Thursday 13 June 2019

Horizon trial day 19: No One Is Getting In A DeLorean

Dr Emmett Brown
There were two big issues raised today by Patrick Green (QC for the claimants) in his cross-examination of Dr Robert Worden, the independent IT expert contracted by the Post Office to look into the Horizon issues raised in this trial.

The first was the information Dr Worden might have factored into his statistical model which he either chose not to consider, mistakenly failed to consider, or simply wasn't told about.

This was striking when Patrick Green was pressing him on transaction corrections. Transaction corrections are issued by the Post Office to individual branches, groups of branches or the entire network of Post Office branches in order to correct something which has gone wrong.

If a bug or user error causes a branch to be £500 out of pocket (or in surplus), once the bug or error has been flagged and examined, a Transaction Correction or TC is manually issued to the branch via Horizon, which the Subpostmaster accepts into her or his branch accounts by pressing a button on ;her or his screen and all is made good. Or at least, that's the theory. There are hundreds of thousands of transaction corrections issued every year.

"We have got to do it"

Mr Green wanted to know on what basis Dr Worden assumed that errors, having either been picked up in branch, automatically or by some manual process would be made good via a transaction correction. The answer was revealing:

DW: "The procedural side of how someone was compensated for
 a bug and how this team pushed numbers around and so on, that procedural side is outside the PEAKs and generally not something I'm... you know, how the suspense account team worked, what their policy was, what you could do,
 and so on, that sort of stuff I don't know."
PG: "But your expectation that it won't amount to a lasting discrepancy."
DW: "Yes, is that this procedure will somehow work out and
 these teams will decide eventually: you do it, we do it, we have got to do it."

Go Post Office!

and...

PG: "You inferred from a KEL [Fujitsu Known Error Log] that didn't say it that
 transaction corrections would be issued?
"
DW: "I mean very often one has to infer from KELs things that
 are not said. They are written by people who know things that we don't know and they are not sort of written for us."
PG: "You have spread that across other KELs which don't
 mention transaction corrections and reached the same inference, haven't you?
DW: "I have made that same inference in several cases, yes.
"

You might think this is a perfectly innocent expectation, but it assumes motivation and competency. Which really does boil down to the whole point of this litigation. The claimants contend that when there was a problem with Horizon, they didn't get a transaction correction (or much other help) to solve it. Dr Worden appears to have assumed they did and used it to inform his conclusion that the claimants are wrong.

Mr Green made the point that the Post Office didn't have a huge incentive to do issue transaction corrections which favour a Subpostmaster, given:

a) it was much easier and much more cost-effective to "pressure" Subpostmasters to cover the cost of bug, error or defect by making it good themselves.

b) there was a possibility that any branch discrepancy could end up in the Post Office's own suspense account, which after three years is then funnelled into its overall profit and loss account.

Giant admin cost

It led to this interesting exchange:

PG: "If Post Office was gaining money at the expense of Subpostmasters... that in itself would not be an incentive to try and
 give the money back, would it?

DW: "Well, I was asked to consider Post Office's motivations,
 and in that context I think that one of Post Office's
 motivations is to keep down the administrative problems
 of things recurring and not being sorted, and if you
 don't sort the discrepancy and the postmaster keeps
 coming back and so on, your admin costs will soon rise.
 So it is a complicated... there is a lot of motivations
 at play there.
"
PG: "There are a lot of motivations at play. If
 Subpostmasters are, let's say hypothetically, pressured to pay regardless of who is at fault and they just pay
 up because of the way they are asked, hypothetically,
 that reduces your admin costs a lot, and if they have
 suffered a loss you don't have to give the money back,
 so that meets two objectives?"
DW: "That is part of the trade off. There will be the ones,
 as you say, that just knuckle under and take it, and the
 ones that keep banging the table will cost you a lot of 
money.
"

It made me wonder if this trial is the giant admin cost caused by a failure to fix problems when claimant Subpostmasters were having them.

The second big issue was about the assumptions and estimates Dr Worden relied on when he came to his conclusion that the chances of any claimant being affected by any meaningful bug to be vanishingly small, something which weirdly coincides with the Post Office's argument.

Mr Green explored a few of them this morning - in particular a calculation Dr Worden had made about the chances of a Transaction Correction being issued in error. It's this that led to everyone suddenly thinking about Dr Emmett Brown.

Dr Worden accepted that TCs could be issued in error, and on the basis of figures provided to him by Post Office (which in cross-examination transpired to be a guess) concluded that for the average erroneously issued TC costs each branch in the network £6 per month, averaged down to £2 per month for claimant branches (based on the the size and number of transactions they processed).

Twitter gets involved

Dr Worden used this calculation in his second report to inform his conclusion that erroneous transaction corrections could notbe the source of claimants' problems.

Mr Green picked up Dr Worden's logic and asked him about Naushad Abdulla, one of the lead claimants in the Common Issues trial. Now we know that Mr Abdulla had erroneous transaction corrections of £1092 issued to him twice in two months.

Mr Green and Dr Worden agreed that if the two transaction corrections had no correlation (ie they weren't issued for the same or related reasons, which could affect their statistical probability) there was a 1 in 500,000 chance of this happening.

Amazingly, it happened to Mr Abdulla. Yet this was not used by Dr Worden as a way of evaluating his calculations. Dr Worden didn't look at what had actually happened to claimants.

"Why?" asked Mr Green asking Dr Worden to think about his Penny Black analogy from Tuesday.

Mr Green did not take Dr Worden through the analogy again, but chose instead to use one posited on twitter by Professor Steven Murdoch, a Royal Society Research Fellow who has been following this trial:



Dr Worden was not impressed. He accepted that claimants being special in some way was important, but said it was "not a material factor
 in whether Horizon during your tenure caused bugs.
"

Mr Green pushed back: "Dr Worden, just because you join [the claimant group, it] doesn't mean that
 we go Back to the Future with the professor in the
 DeLorean and Horizon causes problems in the past."

Dr Worden stood his ground: "They have self-selected.
... the causation is back to front, and causation
 is what's at issue here.
"

Dr Worden has taken a view of Horizon as a whole. After all, the Horizon issues don't require him to look at specific users of the system.

Mangoes

But I can also appreciate how the claimants have problems with his approach. If some people are being murdered in the corner of a 1,000,000 acre swamp, there is nothing bad happening in 99.999% of the swamp. The mangoes are growing, the sun is shining, the air is humid. The whole eco-system is working as it should. But there are still people being killed in the corner of the swamp.

Someone who has a vested interest in growing and selling mangoes may want to focus on the success of the mangoes across 99.999% of the swamp. Those more concerned with people being killed will take a different view.

Dr Worden's final day of being cross-examined begins at 10.30am tomorrow, Friday 14 June. I'll be live tweeting here. I hope you can join me.

PS Just before lunch, the judge noted, with measured amusement, that the transcribers, in their realtime transcription of the day's proceedings, had spelt DeLorean "De Lorey Yum". He asked that counsel ensure the correct spelling be supplied for the unperfected transcript. 

*******************
If you can, please help keep this crowdfunded public-interest journalism project going by chucking a few quid in the tip jar below. Contributors who give £20 or more will start receiving regular "secret" emails which have all the info and gossip about this litigation as it makes its way through the courts.

If you want to find out a little bit more about the underlying story, click here.
Choose an amount

Horizon trial day 19: transcript

This is the unperfected transcript of proceedings on Day 19 of the Horizon High Court trial, part of the Bates and others v Post Office group litigation.

Today was the second day of Dr Robert Worden's cross-examination. Dr Worden is the independent IT expert contracted by the Post Office to look into the Horizon issues.


Transcript follows:

