: My Lord, is that a convenient moment?
MR JUSTICE FRASER: I think it is. Thank you very much
Dr Worden.
I did give Mr de Garr Robinson this opportunity on
his last day, do you want to start at 10.15 am tomorrow
or do you think 10.30 is adequate?
MR GREEN: I think 10.30 should be adequate.
MR JUSTICE FRASER: Dr Worden, we are going to start again
at 10.30 tomorrow. I'm now going to listen to -- who
knows it might be a couple of minutes, it might be
slightly longer about disclosure. There's no need for
you to wait because quite frankly I don't know how long
I would be asking you to stay, so why don't you just --
A. I shall slack off.
MR JUSTICE FRASER: I would not put it quite like that. By
all means you can go and we are going to revert to the
point that Mr Green started trying to make this morning.
Right.
Discussion
MR JUSTICE FRASER: Right, Mr Green.
MR GREEN: My Lord, there has been an additional thread
added as you may have appreciated during the course of
today, which is that at 1.02 pm we got the ARQ figures.
The only missing year -- we were told up to 2014, they
run back to 2004. We discovered that there was
a missing year.
MR JUSTICE FRASER: What year was that?
MR GREEN: Up to 2013.
MR JUSTICE FRASER: Is that what you were given today?
MR GREEN: That's what we have got. Sorry, the year is 2013
to 2014 is what I meant to say, I may have said the
wrong thing. It turns out that -- we have had to press
for that. It turns out there were more than the
allowance of 720 ARQs in that year.
MR JUSTICE FRASER: Used?
MR GREEN: Used. More than that number requested. But as
Dr Worden doesn't know about that I didn't put those
figures to him. Then, the matter which I raised this
morning is the letter, which I understand I think may
have been sent to the court as well.
MR JUSTICE FRASER: I will tell you what I saw about that.
I saw an email from you which was pursuant to a request
I had just made about some references and then I read
the letter which came in as a result of your email and
that's about I think the extraction of data into a more
usable form which went in the WBD document and that is
MSC data which was disclosed anyway, is that right?
MR GREEN: My Lord that's absolutely correct. It was
disclosed in separate spreadsheets and then as I hope
I correctly and accurately explained to the court it was
then disclosed to us in a new and different form.
MR JUSTICE FRASER: I understand.
MR GREEN: Putting content from different documents into one
document and I cross-examined on the difference between
the two.
MR JUSTICE FRASER: I understand. That's what you wanted to
mention this morning?
MR GREEN: I wanted to make sure there was no
misunderstanding. From our perspective that is under
CPR 31.9, those are new documents in the same way that
the copy with the manuscript edition that someone wants
to rely on is a new document because they have come from
three different disclosed documents and they have been
put together and the way in which they have been put
together differs and we rely on the difference.
MR JUSTICE FRASER: All right. But if and insofar as that
is a point, that's a point for submission, argument and
for me, it doesn't affect the cross-examination.
MR GREEN: It was just to explain why --
MR DE GARR ROBINSON: It doesn't, my Lord, but I would
welcome the opportunity to explain. My learned friend
during the course of his cross-examination has on
a number of occasions said that documents have been put
in the trial bundles.
My Lord your Lordship will appreciate that's been
happening more or less on a continuous basis by both
sides throughout the entirety of this case.
Those MSCs, they were inserted as a result of my
request.
MR JUSTICE FRASER: Which I understand from the letter to
put it in a usable form, is that right?
MR DE GARR ROBINSON: Exactly. My Lord what happened was in
Mr Coyne's second report, I think, you will forgive me
if I can't remember particular paragraphs, but
paragraphs 3.315 and 5.242 spring to mind, it might be
5.424.
MR JUSTICE FRASER: You are just showing off.
MR DE GARR ROBINSON: It is a memory test.
MR JUSTICE FRASER: But at two places in the report?
MR DE GARR ROBINSON: Mr Coyne referred to MSCs that were of
interest to him or to PEAKs that were of interest to him
that related to MSCs.
My Lord, I asked for the data relating to those MSCs
to be extracted from the spreadsheets because I'm not
very good with spreadsheets, frankly. I find the
smallness of the text very difficult. My instructing
solicitors therefore downloaded that data which
everybody already had onto clean documents so that they
could be easier to deploy. I rather optimistically
thought I would have the opportunity and time to
cross-examine Mr Coyne about the MSCs and the issues
that he was discussing and so I asked for those
documents, which as I say just clarified data that had
already been disclosed, and indeed was already in the
trial bundles. I asked for those to be put into the
trial bundle.
As it turns out my optimism proved unfounded, I ran
out of time, so I didn't have the opportunity to
cross-examine him on his report.
So my Lord to the extent that there are any dark
intimations being conjured up by this process, I'm fully
responsible and I was trying to be helpful and I believe
had I had an opportunity to cross-examine Mr Coyne, it
would have been helpful.
MR JUSTICE FRASER: So the short points are: the data in
those MSC documents was already available in disclosed
documents but in spreadsheet form; they were put
together in a more usable form for cross-examination
purposes; and there are no dark intimations.
MR DE GARR ROBINSON: Indeed.
MR JUSTICE FRASER: I have that. Thank you very much. That
was included, effectively, in the letter but of course
it is very helpful to have it explained.
MR DE GARR ROBINSON: There are conspiracy theories often
suggested and I was quite concerned to scotch that
particular one.
MR JUSTICE FRASER: That's entirely understood. Thank you
very much.
Mr Green, anything more to say about that?
MR GREEN: My Lord you will appreciate from the
cross-examination our concern was there was a key
document which missed out the bad bits and they are put
together in different ways.