                                       Thursday, 13th June 2019
   (10.30 am)
                      DR WORDEN (continued)
            Cross-examination by Mr Green (continued)
   MR DE GARR ROBINSON:  My Lord, housekeeping.  Bundle of
       PEAKs and KELs referred to during Mr Coyne's
       cross-examination with, I believe, an index.  Could
       I hand that up to your Lordship?
   MR JUSTICE FRASER:  Of course.  Thank you very much.
       (Handed)
           So that's those referred to last week.
   MR DE GARR ROBINSON:  Last week.
   MR JUSTICE FRASER:  The one that I handed back, which was
       referred to in the evidence of fact, what's happening
       with that?
   MR DE GARR ROBINSON:  My Lord, that was handed up I think to
       your clerk at close of business on Tuesday.  So you
       should have that.
   MR JUSTICE FRASER:  I see, yes.
   MR DE GARR ROBINSON:  My instructing solicitors went through
       it and put in a proper index.
   MR JUSTICE FRASER:  You are right --
   MR DE GARR ROBINSON:  So you should now have --
   MR JUSTICE FRASER:  So I have now apart from this week,
       which one wouldn't necessarily expect.  That's very
       helpful.  Thank you very much.
   MR GREEN:  My Lord.  Just one very quick point before we
       resume, if we may.  There was a letter that I think may
       have been copied to the court sent by Wombles yesterday
       about the status of the recently disclosed documents
       which include information from the MSC spreadsheets
       which were disclosed on 21 December.
   MR JUSTICE FRASER:  Yes.
   MR GREEN:  And what is being said there is that from the
       email that I sent the court --
   MR JUSTICE FRASER:  Well, I have read the email and I have
       read the letter.
   MR GREEN:  I'm most grateful.
   MR JUSTICE FRASER:  Do we need to pursue this now rather
       than at the end of the day, given we have Dr Worden
       there, or do you want to --
   MR GREEN:  I'm happy to do it at the end of the day.
   MR JUSTICE FRASER:  If it is not going to affect what
       happens during today, I think the best thing, if you
       have any points arising on that, we will revert to it at
       the end of the day.  Let's get on with the
       cross-examination of the witness.
   MR GREEN:  I'm most grateful.
   MR JUSTICE FRASER:  All right.
   MR GREEN:  Dr Worden, could we look first please at {C1/1/1}
       which is the Common Issues.
   A.  The Horizon Issues, right.
   Q.  Sorry, the Horizon Issues, I do beg your pardon.  The
       Horizon Issues agreed list.
   A.  Sorry, could I just put in one thing first?  I would
       like at some stage, at your convenience, at any time, to
       make two corrections to the evidence I gave on Tuesday.
   MR GREEN:  My Lord, is it convenient to do that now?
   MR JUSTICE FRASER:  I would have thought it is quite
       important to probably deal with them first.
   A.  Right.  The corrections are concerned with the issue of
       claimant branch sizes, which if you remember we spent
       some time on, and there are two points in which, looking
       back at my evidence, I think it needs to be corrected or
       improved.  Those points are in the transcript at
       pages 183 and 181 {Day18/181:1}.  You will recall that
       at the time I said I was not very clear about what I had
       done because the history is, as you well know, that
       I addressed the issue of claimant branch sizes both in
       my first report and in my supplemental report and the
       calculation of claimant branch sizes for my first report
       was done about nine months ago, and for my supplemental
       report, I have looked it up, and the calculations were
       done six months ago.  And I will admit, I had not gone
       back and refreshed my memory about these before Tuesday
       but obviously I did so yesterday.
           There are two issues on which I would like to
       correct my evidence.  One is the factor 1.7 where, as
       you recall, we were discussing the distinction
       between -- what are they called -- customer sessions and
       transactions, and I mentioned I was uncertain about this
       factor 1.7.  And I shouldn't really have mentioned that
       because the uncertainty I had about the factor 1.7 was
       some time earlier than my first report, and by the time
       of my first report I had satisfied myself in my mind
       what the factor 1.7 was and it has nothing to do with
       the distinction between transactions and customer
       sessions.
           Now, my opinion at the time of my first report was,
       and it is now, that there are three terms in use.  There
       are customer sessions, there are transactions and there
       are baskets, and my opinion is they all refer to the
       same thing.  And particularly if you look at all the
       stuff there is about recoverable transactions and
       cancellable transactions, it becomes quite clear to me
       that a customer session is the same thing as
       a transaction.
           Now, the figure 1.7 was a figure I had come across
       earlier in a document which I think is TD Arc 0039, and
       I think it is called Horizon Architecture Summary, or
       something.  We could go to that.  But the reference to
       that is 1.7 is the average number of products which
       a customer buys in a basket and we could find that
       reference if you like.
   MR JUSTICE FRASER:  So the first correction is the 1.7 that
       you referred to on Tuesday is the average number of
       products which a customer buys in a basket.
   A.  Yes, it is nothing to do -- and I believe that customer
       session and transaction is the same thing.  So that is
       the first correction.
   MR JUSTICE FRASER:  And the second correction?
   A.  The second correction is a sort of history one, that
       Mr Green took me to the Angela Van Den Bogard
       spreadsheet and pointed out that there are only I think
       496 lines in the spreadsheet whereas there are 561
       claimants, and so this would make a difference of
       approximately factor 10 -- 10%, sorry, a difference of
       10% approximately to the answer.
           Now what I would like to clarify there is that in my
       first report I did make a mistake.  I did not take
       account of the fact that there were only 496 lines in
       the spreadsheet but there are 561 claimants.  Now,
       I have since gone back and looked at the calculation
       which I made on December 28th, I got the spreadsheet for
       the supplemental report, and it is evident from that
       spreadsheet that I did the summation of the number of --
       it is a different calculation because it is three
       different years and it is done differently and so on,
       but it is evident from the spreadsheet that for each of
       those years I actually did the sum of the number of rows
       in the spreadsheet, so I corrected that error.
           So the result was that while I thought the
       difference, the change in my answer from 0.37 to 0.45,
       which is a 21% change, I think, while I thought that
       change arose from my change of method, in fact it arose
       partly from my correcting that error.
   MR JUSTICE FRASER:  Right, Mr Green.
   MR GREEN:  Well, we may have to come back to some of those
       points.
   A.  Absolutely yes.
   Q.  Let's start with a simple one.  You are saying now that
       you have reflected overnight on what was put to you
       yesterday about the difference between transactions and
       sessions?
   MR JUSTICE FRASER:  Tuesday.
   Q.  Sorry, yes, on Tuesday, about the difference between
       transactions and sessions, that they are the same?
   A.  I believe and I believed at the time of my first report
       that they are the same, yes.
   Q.  And the problem with thinking something that's
       completely wrong is that it undermines the basis of any
       calculations that you thereafter make on that basis, in
       theory, if you were wrong?
   A.  I had an uncertainty in my mind well before my first
       report.  What I'm saying to the court is that by the
       time of my first report that uncertainty was cleared up
       and is my current opinion.
   Q.  I'm struggling slightly, Dr Worden, to make sense of
       this.
           Can you tell the court now whether you enquired into
       that difference specifically and found out the answer
       with confidence before you gave evidence today -- before
       you gave evidence on Tuesday?
   A.  When I gave evidence on Tuesday I had done those
       calculations nine months before, I hadn't gone back and
       revised it, and I said in court that my memory was
       unclear of the time order.
   Q.  No, no.  I'm talking about the distinction between
       sessions of transactions.
   A.  Yes.
   Q.  Now, had you, before you came to court on Tuesday, at
       any time satisfied yourself of the distinction between
       transactions and sessions and found there was none?
   A.  Yes, before my first report.
   Q.  Before your first report?
   A.  Yes.
   Q.  And how did you do that?
   A.  Well, I considered the nature of recoverable
       transactions and cancellable transactions, which in my
       mind addresses all the cases.
   Q.  Well, that came up in the case of Mrs Burke, didn't it?
   A.  It comes up in all sorts of places.  It is a very
       important issue of the trial.
   Q.  Yes, and so a proper understanding of that issue and
       whether or not a transaction is the same as a session
       would be necessary to any properly formed opinion about
       the problem, wouldn't it?
   A.  No.  Proper understanding of a transaction is necessary
       for understanding of recoverable transactions and
       cancellable transactions.  On that basis, I concluded
       before my first report that a transaction and a customer
       session are the same thing.
   Q.  So why would there be this reference to 1.7 in
       a document that you had previously seen but hadn't
       mentioned before Tuesday?
   A.  Because my memory was confused and I recall that at some
       time in the past I had been concerned about this figure
       of 1.7, and not having gone back and recalled the
       history of my calculations of customer branch size
       I mistakenly associated the factor 1.7 with this issue,
       and that was my mistake in evidence which I have
       corrected.
   Q.  Okay.  Let's look at {F/1461/1}, please.  The F bundle
       takes a moment to load so it will come up in a second.
           (Pause)
           This is a receipt in Mrs Burke's case.
   A.  Yes.
   Q.  You will see about halfway down the receipt,
       "Disconnected session", do you see that?
   A.  Yes.
   Q.  In capitals?
   A.  Where are we?
   Q.  Halfway down, "Disconnected session".  Do you see that?
   A.  This is a disconnected session receipt, yes.
   Q.  Then it says:
           "Do not attempt to reverse any transaction from this
       session."
   A.  Yes.
   Q.  They are not the same?
   A.  The word "transaction" gets used in lots of ways and
       obviously here a transaction means a part of what
       a customer did, and that's a different sense of
       transaction from recoverable transaction which is
       a whole thing.  This is a recoverable transaction that
       had to be recovered.
   Q.  Not the same?
   A.  No, there are different uses of the words "transaction".
       There is the technical use in terms of computer systems,
       there is the use in terms of Horizon, and there is
       probably the use that subpostmasters have.  But it is my
       opinion that a transaction as recorded on Horizon -- it
       is my opinion that statistics on customer sessions are
       recorded on Horizon and they are synonymous with
       transactions, Horizon transactions.
   Q.  You got the statistics for the number of transactions
       from Angela Van Den Bogard's witness statement, didn't
       you?
   A.  From various places.  I think there are various
       documents which also have transaction volumes in them.
   Q.  But you took -- you said it was in her second witness
       statement, it was actually in her first.
   A.  For the claimants' branches I got them from her witness
       statements.  For the mass of branches I got them from
       various places.
   Q.  That is not right actually.  You say you took the
       figure, the 48 million -- we went through this on
       Tuesday -- from Angela Van Den Bogard's witness
       statement and note Mr Coyne used the same figure.  On
       Tuesday I put to you that actually it is her first
       witness statement, it is 47 million, and Mr Coyne says
       47 million.  That's what I put to you on Tuesday.  Do
       you accept that?
   A.  I remember that distinction --
   Q.  Right.  Let's look at Angela Van Den Bogard's second
       witness statement at paragraph 14.2 at page {E2/5/4}, I
       think.
   MR JUSTICE FRASER:  Which paragraph?
   MR GREEN:  14.2.
   MR JUSTICE FRASER:  I think it does start on page {E2/5/4}.
   MR GREEN:  I'm most grateful.  You can see there, halfway
       down, on the left-hand side:
           "If there is a payment due to or from the
       customer --"
   A.  Sorry, I haven't got there yet.
   Q.  About halfway down on the left-hand margin:
           "If there is a payment --"
   A.  Sorry, I just haven't found it.  Ah, right down at the
       bottom.  Halfway down the last paragraph.  I was looking
       halfway down the page.
   MR JUSTICE FRASER:  I think, Dr Worden, if you look at
       paragraph 14.2 and count down six lines from the top of
       that paragraph.
   A.  Yes, I have got it now.  Thank you.
   MR GREEN:  You will find the words:
           "If there is a payment due to or from the customer,
       the session (ie the transaction or transactions sitting
       in the stack that have not been completed) is settled to
       cash and a receipt is automatically printed."
   A.  Yes.
   Q.  That is the witness from whom you took the figure for
       the number of transactions, isn't it?
   A.  I took from her spreadsheet, yes.  As I say, there are
       various uses of the word "transaction" in currency and
       I felt that the only thing that could be automatically
       measured by Horizon was the number of transactions which
       are the same as customer sessions.  Now if I'm mistaken
       about that, I was mistaken at the time of my first
       witness statement, but I still -- it is still my opinion
       that a transaction and a customer session, particularly
       from the definitions of recoverable transaction.
       A recoverable transaction consists of a customer session
       in which all these things happen, and then it goes wrong
       when some contact has been made with the bank, and the
       whole recoverable transaction has to be recovered.  And
       that's the sense in which I think a transaction is the
       same as a customer session.
   Q.  Dr Worden, I'm going to suggest to you that you were
       embarrassed at what we saw on Tuesday and what you have
       just come up with this morning is an answer of
       convenience to cover up your embarrassment?
   A.  That's not the case.
   Q.  We will return to some of the other points later on that
       you have canvassed this morning but for present purposes
       can we start again at {C1/1/1}, please.
   A.  Yes.
   Q.  Now, Issue 1(b) on the Horizon Issues --
   A.  1(b) yes.
   Q.  Yes?
   A.  Mm.
   Q.  Is:
           "The extent to which it was possible or likely for
       bug, error or defects ... to have the potential to (b)
       undermine the reliability of Horizon accurately to
       process and to record transactions ..."
           Yes?
   A.  Yes.
   Q.  And you chose to answer Issue 1(b) separately in your
       reports?
   A.  That is right.  It is some subsection of 8.
   Q.  If we look at paragraph 574, please, at {D3/1/138}.
   A.  It is worth my getting this one out.  574?  Oh.
   Q.  On page 138.
   A.  Part (b), yes.
   Q.  Do you have 574 there, Dr Worden?
   A.  I have it there, yes.
   Q.  I'm really taking you to this just to be fair to you, to
       re-orient you in your report where you dealt with it.
       Okay?
   A.  Mm.
   Q.  So 574 is your summary where you say:
           " ... the Horizon core audit process was designed to
       create a secure, accurate and immutable record of what
       was entered into Horizon at the branch, and to record
       verifiably who entered it."
           Yes?
   A.  Yes.
   Q.  "In my opinion, regardless of any other processing done
       in other parts of Horizon, the core audit database was
       an accurate record of transactions entered in the
       branch. It was carefully designed, and I have seen no
       evidence that it ever failed in service. Therefore in
       any case of doubt about processing done in other parts
       of Horizon, this record was available to establish the
       true state of any branch accounts, based on transactions
       entered in the branch."
           Yes?
   A.  Yes.
   Q.  And that's the substance.  Then you deal with it as
       being a highly reliable record at page {D3/1/191},
       paragraphs 848 to 850.
   A.  Sorry, are we coming to that?  Yes.  Okay.  Part (b)
       again.  Right.
           (Reads to self)
           Right.
   Q.  Yes?  And you explain that we actually have to go back
       to two different parts of the report from there, at 849?
   A.  Sorry, can I get to that?
   Q.  Yes.  We are looking at it.
   A.  In 4.4 and 6.2.6 I describe the audit system, right.
   Q.  Yes?  You say "highly reliable record of transactions
       entered" into the branch, yes?
   A.  Yes.
   Q.  And that's your robustness countermeasure of secure
       kernel hardware?
   A.  Yes, and we talk about the secure chain of
       communication.
   Q.  Indeed.  Okay?  Then from there to get to 4.4 we go to
       pages 45 to 48 {D3/1/45}.
   A.  So we've got more about the audit database here.
   Q.  Exactly.  And it is 173 to 179.
   A.  179?  Right, okay.
   Q.  Can we pause on that -- sorry, my fault entirely --
   A.  So they are the pictures.  Yes, okay.
   Q.  But just pausing there, we see again the phrase in the
       second line of 173, "an accurate and immutable record",
       don't we?
   A.  Yes.
   Q.  Yes.  And then we -- "of any activity which can affect
       the branch accounts"?
   A.  Yes.
   Q.  And then at section 6.2.6, which is on page {D3/1/73},
       paragraphs 267 to 271 is where you deal with it again.
   A.  Again.
   Q.  Just to trace through.  I would like you to look,
       please, if you would, at paragraph 270.
   A.  270.  Yes, okay.
   Q.  It is over the page on page {D3/1/74}.
   A.  "... KELs indicates that use of the audit database was a
       backstop, and rarely used ..."
           Yes.
   Q.  Now, you have drawn an inference there about the reason
       for not using the audit database?
   A.  Yes.
   Q.  That's actually a matter in dispute between the parties,
       isn't it?
   A.  Well, Mr Coyne suggested the audit database should have
       been used more and differently and that is a difference
       between the experts, yes.
   Q.  But when Mr Coyne suggested that, it was positively put
       to him that it was quite expensive and labour intensive
       as a justification for not using it?
   A.  Not using it for every TC, I believe that is
       a justification, yes, but every TC and every bug is
       a different matter.
   Q.  Let's look at Day 15 of the transcript, if we may,
       please, {Day 15/71:21}.
   A.  Page?
   Q.  We are looking at page 71, line 21.
   A.  "... labour intensive ... expensive ..."
           He says he can't imagine why it would be labour
       intensive.
   Q.  Do you remember listening to that?
   A.  Yes, I think I can --
   Q.  We can see on the same screen at the bottom of 73:
           "Question:  And the charge that's made over the
       allowance of 720 a year, it is over £200, are you aware
       of that?"
           Do you remember --
   A.  Yes, I've always been aware of this figure in the
       ballpark of £250, yes.
   Q.  So the figure you have always had in mind is £250?
   A.  Something like that.
   Q.  In that ballpark.
           Let's pause there.  It seems that -- it appears to
       be agreed that the allowance for ARQ requests was 720
       a year?
   A.  I don't recall a precise figure but I am sure you are
       right.
   Q.  I can just show you quickly, {E2/8/4}.  That's the
       witness statement of Ms Mather at {E2/8/4}.  You will
       see at paragraph 19 -- yes?
   A.  Yes, number of ARQs.
   Q.  She says that she has spoken to a colleague called
       Christopher Knight who has confirmed that Post Office
       gets an allowance of 720 data queries a year, yes?
   A.  Yes.
   Q.  "He is not aware of any fees or penalties having been
       paid by Post office, nor anyone being deterred from
       making ARQ requests because of fees that might have to
       be paid ..."
           Just focusing on the number at the moment.
   A.  Yes.
   Q.  720 appears to be right.  Let's look please at
       {F/1092/1}.  You can see underneath "Financial Benefits"
       the second point:
           "ARQ ... retrieval process ..."
   A.  Yes.
   Q.  And you can see 720 requests there, can't you?
   A.  This is subsumed without breakdown.
   Q.  Yes.  But you can also see there that the figure that's
       referred to there is £450 --
   A.  Yes.
   Q.  -- per unit, can't you?
   A.  Yes.  Well, I think it's the division gives that answer.
       Is that right?
   Q.  Well, let's take it in stages.  What was put to Mr Coyne
       without any document or any particular basis was the
       figure was over £200?
   A.  Well, I think -- I would imagine there are two different
       figures.  In other words, there is a bulk price for your
       first 720 and that works out.  You have paid that
       already and you can get 720 for that, and so the average
       of those is that much.  Then if you go beyond that, for
       each one you pay a different figure.
   Q.  And you think the £200 is the extras?
   A.  I suspect so, yes.  But there are those two figures and
       I haven't really gone into the detail of that because
       250/450, you know, it doesn't seem to me hugely to
       influence my opinion --
   Q.  It is just a bit more than double, isn't it?
   A.  Yes.
   Q.  And that's not an order of magnitude that would bother
       you from an engineering perspective --
   A.  -- it's not a thing that feeds into any of the numbers
       I have tried to calculate really.
   Q.  But it might feed into whether or not cost was
       a disincentive to seek ARQ requests?
   A.  Well, as I say, the issue Mr Coyne raised was seeking
       ARQs for every TC, in other words 100,000 a year, and
       that's rather different from seeking evidence for
       a suspected buyer.
   Q.  Well, what about -- if we just focus at the moment on
       looking at ARQ data where in every case the
       subpostmaster queries the transaction.
   A.  Yes.
   Q.  If the cost was half, you would be able to get twice as
       many, wouldn't you, for the same amount?
   A.  For the same budget, if you choose the same budget on
       that, yes.
   Q.  Yes.  So it makes a bit of a difference?
   A.  Yes, I agree it does.
   Q.  And --
   A.  But as I say, my impression is ARQ, you know, is
       a backstop basically.  And normally one can investigate
       these issues without going to ARQs and one can arrive at
       a position of understanding what happened without going
       to the ARQ because MISs are designed to do that.
   Q.  Let's take it in stages, if we may.  Just eyeballing the
       figure of 384,000 and dividing by 720, that's actually
       about £533, isn't it?
   A.  Oh really?  Right, yes, okay.
   Q.  And what was put to Mr Coyne was it was over £200?
   A.  Mm.
   Q.  Would you say that's consistent with it being 450 or
       533?
   A.  Well, it is consistent -- consistent to me means not
       contradictory --
   Q.  Yes, so it is consistent?
   A.  And that's consistent, yes.
   Q.  So it is literally consistent but quite misleading for
       purposes of trying to work out whether it is
       a disincentive, isn't it?
   A.  I'm not sure who is misled.
   Q.  I'm just saying if someone is saying cost is a
       disincentive because you are charging over £200, it
       doesn't really tell the whole story if the true price is
       450, 436 or 533, does it?
   A.  But the 450 was paid upfront so, you know, however many
       you go towards your 720, it doesn't make a difference
       what Post Office paid, so it wasn't a disincentive for
       them.
   Q.  Dr Worden, you are making it up as you're going along.
   A.  I'm not.  I'm answering your questions as you put them
       to me.
   Q.  The true answer is you have no ideas about these figures
       and you're guessing what they might be.
   A.  No, I'm not.  I'm answering your questions.
   Q.  You don't know any of this.
   A.  I'm trying to answer your questions --
   Q.  I understand --
   A.  -- on an issue I have not looked at in great depth.
   Q.  That's rather the point.  I'm not disputing you are
       trying to answer the questions, I'm putting to you that
       you have no foundation for doing so.  Do you agree with?
   A.  My knowledge of the price of ARQs is not very precise
       because I haven't focused on them in my -- that price in
       my reports.  So I'm trying to do the best I can to
       answer your questions.
   Q.  It is perfectly okay to say "I have no idea about that".
   A.  That wouldn't be true.
   Q.  Then what idea do you have?
   A.  I have an idea that I have seen some of these figures
       and I know it is in the ballpark of £250/£300 --
   Q.  Yes, but let's focus on a particular thing that you have
       given evidence about.  You say there is a distinction
       between the ones you get all paid for in advance, which
       you were saying would be the £200 price, £200 a unit?
   A.  No, the ones you get more for in advance are the £450 --
   Q.  Sorry, quite right.  And you say you pay £200 for the
       additional ones?
   A.  That's been my understanding, yes.
   Q.  Where do you get the £200 for the additional ones from?
   A.  I can't recall exactly.  My understanding of these
       things builds up from all sorts of documents I read and
       I can't, I'm afraid, always point to say: this document
       is where I got it.
   Q.  Well, I'm positively putting to you, Dr Worden, that you
       are giving answers that you think are consistent with
       what has been put as part of Post Office's case rather
       than from any actual facts you have?
   A.  That is not true.
   MR JUSTICE FRASER:  I'm going to ask a question to clear it
       up and then I'll ask Mr Green to move on.
           In the last couple of minutes you have mentioned
       a number of different prices and I just want all costs.
       I think you said £200 and at one point you said ballpark
       £250 to £300.  Do you know how much the requests in fact
       cost?
   A.  I don't know in detail.  The figure I have always had in
       mind is ballpark 250.
   MR JUSTICE FRASER:  Mr Green.
   MR GREEN:  If we look please at {F/994.1/2}, this is
       an email which is at or about the same time as the 2012
       document we were looking at a moment ago.
   A.  Right.
   Q.  And you will see on that second page, if you come
       two-thirds of the way down, do you see "Monthly
       Reporting"?
   A.  Yes, I see that paragraph.
   Q.  Okay.  Just below that:
           "We have always worked on the belief that a single
       ARQ costs now about £450 each ..."
           Do you see that?
   A.  Yes.
   Q.  Just pausing there.  The first point is that
       an organisation is going to take its decisions based on
       the beliefs it has whether they are right or not, aren't
       they?  If everyone believes it costs about £450 --
   A.  That seems to have been the consensus view amongst
       various people in Post Office, I'm not sure what
       population of people it is.
   Q.  Okay.  This is what is said by Mr Laycock here.  He
       says:
           "... in that I have costs from 2004 that identified
       an uplift of an additional 390 at a cost of £170,000."
   A.  Yes.
   Q.  "This indicates a large unit cost of £436 per
       enquiry ..."
   A.  I take it that the division works.
   Q.  It does, I think it is 435.8.
           "So the cost we have assumed now to be in the region
       of £450 ..."
           And then:
           " ... although Sue has stated 'there is provision in
       the contract to increase the maximum number of queries
       and if we do so the charge would be £207 per query.'"
           So if they were to change the contract they would be
       able to get additional ARQs much more cheaply?
   A.  Yes, this is sort of buy more get a discount.
   Q.  So would you accept, first of all, that this appears to
       be the position that they were working on?
   A.  Yes.  I mean this is a snapshot of what they thought at
       a certain time.
   Q.  Right.  Let's go, please, if we may, now to {F/728/1}.
       This begins at the back of this change.  This relates
       to --
   A.  This is 2010.  What was the last one?
   Q.  2012?
   A.  So this is a bit earlier.
   Q.  This is a bit earlier.  This begins at the back of the
       chain.  I will take you, if I may, to the last actual
       text which is on page {F/728/12}, other than
       Michele Graves' name and contact details.
   A.  So this is at the bottom.  It starts with the first or
       the last in the chain, sorry?
   Q.  Now, do you see the second paragraph of the "Hi Lin"
       email?
   A.  Sorry, could I ask, this is an email chain where the
       first email is at the bottom?
   Q.  Yes, it is.
   A.  Right, okay.
   Q.  The second paragraph under "Hi Lin" at the bottom:
           "Moving forward, can you confirm what your next
       steps are re the points she has raised. I know you are
       waiting for the audit trail of the transaction events.
       Re the comment about the two auditor visits monitoring
       her work and apparently also having a problem with the
       figures, are you obtaining a report from the auditor? If
       this escalates we will need to answer the apparent
       discrepancies in the figures on his laptop & horizon."
   A.  Yes.
   Q.  Pausing there, that's a reference to the fact that the
       auditor had figures on his laptop that he had worked out
       that were different from the ones on Horizon?
   A.  Yes, and presumably he had done this by making a visit.
   Q.  Yes.
   A.  Right.  Okay.
   Q.  So there is a discrepancy between the figures the
       auditor thinks Horizon should show and what's on
       Horizon.
   A.  Yes.
   Q.  And they are asking about whether they are getting
       a report.  If we go up to the email above --
   A.  "I have changed it slightly."
           Do you know what "it" is?
   Q.  Let's just focus on the next paragraph:
           "In terms of the points raised we do have a report
       from the auditor but it is probably not detailed enough
       to cover all the points, so we will probably need to go
       back on this as part of the contractual case. In terms
       of the audit trail via Horizon we are waiting for Mark
       Dinsdale to authorise the case as he holds the budget.
           "Nigel has today referred the case to Jason Collins
       requesting their involvement given the level of losses -
       I will forward e-mail separately. Need to see where this
       gets us before we can move the case forward or start to
       answer her detailed questions."
   A.  Yes.
   Q.  So you can see the genesis of this.
   A.  Okay.
   Q.  So this is a classic case where the ARQ data might well
       be helpful, isn't it?
   A.  It looks like it.  It looks they are considering getting
       the ARQ data, yes.
   Q.  And it is particularly acute, the need for the ARQ data
       here, because you have got the subpostmaster asking
       detailed questions and challenging what's being shown.
       You have got an auditor with figures that he says should
       be on the system?
   A.  Yes.
   Q.  And those are differing from Horizon?
   A.  Let me check --
   Q.  That's the premise of this enquiry?
   A.  The differing from Horizon, yes, that was in some
       previous paragraph.
   Q.  Yes exactly, just setting the stage.  So this is
       a particularly important example of when you might wish
       to seek ARQ data to resolve what's happened?
   A.  It sounds like it, yes.
   Q.  That's reflected on page {F/728/11}, if we go back to
       that.
   A.  Yes.  We are on 12 now.  Go to 11.  Yes.
   Q.  "Thanks Lin:
           "Have made suggested changes & sent:
           "If we can encourage Mark Dinsdale to authorise the
       audit trail, I feel it would be beneficial given the
       current interest in Horizon from media & MP's."
   A.  Right.
   Q.  Now, was it your impression when you drew the inference
       in your report that they would get the audit data if
       they needed it?  Was it your impression that they would
       be tipped over the edge into trying to get it if there
       was media interest or interest from MPs?
   A.  I wasn't concerned with that.
   Q.  No?
   MR JUSTICE FRASER:  I think he answered two questions
       together there, Mr Green.  I wonder if you could put
       them separately.
   MR GREEN:  I'm grateful.
           Dr Worden, did you think that Post Office would only
       think about getting ARQ data because of interest from
       media and MPs when you were looking at the inference you
       drew?
   A.  Which inference?
   Q.  The inference that the reason they didn't get ARQ data
       was because they had every other information source they
       needed?
   A.  Well, we must distinguish between -- what I was mainly
       looking at was investigating potential bugs and
       mysteries, and that is a mixture of Post Office and
       Fujitsu.  I was certainly not concerned with Post Office
       business decisions about whether media attention or
       political attention made it more important or not.
       I was not concerned with that.
   Q.  Because here, Mrs Stubbs' case, not only have we got the
       problem itself, militating in favour of getting ARQ
       data, but on top of that we have got an extra layer that
       they seem to be giving weight to on the face of that of
       current interest in Horizon from media and MPs, haven't
       we?
   A.  Yes.
   Q.  So that is a further reason for them to be apparently
       motivated to get it.  Let's go, please, now forward to
       page {F/728/9}.
   A.  Right, we are moving back, so this is --
   Q.  There is an email from Mark Dinsdale, do you see that?
   A.  Right, and he says it'll take three weeks, yes.
   Q.  That's not really the point, is it, because if we read
       on it says:
           "Has Jason agreed to take this case on, because we
       don't hand over Horizon logs to a spmr."
   A.  Where are we?
   Q.  Just after "3 weeks" where you stopped reading.
   A.  Yes, he says that.
   Q.  Why would they not give Horizon logs to a SPM who was
       concerned about discrepancies in their branch?
   A.  I don't know.  I haven't looked at it.
   Q.  "It needs an expert to understand what it says, and
       usually this requires one of the investigators."
   A.  Yes, um --
   Q.  "I'll give Jason a call in the morning ..."
           I will just read it to you and then ask you
       questions, if I may?
   A.  Yes.
   Q.  "... then I will raise an ARQ from Fujitsu."
           Then he says this:
           "Is this for our benefit, as there is a cost
       attached to ARQ requests, we do get a supply free of
       charge as part of the contract but we usually don't have
       enough, therefore we usually charge the defence
       lawyers."
   A.  Yes.
   Q.  Cost was a disincentive for Post Office based on this
       email, wasn't it?
   A.  Well, I mean on this email they are saying we charge the
       defence lawyers, so it is not actually a cost for them,
       but I have to read this email carefully to answer that
       question.
   MR DE GARR ROBINSON:  My Lord, I do rise to ask whether this
       line of cross-examination is productive with this
       witness?  He is an expert giving evidence about the
       operation of the Horizon system, and my learned friend
       wishes to put a story to him, but isn't this a matter
       best left for submissions rather than taking time up in
       cross-examination?
   MR JUSTICE FRASER:  Well, as you know from last week I am
       relaxed about how counsel uses their time, but you are
       correct, that last question was in fact submission
       because it was asked about the thought processes within
       the Post Office.
           So Mr Green, if you would like to put the point
       based on this expert's view of cost incentive or
       disincentive.  And the point, as Mr de Garr Robinson
       says, effectively boils down to one of submission, so
       I would not necessarily spend very long on it, but as
       you found out last week I will let both of you during
       your cross-examination spend as long as you want on any
       points you might think are useful to each of you.
   MR GREEN:  I'm grateful.
           You didn't consider this before you formed the view
       that you have expressed in your report, did you?
   A.  No, because -- I didn't consider it -- I didn't see this
       email chain before I formed my view.
   Q.  You accept that what you have seen here would be
       relevant to forming the inference that you have
       expressed in your report, wouldn't it?
   MR DE GARR ROBINSON:  Which inference?  Could you --
   MR GREEN:  The inference which was the beginning of this bit
       of the cross-examination about the reason for not
       looking at ARQ data.
   A.  Can we go to that inference?  That was that MISs were
       normally sufficient for the purpose, I think.
   Q.  Right.
   A.  And what did I say in my report that we are referring
       to?
   Q.  Let's look back.  Paragraph 270 on page {D3/1/74}.
   A.  270:
           "... audit database was a backstop, and rarely used
       ..."
           Yes.
           "... other comparisons of data were usually
       sufficient to diagnose the problem."
           That was my inference, yes.
   Q.  And I positively put to you that was an inference you
       drew, yes?
   A.  Yes.
   Q.  And you drew the inference about the reason for not
       looking at the audit database?
   A.  That was a technical inference based on quality of data.
   Q.  I'm going to suggest to you, Dr Worden, that you and
       Mr Coyne found that the audit data was very rarely
       referred to.  That's agreed?
   A.  I think so, yes.
   Q.  And you felt the need to explain that away, and that's
       why you said there that it was:
           "... because other comparisons of data were usually
       sufficient to diagnose the problem."
   A.  I would not put it as explain away.  I was trying to put
       in context the way audit data was used and I felt that
       was part of the description.
   Q.  Having seen the documents I have just put to you, do you
       accept that the cost of these was a disincentive to
       Post Office using the ARQ data which you should have had
       regard to, or now do accept you will have regard to, in
       relation to that issue?
   A.  My view has always been that in the context of TCs, the
       cost of retrieving ARQ data would be a disincentive
       because they need 100,000 TCs a year and it would have
       been prohibited.
   Q.  I'm asking you about what I have shown you and I have
       given you the example of Mrs Stubbs, who was not dealing
       with TCs, she was dealing with problems with her branch
       accounts, and I have shown you the other documents.
           Last chance.  Do you accept that it appears on the
       face of these documents for the purpose of any such
       inference that cost was a material disincentive?
   A.  It appears from these documents it was, yes.
   Q.  Thank you.
           Now, we had disclosed on the Tuesday before the
       trial started some further ARQ data, that's 28th May,
       which was described as going back to 2004.  There is
       a year missing from that which is still being pursued,
       so I may have to come back to that with you, Dr Worden.
       But you hadn't looked yourself at the number of ARQ
       requests made in any particular year, had you?
   A.  No.
   Q.  You heard Mr Coyne's evidence about system design,
       didn't you?
   A.  Yes.
   Q.  And just stepping back for a moment, it seems that
       Fujitsu had negotiated for themselves a contract where
       Post Office couldn't actually see the data in the audit
       store or read it in real time.  That is correct?
   A.  The audit store, yes.
   Q.  It could not be read in real time?
   A.  That is right, not designed --
   Q.  And that was the arrangement?
   A.  Well, that was the business requirement that apparently
       Fujitsu and Post Office had agreed.
   Q.  That's what they agreed.  And I think we saw in the
       Peter Laycock email we went to earlier, I didn't point
       it out to you, but they were paying about £11 million
       a year for their data centre and ARQ service and it was
       from that budget that the ALQs were provided.
       Nonetheless there was a limited number of requests they
       could make and they had to pay about £450 or so they
       thought.  So that is where we got to, yes?
           The matter that was being put to Mr Coyne was that
       it was expensive and therefore it was reasonable not to
       do it.  That's a consequence of the way the relationship
       has been designed and what they have agreed, isn't it?
   A.  Well, to my mind it is the consequence of the fact that
       there are 100,000 TCs a year --
   Q.  I'm not talking about doing it to every TC, I'm just
       talking about whether you have access to read the audit
       data, and I'm saying what we have established was the
       position, you would fairly accept, of the consequence of
       the way the arrangement had been set up between
       Post Office and Fujitsu --
   A.  It is a consequence of the way the Post Office had
       defined their business requirements, and Fujitsu and
       Post Office had agreed requirements and had built the
       Horizon system this way.  It was a consequence of that.
   Q.  Yes.  So it is a consequence of the design and build of
       the system --
   A.  Yes.
   Q.  -- based on the business requirements that Fujitsu and
       Post Office had agreed between themselves?
   A.  Yes.
   Q.  And if we look, please, at Day 15 of the transcript at
       page 87 {Day15/87:1}.  I'm going to ask you to --