MR JUSTICE FRASER: No, I understand. There is a point I'm
going to raise with both of you about disclosure but it
is not this point, but so far as the cross-examination
of this witness is concerned, the exchanges this week
have taken us where they have taken us and it is
irrelevant -- I beg your pardon -- it is not going to
affect what happens tomorrow, let's put it that way?
MR GREEN: Exactly.
MR JUSTICE FRASER: Because the timetable of this trial has
already been affected by one or two other matters and
that's my main concern.
My second concern -- I shouldn't say concern but
given the point has been raised I'm going to address it
now rather than tomorrow. In Mr Coyne's
cross-examination he was asked about OCPs and OCRs and
in re-examination it was said, I think, that there were
two and a half thousand that were very recently
disclosed and -- I have got the note somewhere -- that
was also one of those eventful days in late May, is that
correct?
MR GREEN: No. That was 18th April, my Lord. So mid-flow.
MR JUSTICE FRASER: Right. Now did that come with
a covering letter?
MR GREEN: I think it may have done. My Lord would you like
us to send you the reference?
MR JUSTICE FRASER: No, what I would like to do is just
explore now, firstly with Mr de Garr Robinson,
a quantity of documents of that number coming at that
stage in this trial requires an explanation.
MR DE GARR ROBINSON: Yes. Perhaps I can give it now?
MR JUSTICE FRASER: Well, you can but by all means don't
feel obliged because I'm going to ask for a witness
statement, but by all means tell me the explanation.
MR DE GARR ROBINSON: My Lord, the position is this: the
OCPs and OCRs are maintained on the Fujitsu system and
they were disclosed when they were disclosed back in
January. My Lord, so far as Post Office were concerned
that was that. Then much later Fujitsu discovered
an old database that had been copied more than ten years
previously on a system somewhere and told Post Office
that they had found this collection of documents.
Post Office, within a matter of days, realising they
were disclosable, I'm not sure there was any order for
disclosure but realising it was appropriate for those
documents to be disclosed voluntarily in the way that
the previous OCPs and OCRs had been disclosed, Post
Office immediately wrote to Freeths in order to explain
that they had learned from Fujitsu that this unexpected
cache of OCRs -- it should be remembered we are talking
about OCRs not OCPs, these aren't document relating to
changes which might have been made directly to branch
accounts -- but that information was provided as quickly
as could be done and, my Lord, as I say, the rest is
history.
MR JUSTICE FRASER: Right. And that's what led to the
documents being provided on the 18th April?
MR DE GARR ROBINSON: Yes.
MR JUSTICE FRASER: Let me put myself neutrally, it does not
necessarily surprise me that they have come from Fujitsu
rather than documents that the Post Office already had,
but it seems to me a witness statement of explanation is
required for my purposes. I have looked in the H bundle
and I have not found a letter which explains that
situation to me the way you have explained it.
MR DE GARR ROBINSON: There is correspondence about this.
MR JUSTICE FRASER: I have seen quite a bit of
correspondence about it but I rather ran out of steam
when I had looked at about 10 or 20 letters.
MR DE GARR ROBINSON: That is entirely forgivable if I may
say so.
MR JUSTICE FRASER: I'm not going to impose a draconian
deadline on you and it is not going to affect tomorrow
at all, but I would like please a witness statement of
explanation about that tranche of disclosure.
The MSC cross-examination creation document scenario
doesn't bother me in the least. I used to do the same
myself and sometimes data that's already in documents is
more usefully packaged in different forms. I don't
intend to say anything more about that. Mr Green can
explore that if and when he wants, when he makes his
closing submissions if he feels he needs or wants to.
But the disclosure of those documents, albeit coming
from Fujitsu, I would like a witness statement to
explain that.
MR DE GARR ROBINSON: My Lord, that will be done. Can I say
two things. Ms Keating has very helpfully drawn my
attention to two H documents which may be helpful for
your Lordship's purposes.
MR JUSTICE FRASER: Yes.
MR DE GARR ROBINSON: {H/263/1} and {H/273/1}. And my Lord
deadline for the witness statement?
MR JUSTICE FRASER: It is not going to be before noon next
Wednesday. But what I would like it -- I'm not going to
dictate all the information that needs to be included --
but I would like to know the dates when the
Post Office's solicitors or the Post Office was told and
in accordance with the rules of the CPR, if the
information is coming from Mr X or Ms X at Fujitsu, it
should say "I was contacted by Mr X or Ms X". It should
not say --
MR DE GARR ROBINSON: Sources of information.
MR JUSTICE FRASER: Well in modern witness statements now
often one just finds "I understood from company X" and
that's not good enough. 12 o'clock next Wednesday is
fine. We will put that in its own separate box for the
moment.
MR DE GARR ROBINSON: Thank you.
MR JUSTICE FRASER: There is one other point since we are
having a sort of general round up and this isn't for
tomorrow and it is probably not even for the closings,
save the end of day 2 of the closings. There are two
case management conferences in the court diary for this
case going forward still from the timetable as it was
set down before March. I will just remind you what they
are. One is 23rd July and one is 18th September.
They were directed as part of what was the intended
2019 progress of this action which has obviously not
unfolded exactly as one would have expected and at the
end of day 2 of the closings I think we are just going
to have to have a brief stock-take about the shape of
the remainder of this calendar year, and I was going to
mention again that tomorrow but on the basis we are
dealing with other matters, I thought I would mention it
to you now. Neither of you need to say anything about
it, but it is just something we have to think about.
So 10.30 am tomorrow. Thank you very much.
(4.41 pm)
(The court adjourned until 10.30 am on Friday,
14th June 2019)