   A.  87?
   Q.  Yes, page 87.  If you look at lines 1 to 14.
   A.  Yes, can I read all that through?  (Pause)
           (Reads to self)
           Yes.
   Q.  You have heard of the acronym WORM, haven't you?
   A.  Yes.
   Q.  What does it mean?
   A.  Write once read many.
   Q.  And that's not an idiosyncratic acronym of Mr Coyne,
       that's a standard industry --
   A.  No, I think that is pretty common.
   Q.  Pretty common?
   A.  Yes.
   Q.  Mr Coyne says there, when it is put to him that it has
       to be cracked open hundreds of times a day, the separate
       seal core audit store, His answer is:
           "Answer:  I think the word 'sealed' is misleading
       and the concept of cracking something open to get access
       to it I think is misleading as well.
           "Things in an audit store are only -- can be written
       to and only written to once, and the term that's often
       used is write once read many, WORM.  So the process is
       written to once, but people can read from that store on
       many occasions."
           Now, that is not an uncommon system for that kind of
       data, is it?
   A.  I think it is fairly common, yes.  I'm not --
   Q.  Hence the acronym, actually?
   A.  Yes.
   Q.  And if we look at page {Day15/84:6} to line 14, you can
       see him, Mr Coyne, explaining the purpose of an audit
       store.
           "Answer:  Well, the purpose of having an audit of
       what happens at branch counters is so that if there is
       a dispute over what has happened that somebody,
       presumably this will be Post Office, can have a very
       quick look at what happened and find out the truth.
       That's the purpose of having an audit store.  There is
       no other reason for it other than looking back at what
       actually happened.  It is my perception that that look
       back was available to people at the Post Office."
   A.  Yes.
   Q.  Yes?  Now, that is right so far as it goes?
   A.  Let me see.
   Q.  Subject to cost etc and time to get the ARQs from
       Fujitsu?
   A.  Sorry, can I read that paragraph again?
           (Reads to self)
           Now, "very quick look" is not what was intimated.
       It is not what Horizon did.
   Q.  Well, it was open to Fujitsu to at least look back when
       they eventually did get the ALQ data, wasn't it?
   A.  Well, the business requirement had been stated and
       agreed that here is this audit store and it does these
       things.  A quick look was not one of them.
   Q.  Do you have any practical experience yourself of working
       in or designing audit stores for different systems?
   A.  Let me think.  Not this kind of audit store.
   Q.  No, because Mr Coyne says he does at page {Day15/82:2}
       to line 14.
   A.  Let's look at this.  Page 82, line?
   Q.  Do you see that?
   A.  (Reads to self)
           Okay.
           "... they don't have to work in the way ..."
   Q.  Yes.  And he agrees with you, they are:
           "... often very easily accessible to be able to be
       read by certain users ..."
           Hence the WORM acronym.
   A.  Sorry, what does he agree with me?
   Q.  Well, do you agree with him that audit systems of the
       WORM type are:
           "... often very easily accessible to be able to be
       used by certain users ..."
           There's nothing inherently difficult about that if
       you design it that way?
   A.  If the business requirement is that and you design it
       that way, then it is possible, yes.
   Q.  Yes.  And if you don't design the system that way, it is
       not?
   A.  That is right, yes.
   Q.  And if we look at {D3/1/102}, paragraph 400.
   A.  Yes, right.
   Q.  You say:
           "I have not had much personal involvement in
       building secure kernel software ..."
   MR JUSTICE FRASER:  Which paragraph?
   MR GREEN:  Paragraph 400:
           " ... or computer security techniques, although I'm
       familiar with the underlying mathematical specification
       methods."
           And that's fair?
   A.  I said it.
   Q.  Now, just focusing on the gold standard or tamper-proof
       nature of the information in the audit store now.  You
       have described it as a gold standard in your expert
       report?
   A.  Yes.
   Q.  And you say it is a highly secure and tamper-proof
       record of what's entered into Horizon at the counter,
       etc, as a gold standard for comparison for data held in
       other parts of the Horizon estate, etc, supporting the
       diagnosis of software errors.
           Now can we agree that the point where the accuracy
       of the audit store data matters is the point at which it
       is actually being looked at for comparison with what's
       there at the branch or on the auditor's laptop?
   A.  Well, accuracy matters in any context it is used.
   Q.  Okay, in any context it is used?
   A.  I think so.
   Q.  But you would accept that its accuracy matters within
       the audit store?
   A.  Yes.
   Q.  Because if it is wrong there it is just wrong?
   A.  Yes.
   Q.  And its accuracy matters when it is being looked at
       after it has been extracted, yes?
   A.  Yes.
   Q.  Because if it is not still as accurate as it was in the
       audit store you have got another problem?
   A.  Yes.
   Q.  Mr Dunks gave evidence on this, Mr Miletic
       cross-examined him on that.  Were you there for that?
   A.  I do not think I was, actually.
   Q.  Can we look at {F/1716/43}, please.
   A.  "Extraction client", right.
   Q.  So this is a page of the audit extraction client user
       manual.
   A.  Right.
   Q.  And we want page 43, if we may.
   A.  Could I just clarify.  There are two stages in an audit
       extraction, there is getting the xml raw data out and
       then there is converting it to spreadsheets.  Is this
       referring to both --
   Q.  Well, it looks as if it is looking at the process
       overall but we will take it in stages.
           It says:
           "TMS and BRDB messages --"
   A.  Sorry, where are we?
   Q.  At the top of the page.
   A.  Okay.
   Q.  ""TMS and BRDB messages are numbered in sequence for
       each node. During filtering any retrieved audit message
       data is analyzed to determine what message sequences are
       present in the data and whether there are any gaps or
       duplicates in those sequences. A gap in a message
       sequence may indicate that a message is missing from the
       audit data."
   A.  Yes.
   Q.  "Duplicates may indicate that an audit file has been
       gathered twice."
   A.  Yes.
   Q.  Do you see that?  And if you look at the actual dialogue
       box that would be on the screen, on the right-hand side,
       can you see "Gaps Found (shown in red)", and "Duplicates
       Found (shown in blue)"?
   A.  Yes.
   Q.  Then underneath that, do you see "Seek assistance from
       audit support"?
   A.  Yes.
   Q.  Then the text below the diagram or figure 27:
           "When gaps are found, the gaps are shown in red in
       the message ... list ..."
           And so forth.
           "When duplicates are found ..."
           And so forth?
   A.  Yes.
   Q.  Did anyone tell you or give you -- direct your attention
       to the transcript of Mr Dunks' cross-examination about
       this?
   A.  No, I don't think so.  I think I have read that
       transcript though.
   Q.  Had you seen this document before you --
   A.  I certainly looked at this document, yes.
   Q.  This page?
   A.  I'm not sure about this page.  I was more concerned with
       the process of getting from the xml to spreadsheets and
       the different spreadsheets I might get out.
   Q.  Let's pause.  You would accept that this introduces
       a more complete aspect of the picture as to whether or
       not the audit data is a gold standard, doesn't it?
   A.  It obviously clarifies understanding audit data, yes.
   Q.  And the fair inference from the document is that gaps
       and duplicates do occur?
   A.  No.  I think the fair inference from the document is
       that if gaps and duplicates occur you should be
       concerned.
   Q.  So you are not prepared to accept that the fair
       inference from this document is that gaps and duplicates
       do occur in the audit database?
   A.  I do not think that's a fair inference.  I think the
       fair inference is that they are not supposed to and if
       they do you should seek assistance.
   Q.  So in fact even if you had seen this, it wouldn't have
       changed your view about gold standard, would it?
   A.  No, it doesn't.  I'm saying that gaps and duplicates are
       something to worry about, therefore raise the alarm.
   Q.  Pausing there.  If there were gaps or duplicates, they
       could arise on the journey of the data to the audit
       store to the point of being committed, couldn't they?
   A.  Yes.
   Q.  They could arise on the journey out of the audit store
       as a result of the extraction process itself?
   A.  That sounds less likely but possible.
   Q.  Possible but less likely.  Or there could be some sort
       of bug, error or defect or form of remote access that
       might make the underlying data unreliable?
   A.  What do we mean by that?
   Q.  Well, let's just -- let's take for example the
       piggy-backing into the counter, and if you accept for
       a moment that if that means that a transaction can be
       done remotely that looks as if it is being done in
       branch, the data in the audit store is going to record
       what was shown in branch, which is that it was done in
       branch when in truth it was done remotely?
   A.  Firstly, nobody has ever explained to me what
       piggy-backing is and I'm uncertain as to what
       piggy-backing means, it is not a technical term --
   Q.  I understand, but I'm just asking you to assume that's
       what it means, not to challenge it.
   A.  You say what's shown in branch.  I mean ... I'm
       struggling with this question a bit.  In other words,
       the audit store has been designed to record what
       happened in branch and normally that's what happens.
       Now you are asking me what else might have happened, and
       normally I would expect any process of remote access to
       branch accounts to record in the transactions, for
       instance with counter 32 as one mechanism, that
       something different had happened and therefore I would
       expect that to go to the audit store.
   Q.  Let me put it this way, Dr Worden.  If it didn't record
       that, that's what would go to the audit store?
   A.  If there was a bug or a fault in the software that was
       used to piggy-back for instance, and piggy-backing did
       not leave a trace in transactions, then that would be
       the case.
   Q.  If piggy-backing itself did not leave a trace in
       transactions that's what would show up in the audit
       store?
   A.  Absolutely, yes, that is right.
   Q.  Now Mr Dunks couldn't assist on the cause of potential
       gaps and duplicates when he was asked about it.
   A.  Mm.
   Q.  But what we can see is their suggestion that one should
       seek assistance from audit support if gaps or duplicates
       were found?
   A.  Yes.
   Q.  Do you know anything about that process that audit
       support would use?
   A.  I haven't looked that deeply, no.
   Q.  Do you know that it was a semi-automated process?
   A.  As I say, I haven't looked into it.
   Q.  Because we know from the Seema Misra case that it was
       referred to by Mr Jenkins in a witness statement to the
       court which, just for your Lordship's note, is
       {F/676/2}.  It is referred to as a semi-automated
       process to remove duplicates, for example.
   A.  What stage was Mr Jenkins referring to?
   Q.  What had happened in the Seema Misra case was ARQ data
       had been obtained, it had duplicates in it, they were
       spotted, and then there was what was described as
       a semi-automated process to remove them.
   A.  Yes, I believe this -- what was the date of this ARQ
       data?
   Q.  As at 2010 I think.
   A.  That was the Seema Misra case at that date, was it?
   Q.  Yes, but you don't know anything about this?
   A.  I have an approximate awareness that at some stage
       duplicates can arise because of two correspondence
       servers, for instance, and that they have to be removed
       at some stage.  That's as far as I have gone.
   Q.  What about gaps?
   A.  Gaps are rarer, I would suspect, and they are -- again
       I haven't looked in depth at the process by which gaps
       might occur but I believe they are not supposed to
       happen.
   Q.  Because a few minutes ago you were saying neither were
       supposed to happen?
   A.  I believe that is right, but "happen" may refer to
       several locations in the process, and by the time it
       gets in the audit store I believe it is the intention
       that duplicates and gaps should not be there.
   Q.  That sentence encapsulates one of the biggest
       differences between you and Mr Coyne, doesn't it,
       Dr Worden?
   A.  I don't know.
   Q.  What Mr Coyne has observed is your report is written
       from the point of design aspiration: this is the
       intention and I'm going to assume that the intention is
       achieved.  And Mr Coyne has taken a different approach
       of trying to see on the ground whether it was.  Do you
       accept that as a fair characterisation of your two
       different approaches?
   A.  No, I don't.  I have looked at testing a lot, I have
       looked at in service a lot, so I have not looked at
       design aspirations only.
   Q.  So do you feel that you looked in relation to the bugs
       that you and Mr Coyne discussed, which we will come to
       later, do you feel that you looked at that carefully to
       form a view about that, did you?
   A.  I looked -- I mean, I looked for bugs.  We both looked
       for bugs and we both did as carefully as we could.
   Q.  I see.
   MR JUSTICE FRASER:  But this document that's still on the
       screen is about extracting the data from the audit
       store.
   A.  Yes.
   MR JUSTICE FRASER:  And as I understand what you have said,
       and I just want to check in case I have misunderstood,
       duplicates may occur, they shouldn't, but they may
       because of the use of two correspondence servers.
   A.  On the way.
   MR JUSTICE FRASER:  Is that on the way out or on the way in?
   A.  I would expect that duplicates coming out are not
       intended whereas duplicates are somewhere on the way in,
       and somewhere on the way in duplicates are removed.
   MR JUSTICE FRASER:  But they could occur both on the way in
       and on the way out, is that right?
   A.  Well, on the way in I think they are perhaps more to be
       expected.  On the way out they are a sign that something
       is wrong.
   MR JUSTICE FRASER:  And what about gaps?
   A.  Gaps on the way out I think are again a sign that
       something's wrong.
   MR JUSTICE FRASER:  And what about on the way in?
   A.  It is not clear whether they may happen.  For instance,
       if a counter gets isolated, you get maroon transactions,
       you might get gaps on the way in.
   MR JUSTICE FRASER:  All right.  Thank you very much.
           Mr Green.
   MR GREEN:  I'm obliged.
           Can we look at audit data reversal indicators.  If
       we can look please at {F/829/1}, it is a document from
       11th August 2011, and it is a document that records that
       ARQ don't identify transaction reversals.
           So this is a PEAK, it is PC0211833.  If you go to
       the bottom of page {F/829/2}, please.
           My Lord, we have got a ring binder with this first
       one in for Dr Worden to add the ones we do as we go
       along.
   MR JUSTICE FRASER:  All right.
   MR GREEN:  As we pass them up, is it all right that
       Mr Donnelly --
   MR JUSTICE FRASER:  Yes, of course.  What, goes and puts
       them in the file, or hands them up?
   MR GREEN:  That is right.
   MR JUSTICE FRASER:  Of course.
   MR GREEN:  I'm most grateful.
           Dr Worden, if you look at page 2.
   A.  Right.
   Q.  At the foot of page 2?
   A.  Yes.
   Q.  Do you see "Impact on Operations" in capitals about five
       lines up?
   A.  Yes.
   Q.  Underneath it says:
           "Spreadsheets supplied by the prosecution team miss
       out an indication as to whether a transaction is
       a reversal."
   A.  Yes.
   Q.  And it appears to be thought that that's relevant there?
   A.  Yes.
   Q.  And that is -- what's being spoken about is the
       extraction process of data from the ARQ logs?
   A.  That is right.
   Q.  Underneath it says:
           "The prosecution team are well aware of the problem;
       we hope to have a release out in a few days; a KEL is
       therefore not required."
   A.  Yes.
   Q.  So it looks as if this was being taken in hand.
           If we go over the page to page {F/829/3}.
   A.  Yes.
   Q.  Do you see "FASTARQs" at the top?
   A.  Sorry?  Fast ARQs.
   Q.  Exactly.  It says:
           "They just need to run fast ARQs with all the
       various queries and check that the HNG-X spreadsheets
       all now have a reversal column."
   A.  Yes, right.
   Q.  It says under "Risks":
           "There are a few risks with this fix.  It must be
       got out or prosecution evidence is incomplete."
           It is clear, isn't it, that what the ARQ data would
       show would depend on how it was going to be extracted?
   A.  Yes, I mean --
   Q.  That's fair?
   A.  -- to fill this in a bit, extraction is getting out the
       xml and then running various programmes to convert the
       xml into various different possible spreadsheet forms,
       and I believe there is more than one, and these xql
       files are xml query files that take xml and extract
       stuff from it.
   Q.  But the answer to my question was yes?
   A.  Yes.  I was just adding a bit of clarification.
   Q.  If we can now go please to {F/1082/1}.  So that was
       August 2011.  This is 12th June 2013.  This is the
       document that has been referred to as the Helen Rose
       report.
   A.  Mm.
   Q.  Is this a document you have seen before, when it comes
       up?
   A.  Certainly the Helen Rose report, when it comes up,
       I would have seen before.
   Q.  You are familiar with it?
   A.  I'm fairly familiar with it, yes.
   Q.  Now, it is at {F/1082/1}, and if we look please at page
       3.
           Let me give you the context.  Look at the bottom of
       page {F/1082/2} first.
   A.  Now the blue is Gareth Jenkins in this, I believe.
   Q.  That is right.  At the bottom of page 2 you see a
       question:
           "I can clearly see the recovery reversal on the
       fujitsu logs received, but would this have been clear
       had we not previously discussed this issue."
           Do you see that?
   A.  Yes.
   Q.  As you say, the blue is Gareth Jenkins.  When you had
       your conversation with Mr Jenkins about the receipts and
       payments issue, did you also discuss this?
   A.  No, not at all.
   Q.  Okay.  If we go over the page please to {F/1082/3}, and
       you look at Mr Jenkins' answer in blue --
   A.  At the bottom.
   Q.  At the bottom.
   A.  Yes.
   Q.  "I understand your concerns. It would be relatively
       simple to add an extra column into the existing ARQ
       report spreadsheet, that would make it clear whether the
       Reversal Basket was generated by recovery or not."
   A.  Yes.
   Q.  "I think this would address your concern.  I'm not sure
       what the formal process is for changing the report
       layout.  Penny can you advise ..."
           And so forth.
           Then at the foot of the page:
           "May recommendation is that a change request is
       submitted so that all system created reversals are
       completely identifiable on both Fujitsu and Credence."
           Now, Angela Van Den Bogard gave her evidence that
       she didn't think this had been acted on, this
       recommendation.  You haven't seen anything to indicate
       that it has in relation to the extracted audit data,
       have you?
   A.  I certainly don't know.  I should say that if it had
       been acted on, the way I would imagine it would be acted
       on is to produce a change in some of these xql files
       which do the conversion to spreadsheet.
   Q.  And that is a relatively simply thing to do as
       Mr Jenkins said?
   A.  I think so.
   Q.  So there is no sensible reason not to do it, is there?
   A.  I don't know.
   Q.  Well, if it is something you want to do and it's
       important and relevant, you explain it's easy to do, can
       you think of a sensible reason why you shouldn't do it?
   A.  No, I can't.  But I don't know what the priorities were
       or what the business considerations were or anything
       else, I just know I don't know whether it was done or
       not.
   Q.  Now, we have looked at your approach to Issue 1(b) which
       is to focus on the audit store data?
   A.  Yes.  I think that is not my only conclusion on
       Issue 1(b).
   Q.  Would you fairly -- because I don't want to take you
       back to your report -- accept that is the focus of your
       answer to 1(b)?
   A.  Well, if we go back to my report there were several
       paragraphs in 8 point whatever it was.
   Q.   I haven't got time to show you every document again but
       let's focus on this.  You agree with Mr Coyne that
       Horizon does not record disputes.  That's agreed?
   A.  Yes, that's agreed.
   Q.  So the Horizon system does not record whether one of the
       parties involved in the transaction, namely the
       subpostmaster, agrees that a figure is correct or
       disagrees?
   A.  Well, disputes are disputes between presumably the
       postmaster and the Post Office about what happened.
       I was not -- that's what I was referring to.
   Q.  There's no dispute button on the screen?
   A.  No.
   Q.  No.  And were you aware that the suggestion of a dispute
       button being on screen was considered and rejected in
       2008?
   A.  I wasn't aware of that, no.
   Q.  Furthermore, where an amount is less than £150, you are
       aware, aren't you, that an SPM can't settle centrally?
   A.  Yes.
   Q.  So in relation to individual items of £150, even if
       disputed, the SPM has to make them good by cash or
       cheque?
   A.  I think that is right.
   Q.  And there could be more than one of those?
   A.  In a month or in what?
   Q.  In a trading period.
   A.  Well, my understanding is that in a trading period, if
       the aggregate amount is less than £150, then it's got to
       be cash on the nail.  If it is bigger it can be suspense
       account.
   Q.  We will come back to that.
           The points relevant to the reliability of the
       Horizon system to record transactions are essentially
       these, that in certain cases the Horizon system will
       record a figure which is in dispute.  That follows from
       what we have just said?
   A.  The Horizon system is recording loads of figures and
       some of those figures may be in dispute, yes, certainly.
   Q.  And because of your view about transaction corrections
       being necessary as part of the overall system, those
       transaction corrections are at some point in time
       correcting figures on Horizon which would otherwise be
       wrong?
   A.  Yes.  Certainly.
   Q.  So without those transaction corrections the figures
       shown on Horizon are wrong?
   A.  They could be wrong for a variety of reasons, all sorts
       of reasons --
   Q.  The answer is yes?
   A.  TCs try and correct all sorts of errors.
   Q.  The answer is yes?
   A.  Yes, but I'm saying there are lots of causes.
   Q.  I'm not asking you about --
   A.  I'm saying yes.
   Q.  And it might be that the subpostmaster knows or believes
       the figure to be wrong?
   A.  Yes.
   Q.  It might be that Post Office or possibly Fujitsu believe
       the figure to be wrong?
   A.  There are all sorts of investigations, yes, which can
       lead to views about figures being wrong.
   Q.  And it might be that two or more of those parties will
       think that the figure is wrong?
   A.  Yes.
   Q.  But it is still the figure on Horizon which requires
       a transaction correction later?
   A.  Yes.
   Q.  So even where everyone agrees that a transaction
       correction is necessary, the figure shown on the Horizon
       system itself is wrong?
   A.  Intermittently wrong, and the point of the transaction
       correction is to make sure that in the long-term Horizon
       is right.
   Q.  Indeed.  Now picking up from Tuesday in relation to
       transaction corrections and the time that they take to
       issue --
   MR JUSTICE FRASER:  Are you onto -- is this a convenient
       moment?
   MR GREEN:  I'm so sorry.  Yes, that would be a convenient
       moment.
   MR JUSTICE FRASER:  I get the sense we are moving on to
       a new topic.
   MR GREEN:  Indeed.
   MR JUSTICE FRASER:  Possibly because you said picking up
       from Tuesday.
           Right, we will have 10 minutes, Dr Worden.  Same
       score as before.  You know the drill.  And we will come
       back in at 12 o'clock.
   (11.50 am)
                         (A short break)
   (12.00 pm)
   MR GREEN:  Dr Worden, picking up from Tuesday in relation to
       TCs and the time they took to issue, can we look please
       at {F/1324/1}.
   A.  Yes, right.
   Q.  Is this a document you have seen before or --
   A.  I'm not familiar with this one, no, sorry.
   Q.  When you wrote your report did you have any factual
       knowledge about how long it took to issue TCs?
   A.  Rather little.  My impression was --
   Q.  No, pause there.
   A.  Yes.
   Q.  Did you actually know any facts?
   A.  I didn't have any data.
   Q.  Thank you.  Let's look at page {F/1324/9}, please.  If
       we look at 3.1.4, do you see what's being proposed there
       is 95% of transaction corrections within four months?
   A.  Yes, right.
   Q.  Then 3.1.5, 95% of transactions within six months?
   A.  Let me just see the categories here.  Okay.
   Q.  You can see?
   A.  Yes.
   Q.  So there are different timescales for different ones.
       If we go over the page to page {F/1324/10}, you can see
       that there are provisions there at 3.1.10 for
       "Aged/large volume/value transaction corrections"?
   A.  Yes.
   MR DE GARR ROBINSON:  I don't mean to be difficult but
       I don't know what this document is.  Has that been
       explained to the witness?
   MR GREEN:  Have you seen any of these before?
   MR DE GARR ROBINSON:  What's "these"?
   MR JUSTICE FRASER:  All right, let's go back to page
       {F/1324/1}.  I assume it is a Post Office document, is
       it?
   MR GREEN:  It is, my Lord, yes.
   MR JUSTICE FRASER:  Why don't you just explain to the
       witness what the document is.
   MR GREEN:  This is a working agreement between the financial
       service centre and the network.
   A.  And what's the date?
   Q.  It is I think 10th March 2015.
   A.  Right, okay.
   Q.  If we go to page {F/1324/8}.  Paragraph 3, there is
       a heading "Working Agreement."
   A.  Yes.
   Q.  This reflects the working agreement between FSC and the
       network and --
   A.  And the pages we have looked at before are after this
       page, is that right?
   Q.  Hold on.
   A.  Sorry.
   Q.  This reflects the working agreement between FSC at
       Post Office and the network, so an internal working
       agreement, which was heralded by the title of the
       document, the title being a working agreement --
   A.  Yes.
   Q.  -- between FSC and the network.
   A.  Yes.
   Q.  And at paragraph 3.1 it says:
           "The following section sets out the standard
       timescales for the issuing of transaction corrections to
       branches by FSC."
   A.  Yes.
   Q.  Then if we go over the page {F/1324/9}, we see the
       provisions there.  My question to you was you hadn't
       seen any -- you hadn't said you hadn't seen this
       document and you said you didn't have any data.
   A.  That is right, yes.
   Q.  Did you know of guidance like this from any other
       documents as far as you know?
   A.  I do not think I did, no.
   Q.  Thank you.
           Then if we go to {C5/11/14}, please.  This is part
       of a request made by Mr Coyne for further information.
       We are looking at paragraph 15.2.  Mr Coyne asks:
           "Please describe the average duration of resolution
       for transaction corrections where other statistical
       might not be found in relation to causes of TCs."
           Yes?
   A.  Yes.
   Q.  You did not support that request, did you?
   A.  I didn't, no.  What time was this request?
   Q.  This is dated -- give me one second.  Mr Coyne makes
       this 4 June 2018?
   A.  So quite early, yes.
   Q.  You didn't support it, did you?
   A.  No.  TCs were --
   Q.  So that might have provided some data for you about that
       topic?
   A.  I didn't feel that my supporting requests led to them
       being acted on any faster, really.
   Q.  Is that why you didn't support so many of the requests
       by Mr Coyne?
   A.  It was not the centre of my focus of interest at the
       time.
   Q.  Let's look at your transaction correction calculations.
       The context in which I think you consider them is Issues
       5 and 15, and then you effectively then reconsider them
       for the purposes of Issue 1.
   A.  How do I do that?  I mean they do interact with
       Issue 1 --
   Q.  And 3?
   A.  -- but where's the implicit linkage?
   Q.  Would you accept that is a fair summary?
   A.  Well, TCs calculation does not enter into my numerical
       estimates on Issue 1, I don't think.
   Q.  Let's pause there.  Let's have a look at Mr Coyne's --
       your criticism of Mr Coyne, as it were.  Let's look at
       paragraph 891 at {D3/1/198}.
   A.  This is my chapter 9, is it?
   Q.  Yes, your chapter 9.
   A.  Which paragraph?  8?
   Q.  At 891.
   A.  Yes.
   Q.  So you note that:
           "Mr Coyne has gone further than the above scope."
   A.  Yes.
   Q.  Because he had actually referred to the possibility of
       further error in the Horizon system where
       an inappropriate method of fix was selected or the
       possibility of transaction corrections being issued as
       a result of error, yes?
   A.  He had referred particularly to the possibility of
       errors in the manual process involved in transaction
       corrections.
   Q.  And that's what you felt was out of scope?
   A.  Yes.
   Q.  And you then explain at 891 that for balance, in 9.6 you
       provide your own commentary without prejudice to your
       understanding of the scope of Issues 5 and 15?
   A.  Yes, right.
   Q.  If we look at what Mr Coyne says in his expert report,
       you refer to it -- if we go to the next page of your
       expert report just for a moment {D3/1/199}, the
       particular points that you have picked out at
       paragraph 893 --
   A.  That's 3.13.
   Q.  -- are 3.13 and 3.28.  Let's go to those.  It is
       {D2/1/27}.  There are two separate points here.  3.13 is
       the first one we are looking at now.
   A.  Yes.
   Q.  And he says:
           "The reconciliation process ultimately presents the
       possibility of further error within the Horizon system
       whereby an inappropriate method of fix was selected,
       and/or the corrective fixes may have been carried out
       erroneously."
   A.  Mm.
   Q.  Now, that's not actually particularly limited or focused
       on transaction corrections, is it?
   A.  ""The reconciliation process ultimately presents the
       possibility of further error within the Horizon system
       whereby an inappropriate method of fix was selected ..."
           It seems to me that fix does have a bearing on
       transaction corrections.
   Q.  Okay, that's how you understood it?
   A.  Yes.
   Q.  Then if we look at 3.28 -- sorry, can we just stay on
       that page one second.
           Just in terms of substance, you agree that that's
       a fair comment by him, whether it is in or out?
   A.  Well, I have difficulty understanding the bounds of the
       Horizon system there because a method of fix being
       selected is a human process.
   Q.  Okay.  Subject to that you would accept the substance of
       what he is saying, subject to the bounds of the Horizon
       system?
   A.  "... corrective fixes may have been carried out
       erroneously."
           Again, that seems to be a human process we are
       talking about.
   Q.  The bounds of the Horizon system you're referring to
       exclude the process of issuing TCs?
   A.  Well, it seems to me that this statement is referring to
       some human processes.
   Q.  And you don't include those in the Horizon system?
   A.  No, not part of the system.
   Q.  If we look at {D2/1/30}, which is the other paragraph to
       which you expressly referred, 3.28.
   A.  (Reads to self)
           Yes.
   Q.  He says:
           "It is also possible that transaction corrections
       were issued as a result of error in Horizon transaction
       data processing."
   A.  Yes.
   Q.  Just pausing there.  In/out, whatever you like to do
       with it, whatever its status going to the Horizon
       Issues, you agree that that's possible?
   A.  It is possible, yes.
   Q.  So at least on that point there's no disagreement of any
       substance?
   A.  No.  I would obviously --
   Q.  Just yes or no at the moment.
   A.  No, there is no disagreement.
   Q.  And you note in your report, {D3/1/199} at
       paragraph 892.3, you say there:
           "Whenever the comparison revealed any discrepancy,
       there appeared to be a human process of deciding where
       to allocate responsibility for the discrepancy this had
       to be a human process and was therefore subject to
       errors."
   A.  Yes.
   Q.  So that's entirely consistent with you accepting the
       point that Mr Coyne made there?
   A.  Yes.
   Q.  On any definition of what consistent means?
   A.  Well, I say consistent means not contradicting, yes.
   Q.  You are actually agreeing with him properly, aren't you,
       there?
   A.  3.13 or 3.28?
   Q.  3.28.
   A.  I think I am, 3.13 I think I am, yes.
   Q.  And then you then devote a substantial section of your
       report, section 9, to calculating your upper limit on
       the magnitude of discrepancies --
   A.  This is 9.6 I think, yes.
   Q.  -- arising from erroneous TCs.
           And if we go to paragraph 895 at {D3/1/199} we can
       see that you have sought to calculate what in line 2 you
       call there:
           "... an upper limit on the magnitude of
       discrepancies in claimants' accounts arising from
       erroneous TCs ..."
   A.  Yes.
   Q.  You have focused on the claimants' accounts rather than
       the subpostmasters generally?
   A.  I have adopted that scaling factor, but to my mind the
       advantage of using numbers is if that scaling factor is
       not the right one it is easy to convert to another
       scaling factor.
   Q.  It is a yes or no answer --
   A.  Yes, I have adopted that scaling factor.
   Q.  And you have looked at annual volumes, distribution of
       types of TC, proportions of TCs disputed and proportion
       of disputes upheld?
   A.  Yes.
   Q.  That's a new exercise that you have done that Mr Coyne
       hadn't done?
   A.  Yes.
   Q.  And none of the Horizon Issues particularly asked you to
       do it?
   A.  You could say the robustness asked me to do it, because
       they are a user error correction, they are a form of
       robustness.
   Q.  But the errors in TCs, your express position is that
       that's out of scope, manual errors in TCs?
   A.  I'm saying the causes are out of scope.  There are a lot
       of things where the causes are out of scope but the
       robustness is how the effects are dealt with.
   Q.  Let's look at page {D3/1/205}, paragraph 928.  You
       identify in paragraph 928 a table of volume of TCs by
       year?
   A.  Mm.
   Q.  Did anything odd strike you in the data when you were
       eyeballing it?
   A.  Yes, there is a funny year where if you look at "Value
       of TCs", then 2015 is rather peculiar.  It jumps up
       above the others.
   Q.  Yes, it is about five times the average of the
       surrounding four years.
   A.  I didn't get to understand the final reason for that.
       Although there was another piece of data where
       a particular month they had some lumps in the number of
       TCs which may be related but I never investigated that.
   Q.  You have no idea whether that was a catch up on lots of
       old ones that had gone wrong or whether it was
       a disastrous year in some respect, or there was
       a specific problem or anything else, do you?
   A.  I don't know the causes of that lump, no.
   Q.  When the claimants' solicitors specifically asked
       a question about the TCs in correspondence -- for
       your Lordship's note {H/69/2} -- were you asked about
       that?
   A.  No, I don't think so.
   Q.  And so you were relying I think on Mr Smith's evidence
       as you say at paragraph 931 on {D3/1/206}, is that
       right?
   A.  Particularly for disputed TCs I was relying on his
       evidence, yes.
   Q.  And you were here for Mr Smith's evidence?
   A.  Mm.
   Q.  Sorry?
   A.  I think I was, yes.
   Q.  I am just checking because earlier on, on Tuesday, you
       said you thought you were here for all the defendant's
       evidence, and every time I put someone to you, you say
       you were not here.
   A.  I agree that's confusing.  I was certainly here for
       certain key defendant witnesses, like Mr Parker and
       Mr Godeseth.  The others I can't be quite so sure about.
   Q.  Because if you rely on someone's evidence it is pretty
       interesting what they say in cross-examination, isn't
       it?
   A.  I read the transcripts if I'm not there.
   Q.  And you have had the transcripts --
   A.  Yes.
   Q.  -- since Tuesday to consider before you came back today?
   A.  Yes.
   Q.  Did you read the transcript of Mr Smith's evidence?
   A.  I believe I did, yes.
   Q.  And it is right that your analysis in 206 is essentially
       premised on Mr Smith's evidence being accepted?
   A.  It is, absolutely.
   Q.  You in fact say that, you say:
           "If this evidence is accepted it enables me to
       calculate the approximate financial impact of errors in
       processing TCs."
           If we just look a bit further down at 934, you have
       just referred again {D3/1/207} to disputed TCs and
       upheld TCs in Mr Smith's witness statement?
   A.  I have jumped somewhere.
   Q.  Sorry.
   MR JUSTICE FRASER:  I think you need to be on {D3/1/207},
       I think.
           Are you going to paragraph 934?
   MR GREEN:  My Lord, I am.
           We have just looked at some other figures from
       Mr Smith, and you say:
           "I proceed on the assumption that these figures,
       which are the only ones available to me, are accepted by
       the court."
   A.  Yes.
   Q.  Mr Smith had presented the figures for Santander in
       a way that had misled both you and Mr Coyne, hadn't he?
   A.  That is correct, there was a change in Mr Smith's
       evidence.  And also I made another calculation of TCs in
       my supplemental report as you are aware.
   Q.  Did that rock your confidence in his knowledge of the
       subject matter at all?
   A.  If you look at my second calculation of TCs, I isolated
       three principal categories, that was Camelot and remming
       and Santander online banking, and Mr Smith's correction
       was not about Santander online banking, it was about
       Santander manual deposits.
   Q.  Yes, but I mean Mr Smith's Camelot figures were
       specifically relied on by you, weren't they?
   A.  Camelot figures, yes.
   Q.  And I think we see that at paragraph 936 and footnote 29
       on page 207.
   A.  Yes.  And I think in my subsequent calculation, when
       I had the three columns for the different kinds, Camelot
       TCs were not a large contribution to the ultimate
       result.
   Q.  Let's have a look at that, paragraph 49.  The figures
       that Mr Smith gave --
   MR JUSTICE FRASER:  Where are we?
   MR GREEN:  I'm so sorry, paragraph 20 of Mr Smith's witness
       statement which is {E2/9/5}.  Do you see paragraph 20
       there?
   A.  Yes.  I remember those figures, yes.
   Q.  There actually weren't any figures for Bank of Ireland
       retracts and lottery for the number of TCs disputed or
       compensating TCs, so they had been estimated?
   A.  They are estimated figures, yes.
   Q.  Did you pick up the fact that they had been estimated
       when you were relying on his evidence in your first
       report?
   A.  Well, I'm always conscious of the limitations of
       evidence and this introducing of uncertainty, that's
       a further dimension of uncertainty in the analysis.
   Q.  But you had assumed they had been estimated based on
       some sort of knowledge?
   A.  I assumed if somebody made an estimate it was a sensible
       estimate, yes.
   Q.  But based on some facts or knowledge that they had?
   A.  Yes.
   Q.  And in his cross-examination, if we go to that,
       {Day6/186:19}, starting at line 19.  It is page 186 at
       line 19.
   A.  I'm not there yet.
   Q.  Don't worry, it will come up in a moment.
   A.  Okay.
           "Question:  ... under 'BOI retracts' and 'Lottery'
       the number of TCs issued for those two is very different
       ..."
               Right.
           "Question:  But the number of disputed TCs
       apparently is estimated to be the same?
           "Answer:  It appears so, yes."
               Right.
   Q.  You see:
           "Question:  And the number ... is ... estimated to
       be identical?
           "Answer:  It appears so, yes.
           "Question:  Do you have any feel at all from your
       own knowledge as to whether those figures are even
       remotely reliable?"
   A.  Well, my own knowledge --
   Q.  No, I'm just asking you to look at the transcript for
       the moment.  I'm just reading out the question I said to
       Mr Smith.  Do you see line 4 on page 187?
   A.  I don't have feel for my own knowledge --
   Q.  No, I'm not asking you the question --
   A.  I thought that's what you were asking me.
   Q.  No.  Could you please just look at the transcript and
       then I'll ask a question in a minute.  It's my fault for
       not making it clear.
   MR JUSTICE FRASER:  I think what Mr Green is doing is he is
       just going to read out some questions and answers from
       Mr Smith and then he is going to put a question to you.
   A.  Right, okay.
   MR JUSTICE FRASER:  Mr Green.
   MR GREEN:  I'm most grateful.
           If you look at line 4 on {Day6/187:4}, and he says:
           "Answer:  The number of issued TCs I would suggest
       are very accurate.  The number of TCs disputed is not
       something that I can comment on at this stage.  I do
       know that prior to having our case management system in
       there was no consistent method of recording the method
       of disputes."
   A.  Yes.
   Q.  So on that footing the figures that you were looking at
       and the person giving them doesn't seem to have been
       hugely well placed to give reliable figures, does he?
   A.  No.
   Q.  Now if we look at TCs of different types on page 207 of
       your first report {D3/1/207}, at paragraph 938, bottom
       of the page, you refer to a TC summary --
   A.  Yes.
   Q.  -- from a TC reporting pack from November 2012.  If we
       look at the following page {D3/1/208} you will see table
       9.3.
   A.  Yes.
   Q.  "Volume of TCs by origin".
   A.  Yes.
   Q.  For 2011/2012.  Do you see that?
   A.  Yes.
   Q.  If we look at the source document from which you have
       taken that, could we please open {F/987/1}.  It is
       an Excel spreadsheet.
           Do you remember you got that from an Excel
       spreadsheet, Dr Worden?
   A.  Yes, plenty of tabs I remember.
   Q.  That is right.  We are going to look at a tab called
       "Summary by period" when that comes up.  It is
       {F/987/1}.
           We can't see it now, but presumably you looked
       carefully at the data on the Excel spreadsheet?
   A.  I poked around that spreadsheet a bit.
   Q.  You poked around a bit?
   A.  Yes.
   Q.  There are quite a few tabs so it is important to see
       what you are dealing with.
   MR JUSTICE FRASER:  Pause for one second.  We are still
       waiting for F/987.
   MR GREEN:  We are.
   MR JUSTICE FRASER:  Which I imagine is quite a big
       spreadsheet which is why it's taking a while to load.
       I can see it there but it has not gone on the common
       screen yet.  Is that F/987?  Here we go.  (Pause)
   MR GREEN:  Shall I just ask you, Dr Worden, while we are
       waiting for that, I will just take you to a different
       paragraph, if I may.
   A.  Yes.
   Q.  If we look at paragraph 942.
   A.  Yes.
   Q.  On page {D3/1/209}.
   A.  I will try my paper copy, I think.
   MR JUSTICE FRASER:  If we do that, we are moving away from
       the spreadsheet, is that right?
   MR GREEN:  My Lord, I will come back to that spreadsheet.
   MR JUSTICE FRASER:  Maybe at 1.55 pm ask for it to be loaded
       up and it will be there at 2 o'clock.
   MR GREEN:  I'm most grateful.
           If we look at paragraph 942, you proceed on various
       assumptions to reach a calculation that:
           "If there were 2% of TCs issued in error, which were
       resolved incorrectly against the branch, the net effect
       on branch accounts would be £6 per branch per month."
   A.  Yes.
   Q.  "As described above, in my opinion this is a
       conservative upper limit on the magnitude inaccuracies
       introduced into branch accounts - which could be of
       either sign."
   A.  Yes.
   Q.  We go down.  943, you have got your assumption that
       branches are affected equally, yes?  Which takes us back
       to our Penny Black example which we won't revisit.
           And then at 944 we have got:
           "This figure is to be compared with the mean
       shortfall per month claimed by the claimants - which, as
       I described in section 8 ..."
           Then you say:
           "A maximum of £2 per month from erroneous TCs is
       less than 1% of this amount."
   A.  Yes, that's just arithmetic.
   Q.  Yes?  So in fairness to you, Dr Worden, you later in
       your second report revise the figure from £2 per month
       to 1.50 per month?
   A.  Yes, there is a complete new calculation in the second
       report.
   Q.  And that change of 50p was significant for your
       calculations on an engineering approach?
   A.  Well, I think I summarised in the second report it was
       £2 again.  I can't recall exactly whether I presented it
       as £2 or 1.50.  But my belief is that figures in that
       range are interesting to the court, whether it is £2, £3
       or whatever, so I didn't feel the need for high
       precision in that figure.  But I think I summarised it
       somewhere in my supplemental report as £2 in spite of
       the fact the arithmetic had come a bit lower.  I can't
       recall.
   Q.  And the effect of the figures that you put forward is,
       you say, to show that the probability of a claim by
       a claimant being correct is extraordinarily low?
   A.  I was just converting from this average of £2 a month to
       what it would look like if the £2 came in lumps.  If the
       £2 came in thousand pound lumps then that would
       obviously have to happen one every 500 months to create
       the right average.  So I was doing the arithmetic of
       probabilities.
   Q.  Yes, but my question to you is that the effect of what
       you were doing was to show, on your approach, that the
       chances of a claim being made by a claimant that they'd
       lost £200 in one month due to errors in TCs, in the
       absence of further evidence the probability of that
       being correct was about 1%?
   A.  Yes.
   Q.  So very unlikely?
   A.  That is the arithmetic, yes.
   Q.  And that's the effect of what you were showing there?
   A.  Yes.
   Q.  And you weren't asked in any of the Horizon Issues by
       the court to give your view of the likelihood of
       a claimant being right about a claim for £200 being lost
       from an erroneous TC, were you?
   A.  No, but I was asked about discrepancies of various kinds
       and I felt, rightly or wrongly, that this was a useful
       way to present the figures.
   Q.  Okay.  In fairness to you, let's show you your second
       report at paragraph 32.  It is on {D3/7/98}.  If we look
       at paragraph 32 on that page and there you say that your
       revised figure is £1.50 per months rather than £2 per
       month?
   A.  Yes.
   Q.  And you say at the end of that paragraph:
           "So in my opinion, errors in TCs cannot account for
       even a small part of the claimed shortfalls."
   A.  Yes.
   Q.  So it is not just the effect of the calculation, it is
       what you reach a conclusion on?
   A.  Yes.
   Q.  So can we just do another statistical analysis.  Let's
       look at a worked example of Mr Abdulla's case.  Have you
       seen information about his case?
   A.  I have.  I'd need to recollect it.
   Q.  Let me -- assume I'm guiding you correctly about the
       facts.
   A.  I am sure you are.
   Q.  Your average for TCs per branch per month is £1.50.
   A.  Mm.
   Q.  And you say that when your average per branch per month
       was £2 the chance of a £200 erroneous TC is 1%?
   A.  Yes.
   Q.  And so when the average per branch is £1.50 the chance
       of a £200 erroneous TC in month is 0.75%, isn't it?
   A.  That is right.
   Q.  You also assumed that the likelihood of TCs -- erroneous
       TCs hitting a branch were equal across the board?
   A.  Per volume of transactions, yes.
   Q.  Per volume of transactions.  And so the chances of
       an erroneous TC of £1,000 would be what, roughly?
   A.  We started with £200 so it is five times lower.
   Q.  So if we divide 0.75% by 5, the chances of one erroneous
       TC of £1,092, will you take it from me, is 0.14%?
   A.  That feels about right.
   Q.  Feels about right?
   A.  Yes.
   MR JUSTICE FRASER:  To two decimal places.
   MR GREEN:  Thank you.  What is the chances of that happening
       in two months in a row, Dr Worden, on your analysis?
   A.  Let me consider this carefully.  If you believe the two
       months are independent statistically then clearly the
       probability is multiplied, but there may be correlation
       factors, who knows?
   Q.  Yes, and there are two points there.  Let's leave
       correlation factors aside for a moment.  If there were
       no correlation factors, yes?
   A.  Yes.
   Q.  Or other factors, and they were independent variables?
   A.  Yes.
   Q.  The answer is 0.14% x 0.14%.
   A.  Yes.
   Q.  So about a seventh or something of a percent of
       a seventh of a percent?
   A.  Well, what is it?  It is 1 part -- I mean 0.14% is 1
       part in -- sorry --
   Q.  It is 1.5 parts in a thousand, isn't it, roughly?
   A.  So the square of that is 2 parts in 1 million, I think.
   Q.  So that is the chances of two erroneous TCs --
   A.  In two identified consecutive months, say.
   Q.  Two identified consecutive months?
   A.  Yes, or non-consecutive months.  I would be more
       confident about con-consecutive months because I think
       consecutive months might have correlations.
   Q.  And you have not factored in the possibility of
       correlations or indeed concentrations of TCs or any
       factors of those sort in your calculations, have you?
   A.  I haven't, I do not think, gone on to calculate these
       commentorial things about N months at a time.  I could
       have spent a lot of time going about distributions of
       three months here and so on.  I didn't go into that,
       I just went into that one result.
   Q.  Do you accept that looking at what appears actually to
       have happened is quite a good way of testing
       a theoretical model that you constructed?
   A.  Well, the theoretical model -- the conclusion is in the
       absence of other information, and then when we have
       other information we have to consider how that other
       information meshes with our original model and so that's
       complicated.
   Q.  So is it fair to assume that in fact the extent to which
       the reality presented by the claimants departs from your
       theoretical model is likely to be explained by
       information you have not considered?
   A.  Well, when we get to individual claimants, as doubtless
       we will in future trials, we will consider all that and
       we will: think what are the circumstances and how does
       that alter the basic model and so on?  We will do that
       calculation, presumably, but that was not my purpose in
       this report.
   Q.  You accept that your theoretical model is not an obvious
       fit with the facts of Mr Abdulla's case if indeed he did
       receive two erroneous TCs running?
   A.  I have not compared my model with Mr Abdulla's case.
   Q.  I know you haven't, that's why I'm asking you to do it
       now?
   A.  I can't do it now.  I don't know enough about
       Mr Abdulla's case.
   Q.  Well, on the theoretical basis you agree that what we
       see in Mr Abdulla's case does not fit at all with your
       predictions in general so that you would look for some
       explaining factor?
   A.  I haven't done the analysis of Mr Abdulla's case
       compared with my general model.  If I did, I'm not sure
       what I would conclude.
   Q.  But if we just read your report, the chance of
       Mr Abdulla being right about even one erroneous TC
       having been issued is vanishingly small?
   A.  No, because he was in -- I mean the sort of factor one
       has to consider is how many months the claimant was in
       post, for instance.  And as I say, comparing the general
       model with a claimant is a complicated exercise which
       I haven't -- and I hesitate to jump in there now.
   Q.  But you have said at paragraph 32, you have reached
       a conclusion that errors in TCs cannot account for even
       a small part of the claimed shortfalls?
   A.  That's about the claimants as a population.
   Q.  But you have done that without the sort of facts that
       you are now wishing to consider in Mr Abdulla's case?
   A.  I have not considered the claimants as individuals, and
       when we get round to that it will be a whole new set of
       considerations.
   Q.  I suggest to you, Dr Worden, that the assumptions that
       you have made, including the even incidence of TCs
       across the subpostmaster population based on
       transactions, is a false premise to arrive at a reliable
       analysis of the type which you have done?
   A.  I don't agree with that.  I would like to know why you
       say that.
   Q.  We gave the Penny Black example on Tuesday, didn't we?
   A.  We did indeed, we went into that.
   Q.  And someone I think tweeting about the case suggested
       a different example which was very similar?
   A.  I haven't read the tweets, I'm afraid.
   Q.  Let me suggest it to you and see if you accept this one:
       based on lottery winners, a very small chance of winning
       the lottery, you walk into a room and everyone in the
       room says to you, "Oh yes, I won the lottery", "I won
       the lottery", "I won the lottery", and that seems very
       unlikely, doesn't it, until you see the sign on the door
       that says "Lottery Winners' Reception".
   A.  In the Penny Black example and in the example that you
       have just given me we are going into the issue of
       supplemental information and how that alters your
       conclusions based on a base model.  We are also going
       into complicated statistical issues about selected
       populations.  We are going towards advanced statistics.
   Q.  That's what you are an expert in.
   A.  I was very careful in my reports not to use advanced
       statistics.  I was trying to keep it at undergraduate
       level, if you like.  So I'm quite happy to answer
       questions about advanced statistics but in doing so
       I shall be very careful and I need to know the question
       very clearly.
   Q.  I'm going to put a point to you that I'd be happy to put
       to my 13-year-old daughter, which is that when you look
       at a statistical sample the first thing you should do is
       look at the nature of the sample and how they were
       selected?
   A.  Yes.
   Q.  And that is what the Penny Black and lottery examples
       are about, isn't it?
   A.  Well, the Penny Black example led to a conclusion which
       in my cross-examination I queried on one ground, and the
       one ground was that it seemed to me that to follow your
       argument I would have to base my analysis on the
       assumption that the claimants were right, and that
       seemed to me strange and not a thing I could do as
       an expert.  But since then I have thought more about it
       and there's another much stronger reason for not taking
       that example, and the point you were putting to me was
       that the claimants were a self selected population and
       you need to deal with them differently, and that is
       an advanced statistical point.  But why it is not
       relevant to my analysis is that the claimants are
       a self-selected sample and they selected themselves long
       after they suffered their shortfalls.
           So the point you are putting to me effectively is
       these people selected themselves and that somehow caused
       Horizon several years previously to rain bugs on them.
       And so the causation is completely the wrong way round
       between Horizon affecting the claimants and the
       claimants self-selecting.  It doesn't make sense.
   Q.  But, Dr Worden, I'm going to put to you that that is
       a comical explanation.
   A.  It is not comical at all.  It is commonsense that
       causation can't go backwards in time.
   Q.  No one is suggesting that causation goes backwards in
       time.
   A.  Well, I think that's the suggestion that was explicit in
       your Penny Black --
   Q.  I will clarify it to you.  The Post Office's case is
       that large numbers of subpostmasters are perfectly happy
       with the Horizon system and do not feel they have
       suffered from unjustified shortfalls.
   A.  Yes.
   Q.  But others do feel they have.
   A.  Yes.
   Q.  How many of the former group do you think you would
       expect to join a group action complaining about
       something they haven't suffered?
   A.  I don't know the answer to that question but I would not
       expect many.
   Q.  No.  Zero or close to zero?
   A.  Yes.
   Q.  If you were aggrieved because you believed that you had
       in fact suffered in that way and you were afforded the
       opportunity of redress, do you think the fact that you
       believe you have suffered in that way is a material
       factor in your decision whether to join the group action
       or not?
   A.  It is a material factor, and it is not a material factor
       in whether Horizon during your tenure caused bugs to
       you.
   Q.  But Dr Worden, just because you join doesn't mean that
       we go back to the future with the professor in the
       DeLorean and Horizon causes problems in the past?
   A.  Exactly.  That is precisely what I'm saying.
   Q.  But you do recognise, don't you, that you accepted that
       identifying how a sample has been selected is important.
       Take it in stages.  You accepted that?
   A.  I accepted that and --
   Q.  And the importance of the sample in this case is you are
       capturing what Post Office themselves call a small
       minority of people who, whether they are right or wrong,
       are all people who feel strongly enough to join the
       group action that they have suffered these shortfalls?
   A.  Yes.  They have self-selected.
   Q.  Yes.  So there is a factor which applies to them which
       does not apply to people, the vast majority --
   A.  But that factor did not apply when they were suffering
       from shortfalls.
   Q.  You genuinely can't see, are you saying, the relevance
       of the sample you're dealing with --
   A.  I'm saying the causation is back to front, and causation
       is what's at issue here.
   MR JUSTICE FRASER:  All right.  I'm going to bring this
       sequence of cross-examination to an end, Mr Green.
       I think it has probably gone on long enough.
   MR GREEN:  I understand.  My Lord, may I just put what
       techniques the expert said he had in fact applied in
       that?
   MR JUSTICE FRASER:  Yes.
   MR GREEN:  Can we look please to {Day18/10:6}.  You were
       asked about having your CV and you have given evidence
       in software development methods and advanced statistical
       techniques.  You said yes.
           You were then asked at line 13:
           "Question:  The phrase 'advanced statistical
       techniques' reflects the application of the expertise
       that you have just been talking about?
           "Answer:  Absolutely.  I believe that the statistics
       I have applied as a scientist particularly but also as
       an engineer goes to the point of advanced statistical
       techniques."
   A.  Yes.
   Q.  Do you now say that you have not applied advanced
       statistical techniques in the approach in your reports?
   A.  What I say is I was encouraged and I took the advice
       that the techniques I have applied in my reports are
       elementary statistical techniques.
   Q.  Who encouraged you to do that?
   A.  The Post Office lawyers were telling me to keep it
       simple, basically, and I was encouraged -- and I felt my
       duty was to provide explanations to the court which the
       court could readily understand, so I did not want to go
       into advanced statistics for that purpose.
   Q.  A final question on this, Dr Worden, and then we will
       move on.  Did you come up with the idea of an even
       distribution across all claimants or did somebody else?
   A.  I did.
   Q.  Can we move forward, please, to Issue 4, for which we
       will go back to {C1/1/1}, please.
           You can see Issue 4:
           "Controls and measures for preventing/fixing bugs
       and developing the system."
   A.  Mm.
   Q.  That's the general heading, and then the specific
       question at question (4) is:
           "To what extent has there been potential for errors
       in data recorded within Horizon to arise in (a) data
       entry, (b) transfer or (c) processing of data in
       Horizon?"
           I want to ask you about (a), data entry first,
       please.  Data entry clearly includes the potential for
       mis-keying, doesn't it?
   A.  It does.
   Q.  And at {D3/1/63} you say there -- you refer to -- at
       paragraph 222, under the heading at 6.1.1 "Detection of
       User Errors" or DUE, you say:
           "In the design of the Horizon counter user
       interface, there are large numbers of measures to
       prevent user errors."
   A.  Yes.
   Q.  "Many of these measures have by now become common
       practice in the design of user interfaces - such as the
       use of menus and buttons, rather than free text input
       ..."
   A.  I was there referring to a common practice rather than
       specifically Horizon, I guess.  Horizon has plenty of
       buttons, not so many menus.
   Q.  So having a screen with a first class stamp button on it
       is one of the factors that you think is helpful?
   A.  For instance, yes.
   Q.  As an example.
   A.  Yes.
   Q.  And you haven't actually had any regard to the specific
       layout of the individual screens, have you?
   A.  I haven't tried to redesign screens myself or to
       consider how they might have been better.  I think that
       is a very dangerous exercise for an IT engineer to do
       actually.
   Q.  Because it is not your field of expertise?
   A.  Well, I have run a field of -- a team of user interface
       experts and we did user interface design for things like
       air traffic control, and the one thing that I learnt is
       the designer's prejudices about what is a good user
       interface or not are not to be trusted, and one thing
       you have to do is user trials to find out what works.
   Q.  Yes.  And that is a very important part of having
       a robust system?
   A.  Yes, user interfaces should be tried out and evaluated.
   Q.  Yes.  And if you get it wrong that increases the
       potential for mis-key errors, doesn't it?
   A.  It would do, yes.
   Q.  At paragraph 224 {D3/1/64}, you say:
           "The Claimants have drawn attention to the user
       error of 'mis-keying', to the question of how well
       Horizon prevented mis-keying, and whether Horizon might
       have prevented it more effectively."
           Yes?  And at paragraph 226 you refer to the
       Mis-Keyed Project Feasibility Study, 2012?
   A.  Right.
   Q.  Which you deal with in appendix C1.
   A.  Yes.  I haven't read that lately, I'm sorry.
   Q.  If we look at {D3/2/40} and we look at paragraph 131,
       there you say:
           "The Post Office internal feasibility study makes it
       clear that Post Office were concerned at the costs
       incurred as a result of mis-keying."
           Yes?
   A.  Yes.
   Q.  You say:
           "However, the background section of the report makes
       it clear that the costs of concern were Post Office's
       central costs, and were not costs or discrepancies in
       accounts in the branches."
   A.  Yes.
   Q.  Did you actually read that document or did someone else
       write that for you?
   A.  I read it and wrote it.
   Q.  So you read that.  You read the document, the background
       document, and you wrote this that we just --
   A.  Yes.  My strong impression from the background document,
       reading the whole of it, was that the emphasis was
       central costs in Post Office.
   Q.  And you feel you read that document with the same care
       that you read other documents you read in the case?
   A.  I think so, yes.  I mean --
   Q.  Let's look at it {F/932/1}.  Let's look at the front of
       it first.  "Mis-Keyed Project Feasibility Study", this
       is the one.
   A.  Okay.
   Q.  And we will find the background section to which you
       referred on page 4 {F/932/4}.  Let's look at the first
       paragraph of the background section to which you have in
       fact expressly referred.  It says:
           "As part of the P&BA centre of excellence drive, one
       of the areas of concern is the number of instances of
       mis-keyed transactions that occur and much to the
       detriment of P&BA. A mis-keyed transaction occurs when
       an incorrect value is input by the counter clerk, which
       causes a poor customer experience."
           Then this:
           "The mistake can have a significant impact on the
       branch and resource is required in P&BA to manage the
       client and address the error. A very large value
       mis-keyed transaction will put the viability of a branch
       in doubt."
   A.  Mm.
   Q.  Why did you not mention that impact in your summary of
       the background?
   A.  The last sentence I agree I did not -- it didn't
       register with me, but it seemed to me that poor customer
       experience and impact on the branch, and it seemed to me
       that basically mis-keying can lead to errors and it
       leads to costs having to correct those errors, and
       certainly large impacts in my opinion are very likely to
       be corrected.
   Q.  Taking your evidence on its face first, the passage that
       you have referred to absolutely does identify that costs
       and discrepancies in branch accounts were of concern.
   A.  It says "impact" on the branch.  And it does -- I agree
       with you the last sentence does say that it has impact
       on the branch, but the general tenor of the document
       seems to me that it is saying, look, this stuff occurs,
       we can correct it, but it is costing us money to correct
       it --
   Q.  Are you being scrupulously fair in your answers,
       Dr Worden, on that point?
   A.  I agree with you that that last sentence of that
       paragraph I had not paid attention to in my summary.
   Q.  I'm going to suggest to you that that is not
       a scrupulously fair answer.  Do you agree?
   A.  I think I have answered your question fairly.
   Q.  Is it scrupulously fair?
   A.  Scrupulously fair?  I'm trying to be as fair as I can,
       certainly.
   Q.  Are you?  Can I suggest you might wish to try harder
       when we look back at what it actually says in the first
       paragraph.
           Come four lines down.  If you look -- if you come
       four lines down, about two inches in from the left-hand
       side margin:
           "The mistake can have a significant impact on the
       branch."
   A.  Sorry, where are we?
   Q.  Four lines down.
   A.  "... impact on the branch ..."
           Yes, that --
   Q.  No, no.  Do you see?
   A.  Yes, I have got that sentence.
   Q.  You have got the sentence that says:
           "The mistake can have a significant impact on the
       branch ..."
   A.  Yes.
   Q.  And you were trying to limit your agreement in answer to
       my questions only to the last sentence which says:
           "A very large value mis-keyed transactions ..."
   A.  Yes, but that sentence which you quoted to me goes on to
       say:
           "... resource is required in P&BA to manage the
       client and address the error."
           So the impact on the branch in that sentence is not
       assumed to be but is implied to be a temporary impact
       because it gets corrected.
   Q.  It does not say correct the error necessarily, does it?
   A.  "Address the error", I mean obviously addressing is
       trying to correct.
   Q.  The other point you have not mentioned in this document
       is recommendations on the document weren't in fact acted
       on, were they?
   A.  I didn't follow through, no.
   Q.  Did you know that Post Office had not acted on the
       recommendations in this document when you wrote your
       reports, either of them?
   A.  I cannot recollect exactly what I knew or did not know,
       but I have not paid attention to whether the Post Office
       actually acted on the recommendations because, as I say,
       user interface issues are very complicated and
       I hesitate to be an armchair critic, if you like, of
       somebody's user interface design and what steps they
       took to improve it.  That is a complicated issue when
       you look at -- say somebody said "We can improve the
       design.  What do we do about it?  Let's run some
       trials".  And what's the virtue of changing the design
       versus the virtue of keeping it stable?  For all those
       postmasters who are using it perfectly correctly, you
       want to keep user interface stable over the years.  So
       there are those trade-offs, all of which I haven't
       looked at.
   Q.  Last question.  Despite having done a lot of work on
       user interfaces, you didn't actually try to analyse how
       user friendly or prone to mis-keying the interfaces
       were, did you?
   A.  I felt it was a difficult thing to do precisely for the
       reason I have said --
   Q.  Yes or no?
   A.  No, I did not.
   MR GREEN:  Thank you very much.
           Is that a convenient moment, my Lord?
   MR JUSTICE FRASER:  I think it is.  This doesn't affect you,
       Dr Worden.  But if you want to go back to that
       spreadsheet, I suggest one of your colleagues or you
       maybe -- I would say based on my experience of the
       bigger documents when I access them from my desk, five
       minutes is probably ...
           Thank you, 2 o'clock.
   (1.00 pm)
                     (The short adjournment)
   (2.00 pm)
   MR GREEN:  Dr Worden, at 2 minutes past 1 today we received
       a big spreadsheet about ARQ requests in 2013.  Is the
       number of ARQ requests something that you know much
       about?
   A.  No.
   Q.  Okay, I will leave that.
   MR JUSTICE FRASER:  Did that come with a covering letter, by
       any chance?
   MR GREEN:  I think there may be one, my Lord.
   MR JUSTICE FRASER:  All right.  Let's move on.
   MR GREEN:  I'm most grateful.
           Picking up where we left off before lunch.  Can
       I ask you please to look at {F/1848.8/1}.
   A.  This is the big spreadsheet, is it?
   Q.  Yes, it is the big spreadsheet.  This seems relatively
       old in the sense it was disclosed on 31st May of this
       year, but it is a draft input and information -- it is
       "Draft Input & Information Provided to Support the
       Post Office Internal Process" -- sorry, this is the
       wrong one.  Sorry.  Can we get 1848.8.1, please?  We
       will come back to the table in a minute.  We are after
       {F/1848.8.1/1}, please.
   MR JUSTICE FRASER:  Are you looking at the common screen?
   MR GREEN:  Yes.
   MR JUSTICE FRASER:  Is that not what you were expecting?
   MR GREEN:  No.  My Lord, it is a normal document.
       {F/1848.8.1/1}.  That's very kind, thank you.
           Now, you see this is a -- this document is headed
       "Draft Input & Information Provided to Support
       Post Office Internal Process".
   A.  Yes.
   Q.  Now, this is a document relating to an incident on
       4th March 2019.
   A.  Right.
   Q.  So it is a recent matter in that sense.
   A.  Yes.
   Q.  And if we look at page {F/1848.8.1/2} and we look at the
       box that says "What's the issue?", do you see that?
   A.  Right, okay.
   Q.  Just pause.  Have you seen this document before or not?
   A.  I think there is something familiar about it actually.
       I remember being puzzled about the phrase
       pre-announcement interface and I'm still puzzled about
       it.
   Q.  Okay.  Let's just see what we can understand about it:
           On 4th March an incident was raised that there were
       failures in the pre-announcement interface to Horizon.
           "The result of this was that branches had to
       manually key the value of pouches received into Horizon
       on receipt, rather than scanning a barcode for automatic
       population of data including the value."
   A.  Yes.
   Q.  "This led to some manual keying errors where the wrong
       value was keyed into Horizon."
   A.  Yes.  So pre-announcements are something to do with
       remming cash.
   Q.  Let's not focus too much on pre-announcement, let's look
       at what the problem is, if we may?
   A.  Sure.
   Q.  Let's take that bit in stages.  The advantage of having
       a scanner and a barcode is that if the system is working
       correctly it will correctly rem in that patch?
   A.  Yes.
   Q.  So in a sense, that is a desirable aspect of a system in
       general?
   A.  Yes.
   Q.  And that wasn't working, we can see?
   A.  As a result of the pre-announcement failure, yes.
       That's interesting.
   Q.  So the branches had to manually key the value of the
       pouches received into Horizon on receipt?
   A.  Yes.  So they had to count the cash, it feels like --
   Q.  No, they had to key in the value.
   A.  So there is a label which says --
   Q.  Yes.  Okay?  This led to some manual keying errors where
       the wrong value was keyed into Horizon.
           Then if you look in the "Impact", it says:
           "Branch: some manual keying errors resulting in
       overstated sterling or foreign currency positions."
           Yes?
   A.  Yes.
   Q.  You see there is no number of branches identified there,
       next to that?
   A.  That is right, yes.
   Q.  And under "Impact" you see in brackets:
           "Include number of branches impacted and the detail
       of the impact."
   A.  Yes.
   Q.  And the financial accounting impact is:
           "Holdings at branches needed to be corrected."
   A.  Yes.
   Q.  So at this stage what is showing on the face of the
       Horizon system is wrong as a result of what has
       happened?
   A.  Yes.
   Q.  And it says:
           "Some manual keying errors ..."
           Yes?
   A.  Yes.
   Q.  Resulted -- as a result the wrong value was keyed in,
       yes?
   A.  Yes.
   Q.  Just pausing there.  Would you regard that happening as
       a problem with the system or would that be the
       subpostmaster to blame?  From your perspective as
       an expert looking at the reliability of the system?
   A.  Well, obviously failures in pre-announcement is some
       sort of failure in the system which causes a higher
       propensity to keying errors.
   Q.  Yes.  And it looks from that at least that the keying
       errors might be those of the SPMs?
   A.  Yes, it sounds like it.
   Q.  If we look at page {F/1848.8.1/3} and we go down to the
       entry on 8th February:
           "This communication to all branches had already been
       sent based on a previous incident, reminding them not to
       enter decimal places and to take extra care when
       entering remittances manually."
   A.  Yes.
   Q.  What they say there is:
           "When entering a sterling (notes/coin) or foreign
       currency Remittance manually onto Horizon NEVER enter
       the value by including a decimal point followed by two
       zeros."
   A.  Yes.
   Q.  That's quite a common way of putting numbers into
       systems, isn't it?
   A.  I must admit it looks strange to me, because I think
       somewhere else in this document you get quite a big
       error if you put the decimal points in.
   Q.  Let's look at that.  You are obviously familiar with the
       document?
   A.  I have seen the document before, yes.
   Q.  So taking it in stages, if we may.  From a design
       perspective if you want to avoid errors of this type,
       that set up is not really as you would have designed it
       Dr Worden yourself, is it?
   A.  As I say, I'm very afraid of taking a user interface
       decision myself, but it does seem strange to me, yes.
   Q.  It is bizarre, isn't it, actually?
   A.  I don't know.  There must have been some reason for not
       entering decimal points.  I don't know what the reason
       might be.
   Q.  Let's have a look.  What he says is:
           "Doing so will result in incorrect totals being
       entered ..."
   MR JUSTICE FRASER:  Where are you?
   MR GREEN:  This is at the bottom of that box, do you see?
       On page 3.
   A.  Which box?
   MR JUSTICE FRASER:  8th February 2019.
   A.  Ah yes, sorry.
   Q.  Sorry, it's slightly --
   A.  "Doing so will result in incorrect totals being entered
       ... extra care ..."
           Yes.
   Q.  Do you see:
           "Doing so will result in incorrect totals being
       entered.  Please take extra care when entering
       remittances in manually."
           Yes?
   A.  Yes.
   Q.  If we go over the page, please {F/1848.8.1/4}, you can
       see the 5 March.  Do you see that?
   A.  Yes.
   Q.  "This communication to all branches was sent following
       the new pre-announcement interface issue:
           "We have seen a higher than normal number of
       incidents where Foreign Currency remittances did not
       auto populate which required branches to manually key
       the amount into Horizon. As a consequence of this we
       have become aware of some branches mis-keying either the
       wrong currencies and/or amounts into Horizon which will
       result in a mis-balance in branch at declaration stage.
       This will also mean that your automated currency
       replenishments will be affected."
           And so forth.
           At the bottom it says:
           "A general remainder for all branches to take extra
       care if they are required to manually enter remittance
       values into Horizon."
           Do you see that?
   A.  Sorry, I'm just reading the bullets in between.
   Q.  Please do.
   A.  Right, okay.
   Q.  Now there's no hint there that the problem is about the
       missing decimal point, is there, on the 5th?
   A.  This announcement to the branches doesn't seem to
       mention the decimal point issue explicitly, I agree with
       that.
   Q.  If we look, please, over the page {F/1848.8.1/5}, we
       have got on -- sorry, can we just go back.
       {F/1848.8.1/4}
           When it printed out, my Lord, ours looks different.
       Just give me one second.
           If you look on 4th March at the bottom of that page,
       do you see:
           "Formal incident ... raised during back office
       transformation early life support and issued to
       Fujitsu."
           Yes?
           "Status Update"?
   A.  Yes.
   Q.  Then if we go forward, please, a page {F/1848.8.1/5},
       you will see there that there is -- if we look at
       6th March 2019, if you look down you will see -- they
       are not in order, but there is a second 6th March 2019
       saying:
           "Report showing list of failed pre-announcements
       requested --"
   A.  Oh, yes.  It messes the order around.
   MR JUSTICE FRASER:  Sorry, where are you reading?
   A.  After the 7th it goes back to the 6th again.
   MR GREEN:  Yes.  Do you see that?
   A.  "... list of failed pre-announcements requested, to be
       cross checked against branch rem-ins."
   Q.  Yes.  If we go over the page {F/1848.8.1/6}, we can see
       what the errors actually look at -- look like from
       branches that have reported a keying error?
   A.  Yes.  And the interesting thing here is some of them are
       a factor of 100 and some of them are a factor of 10,
       I think.
   Q.  Which one is a factor of 10?
   A.  3,500 booked as 35,000.
   Q.  So there appears to be one that looks as though it might
       be a factor of 10, but all the others are a factor of
       100 --
   A.  -- I haven't checked it out but there's both there, yes.
   Q.  So it looks like, for the most part, entering in
       10,000.00 euros gives you a mis-keying error by entering
       instead 1,000,000 euros?
   A.  You usually get a factor of 100.
   MR JUSTICE FRASER:  There are at least two that are a factor
       of 10, I think.  Meliden Road and New Quay.
   Q.  But for the most part it looks like they are mostly
       multiplied by 100?
   A.  Yes.  And I suppose the factor 10 could be where they
       have entered one decimal point.
   Q.  It might be.  That is not an ideal design, is it?
   A.  It doesn't seem good to me.  The only remark I would
       make is this was something that was not part of the
       mainstream design.  The mainstream design was do the
       barcode.
   Q.  Understood.  But the barcode failed, and as a result the
       system was designed in such a way that if people entered
       in what's a perfectly reasonable approach to entering in
       a number, they risked a multiplication of the sum by 10
       or 100.
   A.  I agree, this feels strange to me.  But I hesitate to do
       armchair design of user interfaces.
   Q.  But I'm not talking about armchair design of user
       interface, I'm saying if their report of how the system
       reacts is right, that is going to enter into the system
       an incorrect figure --
   A.  Yes, yes.
   Q.  -- and the figure on the system will be wrong?
   A.  Yes.
   Q.  And it will then have to be corrected by a transaction
       correction?
   A.  Well, there's two safety nets here.  There's TCs, if it
       is discovered centrally, and there's also the daily cash
       count which would also pick it up.
   Q.  I'm not talking about discovery, I'm saying it has to be
       corrected by a TC.  That's what they say in --
   A.  Not necessarily -- oh, yes, I think if you are doing
       a cash count and you see a discrepancy, you don't -- do
       you correct it at the time?  I'm not sure.  But the
       postmaster would see a discrepancy in his daily cash
       count.
   Q.  If you can't reverse a rem in and there is an error, if
       you take it from me, on the premise that you can't
       reverse a rem in, if that is right --
   A.  Well, on Dalmellington they did reverse rems.
   Q.  Let's take it in stages.  If you can't reverse a rem
       in --
   A.  If you can't.
   Q.  -- it has to be corrected by a transaction correction?
   A.  And you may well ask for one, you say.
   Q.  If you can, there is an opportunity if you spot it
       potentially for the subpostmaster to do it?
   A.  Yes.
   Q.  What we know here is that the subpostmaster reported
       a keying error, and we can see in this document that, if
       we look back at page {F/1848.8.1/2}, in
       "Financial/Accounting Impact":
           "... needed to be corrected."
           Do you see that?
   A.  Yes.
   Q.  And if we go forward one page to 27 February,
       {F/1848.8.1/3}.
   A.  I have the 28th.
   Q.  There we are.  Do you see on 27 February:
           "Branches who called the to report the issue were
       advised to declare the correct cash on hand at branch.
       Branches who have made keying errors will receive
       transaction corrections processed by the FSC."
   A.  Yes.
   Q.  So it is right, isn't it, Dr Worden, that first of all
       what we have there is a defect in the system in that the
       scanner remming in didn't work?
   A.  The announcements somehow caused that, yes.
   Q.  But we had a defect, yes?
   A.  It does seem to be.
   Q.  And that caused subpostmasters to have to manually enter
       in the figures?
   A.  Yes.
   Q.  And do you accept that having that decimal point problem
       is also a defect in the system?
   A.  As I say, it seems a strange user interface to me.
   Q.  Yes.  But come on, it is a defect?
   A.  It is not good.
   Q.  It is a defect?
   A.  I hesitate to say it is wrong.  It probably is wrong.
   Q.  Thank you.
           If we can finally look at what I have got as page
       {F/1848.8.1/5}, it is 7 March 2019.  Let's go back to
       that, please.
           We looked at this.  If you look at the bottom
       populated row, 7/3/19.
   A.  Yes.
   Q.  "Issue discussed at BOT Steerco. Action logged to follow
       up with Fujitsu requested to confirm process and
       controls in place to ensure that this is proactively
       managed in the future."
           That doesn't suggest necessarily a fix, does it?
   A.  I would have to read the whole thing.  And I agree that
       if the coder -- supposing there was some error in code,
       supposing pre-announcement failure was an error in code
       somewhere, which I don't know, and supposing that had
       been fixed, then this last comment is -- I would have to
       take time to try and understand what that meant.
   Q.  In your experience of systems of this sort, when we
       looked at the communication to the branches, which
       didn't actually spell out the decimal point problem
       immediately afterwards, is that how you have seen people
       generally communicate with their users in the past?
   A.  Well, I think earlier in here we saw some say -- some
       statement that says you must advise the branches not to
       do the decimal point.  Then we saw another announcement
       which didn't refer to the decimal point.  And again
       I would like to untangle what those two mean together.
   Q.  Dr Worden, the short point is this: the earlier one
       referred to in the 8th February 2019 specifically says:
           "... NEVER enter the value by including a decimal
       point followed by two zeros."
   A.  Can we go back to that and see what the status of that
       sentence is?
   Q.  By all means.  It is on page {F/1848.8.1/3}, I hope.  Do
       you see the guidance to the word "never" in capitals?
   A.  So some communication to branches had been sent on
       a previous incident, and that's what's said about the
       decimal point, but on this one they didn't for some
       reason.
   Q.  Yes.  So we can see what was said on the previous
       incident, highlighting the problem and telling people to
       avoid a decimal point, yes?
   A.  Yes.
   Q.  After the problem actually causing some quite big
       discrepancies, the communication that they actually send
       out on 5 March, on the next page --
   A.  Sorry, can we go back.  I was just reading that page.
   Q.  I think we have done 8th February.
   A.  I'm reading the 18th now.
           Yes.  Okay, thank you.
   Q.  {F/1848.8.1/4}.  So the 18th February one doesn't say
       anything about the decimal point?
   A.  No, but I think what we seem to have is the 8th February
       says don't do this, and the 18th February says if you
       have done this and there is a problem, do this.
   Q.  Well, what it doesn't say is that the problem is
       actually -- I mean, if you look at the way it is phrased
       in the second line, it says:
           "As a consequence of this we have become aware of
       some branches mis-keying ..."
   A.  I'm on the wrong page.
   Q.  Sorry, go up, please. {F/1848.8.1/3}
   MR JUSTICE FRASER:  Are we looking at the 5th March entry?
   MR GREEN:  We are trying to look at the top of the 18th
       February, my Lord.
   MR JUSTICE FRASER:  We need to go back to page 3, please.
   A.  Right.
   MR GREEN:  So let's look at the second line there.  Well,
       let's read the whole thing:
           "We have seen a higher than normal number of
       incidents where Foreign Currency remittances did not
       auto populate which required branches to manually key
       the amount into Horizon. As a consequence of this we
       have become aware of some branches mis-keying either the
       wrong currencies and/or amounts into Horizon ..."
   A.  Yes.
   Q.  They don't say that's because of a failure with the
       system itself --
   A.  Sorry, they then say or they don't say?
   Q.  It does say it didn't auto-populate?
   A.  Yes.
   Q.  Then it says:
           "As a consequence of this we have become aware of
       some branches mis-keying either the wrong currencies
       and/or amounts into Horizon which will result in
       a misbalance in branch at declaration stage."
   A.  So this announcement is covering two cases, an error in
       the number and an error in the currency.
   Q.  Well, the announcement is referring to two cases which
       we don't seem to see any examples of in the list?
   A.  We don't in the ...?  Sorry, I missed that.
   Q.  We didn't see any examples of that in the list at the
       back here?
   A.  No, we didn't.  We saw amounts only in the list.
   Q.  And it doesn't refer to the problem with the decimal
       point, does it?
   A.  This one doesn't.  As I say, the 8th February says --
   Q.  Take it in stages.  We know the 8th does.  This one
       doesn't.  There has just been an incident.  What is
       happening is if you put in a decimal point and two zeros
       on Horizon in a way that you have accepted is wrong, it
       adds the two zeros or the one zero to the number, and it
       doesn't say that?
   A.  This announcement doesn't say that.  This announcement
       says when this damage has been done here's what you do.
   Q.  And if you want users to be able to diagnose what is
       going wrong, you need to tell them what the problems
       with the system are candidly, don't you?
   A.  I demur from that.  Telling users about problems in the
       system is -- can be too much information.  Telling users
       what to do is what I think is most useful.
   Q.  So were they right or wrong to mention the decimal point
       the first time?
   A.  They were right.
   Q.  Were they were right or wrong to not mention it the
       second time?
   A.  I don't know.
   Q.  Dr Worden, when there's just been a flash of people
       getting £900,000 discrepancies, things like that, if you
       are being candid you say: this is due to a fault, or
       whatever you want to call it, in the system by which the
       decimal point is ignored?
   A.  You might say that --
   Q.  If you were being candid you would --
   A.  If we return to the point that the first announcement
       was don't do this, and the second announcement was if
       you have got problems from either amounts or the right
       currency here's how to fix them, here's how to sort it.
           So the purpose of the two announcements are rather
       different and I don't know enough background to say that
       the decimal point point should have been repeated.
   Q.  Let's go to the table, the Excel spreadsheet, which I
       think very kindly we have very got prepared to come up,
       which is what we were going to look at before.  This is
       the one that you had a bit of a poke around in?
   A.  Yes.
   Q.  To get the table that you have referred to, and we will
       have a look at it in a minute, at table 9.3 in your
       report?
   MR JUSTICE FRASER:  Can you just remind me of the trial
       bundle reference of this.
   MR GREEN:  Certainly, I was just about to read it out
       {D3/1/208}.
   MR JUSTICE FRASER:  No, the one on the common screen.
   MR GREEN:  I apologise, my Lord.  It is {F/987/1}.
   MR JUSTICE FRASER:  Okay.
   MR GREEN:  You went down to look for the relevant table to
       use and had a look around.
   A.  Yes, but obviously the most relevant table was the one
       that appeared in my report.
   Q.  I understand.  That was the one you felt was most
       relevant?
   A.  Yes.
   Q.  And if we go down to row 46, please?
   A.  That's a header.
   Q.  Yes.
   A.  "Volume net value."
   Q.  That is the table you reproduced?
   A.  That's it, okay.  The numbers look familiar.
   Q.  Yes?
   A.  Yes.
   Q.  That's the one you reproduced, and it is to do with
       branch errors, isn't it?
   A.  Yes.
   Q.  You did not reproduce the table immediately below it
       which is for other errors, did you?
   A.  That's true, yes.
   Q.  Why not?
   A.  Well, why would I have wanted to?  (Pause)
           For completeness it would have been useful but
       I felt -- as far as the distribution of TCs and the
       distribution of erroneous TCs, but I agree I could well
       have quoted that last table and it would have been
       useful to do so --
   Q.  I'm going to ask you to give his Lordship a candid
       answer: was that a mistake or was it deliberate?
   A.  It certainly wasn't deliberate.  It wasn't, if you like,
       an oversight or a wrong editorial decision, if you like.
       But the question I'm asking myself is how that adds to
       the information?
   Q.  Isn't it obvious, Dr Worden?  TCs that do not arise from
       what even Post Office regards as branch errors might be
       highly relevant to any analysis that you might wish to
       conduct?
   A.  Well, my intent in looking at this top table was to get
       an idea of the proportions.  Now, if we find that the
       proportions in the bottom table radically alter the
       overall proportions, then that is a problem.  But I was
       looking at the proportion -- what I was looking at was
       how big is this, how big is that, and so on.  And indeed
       I overlooked some issues in my first report.  I didn't
       spot the fact that Santander online banking, while small
       in volume was huge in value, and that's an important
       point in my second report.
           So I was looking for overall proportions to say what
       are the important things here.
   Q.  If we just look, the bottom table is the table that even
       in Post Office's mind relates to TCs which were not
       branch errors?
   A.  Yes, absolutely.
   Q.  It is rather what this litigation is concerned with,
       isn't it?
   A.  No, I do not think so.  That is not -- TCs arising from
       other areas is TCs arising from something not in the
       branch, but that TC is probably correct and therefore
       not imputed on the branch.
   Q.  So cash rems to branches, 2011/12 out-turn.  The fact
       that there are 4,093 TCs, which even in Post Office's
       mind are not the result of a branch error, is not
       relevant to your analysis of how the system works?
   A.  Well, 4,000 as opposed to 21,000 in the table above.  It
       is an interesting figure, that, and I hadn't really
       drawn my attention to it at the time of my first report,
       I agree.
   Q.  We know that.  That is the premise of my question.  When
       you answered my earlier question you said it was either
       an oversight or an editorial decision.
   A.  I was not very conscious of that second table.  In other
       words, I said what's the table to put in as the summary
       of the proportions, and I chose that table.
   Q.  The word "chose" suggests it was a conscious choice
       between the two.  It wasn't.  You just found one and
       popped that in --
   A.  I found one which I thought was indicative of the
       proportions and I used that one, yes.
   Q.  Let's move on.
           Now, you gave evidence earlier I think, and I think
       this is common ground, that you and Mr Coyne adopted
       slightly different approaches.  You adopted more of
       a top down --
   A.  The whole thing, to the whole --
   Q.  Yes.  And started the architecture and looked into the
       KELs, and Mr Coyne was looking through the KELs and
       PEAKs and so forth trying to identify --
   A.  Well, I should say I started the architecture, looked at
       the processes and looked at the KELs, yes.
   Q.  I think you started with the 75 documents Mr Jenkins
       gave you?
   A.  That is right, there was an early tranche --
   Q.  Was he able to describe those documents and what to look
       at when you spoke to him?
   A.  No, it wasn't Mr Jenkins who gave me those 75.  I had
       this early tranche of documents which was mainly high
       level architecture stuff.
   Q.  Do you know who those were provided by?
   A.  Just lawyers said "Look at these", you know, it was
       really early months.
   Q.  I see.  And in the second --
   A.  I mean they said "More's coming but here's something to
       go on".
   Q.  I understand.  In the second joint statement I think you
       and Mr Coyne, if we look at {D1/2/28}, that's the second
       joint statement.  If we look on page 28 at item 1.8.
   A.  "Extent".
   Q.  You make the point at 1.8 with regard to extent, yes?
   A.  Yes.
   Q.  You say:
           "In order to address Horizon issue 1, it is
       necessary to define measures of the extent of bugs with
       possible impact on branch accounts."
   A.  Yes.
   Q.  So you appreciated that was necessary for the purpose of
       Horizon Issue 1?
   A.  That's my view, yes.
   Q.  And having some sort of idea for the order of magnitude
       of something is obviously quite a good starting point,
       isn't it?
   A.  Yes.
   Q.  Is it 1 or 10 or --
   A.  Also, I mean not only the question is it 1 or 10, but
       what's the scope with which -- in other words, if I'm
       asking a question about likely, what is the scope of
       likely that is interesting?
   Q.  We will come to that.  But if you look at a particular
       bug and you are just looking to try and identify the
       data, it is helpful to know whether it affects one
       branch alone or perhaps 10 or 20?
   A.  Absolutely, yes.
   Q.  Because that is a significant difference for the
       purposes of what you might infer from it.  And we agreed
       on Tuesday that if it has actually impacted a branch and
       the branch accounts, it obviously had the potential to
       do so.  Yes?
   A.  I agree with that, yes.
   Q.  But in order to have the potential to do so it is not
       necessary to find that it actually did in a particular
       case?
   A.  I think potential is wider than actual, yes.
   Q.  Exactly.  I want in a moment to take you to some of the
       bugs specifically and go through them, but can I just
       clarify one point first in relation to paragraph 650 in
       your first expert report at {D3/1/153}.
   A.  650, I will just get that.  Yes, "Receipts/Payments
       Mismatch".  Okay, that is the beginning of the analysis
       of the receipts/payments mismatch, yes.
   Q.  If we look at page {D3/1/153}, you will see there that
       in paragraph 650 you are referring to the receipts and
       payments mismatch issue, yes?
   A.  Yes.
   Q.  You refer to where it is in Mr Coyne's report, you say:
           "It involved a bug in Horizon which was triggered by
       a rare circumstance (which one would not expect to be
       exercised in testing) and which had an effect on branch
       accounts."
           Then you say:
           "If Mr Godeseth's evidence about this bug is not
       accepted, I shall revise my opinions accordingly. They
       are based on written evidence - particularly on a
       written analysis by Gareth Jenkins ..."
           Yes?
   A.  Yes.
   Q.  "... as well as the second witness statement of
       Mr Godeseth."
           Pausing there.  Were they not also based on the
       conversation you had specifically had with Mr Jenkins
       about the receipts and payments mismatch bug?
   A.  That helped to clarify my understanding of the
       documents.  I could read the documents I think with
       a little more confidence once Mr Jenkins had explained
       some things.  I was particularly interested in double
       entry accounting and how that applied and the
       conversation with Mr Jenkins did clarify that.
   Q.  What was Mr Jenkins able to add that we don't find in
       the documents, if anything?
   A.  It was not so much that he added anything, it was that
       I had -- not in the documents -- I had started from my
       own experience and my own thoughts about system design
       and I had thought double entry accounting might be
       applied in a certain way.  And it appeared, it emerged,
       as Mr Jenkins' document made clear, and he I think
       reinforced to me, that double entry accounting is not
       applied to the roll over in quite the way I had
       understood.
   Q.  And what was the difference between what you had
       understood and what he told you?
   A.  That certain operations in the roll over were not double
       entry.
   Q.  And which were those?
   A.  It was to do with calculating a final month figure from
       an initial month figure and adding all the transactions,
       as I recall.  I realised, reading Mr Jenkins' document
       again in the light of that conversation, that double
       entry accounting was applied in Horizon in more
       complicated ways than I had understood.
   Q.  Did you set that out -- set out that more nuanced
       understanding in your report somewhere?
   A.  I believe I did.  If we look at DEA in this section
       I believe we will find the reference to the fact that
       DEA -- here we are.  654.2 is pretty much it.
   Q.  That's what came from Mr Jenkins, did it?
   A.  That's what came from my final understanding of the
       documents, having had a few words from Mr Jenkins which
       made it clearer to me and made me think about how double
       entry accounting might be applied in such a system and
       the fact that, for accumulation exercises like that, it
       may well be sensible not to apply double entry
       accounting in the kind of direct way which I had first
       thought was appropriate.  So this was a matter of my
       experience versus the documents, if you like.
   Q.  So you were expecting double entry accounting to apply
       across the board and you discovered --
   A.  I was expecting it to be more comprehensive and more
       immediate.  Obviously at the end it applies because it
       goes to POLSAP, and POLSAP does (inaudible) accounting,
       but I was expecting it to be rather more immediate.
   Q.  Within Horizon you were expecting?
   A.  Yes.
   Q.  And what other operations were apparently not double
       entry operations?  Can you remember?
   A.  I can't think of any off the top of my head but my
       feeling is that customer transactions are double entry.
   Q.  You can't remember others that aren't?
   A.  I can't remember offhand.
   Q.  That's a fair answer.  Sorry, that is a matter for his
       Lordship.
           So can we look now please at Callendar Square --
       just before we move off receipts and payments mismatch,
       Mr Jenkins didn't give you any details on the phone of
       how and exactly when and indeed whether every single
       person in the receipts and payments mismatch bug had
       actually been compensated, did he?
   A.  No, we didn't talk about that aspect.
   Q.  So you have no more information about that than we have
       in the documents?
   A.  No.
   Q.  If you can move to Callendar Square, please.  Can
       I understand, when you wrote your first report you had
       obviously had to look into some of these bugs?
   A.  Yes.
   Q.  And you had been told about how many by Post Office in
       your instructions?
   A.  Well, I had been told about the three.  I was looking
       for more.  But the three were the three obviously that
       were a focus of those --
   Q.  And they were the three acknowledged bugs that
       Post Office had acknowledged in its letter of response?
   A.  Yes.
   Q.  So the suspense account bug?
   A.  Yes.
   Q.  Callendar Square?
   A.  Yes.
   Q.  And the receipts and payments mismatch?
   A.  That is right.
   Q.  No one at Post Office had told you about any other bugs?
   A.  I wasn't relying on Post Office to tell me about bugs or
       Fujitsu.  I mean I was relying on me digging around.
   Q.  So you were left to see if there were any more than
       those three and dig around?
   A.  That was the exercise I understood I was doing, yes.
   Q.  I understand.  If we look please at {D3/1/156} in your
       first report, and if we look at -- just to give you
       context to see where you are, do you want to go back to
       the previous page, very kindly, just to show Dr Worden.
       {D3/3/155}
           Dr Worden, you can see this is under your heading
       8.6.2, "The Callendar Square ..."
   A.  Can I just remind myself.
           Okay, yes.
   Q.  Okay?  Over the page at 663 {D3/3/156}, after describing
       how stock would disappear from the sending stock unit
       and not appear in the receiving stock unit, which is
       662:
           "... a failure of double entry accounting which was
       not evident to the subpostmaster at the time."
           You go on to deal with this.
           So this is another aspect, isn't it, in which on
       this occasion there was a failure of double entry
       accounting rather than an absence of double entry
       accounting, is that fair to distinguish between the two?
   A.  I'm not quite sure.  I mean, a failure rather than
       an absence ...
   Q.  Well, what I'm really asking you is in relation to your
       conversation with Mr Jenkins you told the court that you
       identified an issue there where the operation concerned
       was not governed by double entry accounting?
   A.  Yes.
   Q.  And here, on the face of it, it looks as if this did
       not -- you can see, if you look at 663 you see:
           "In my opinion, under the later Horizon Online
       software this failure of DEA might have been immediately
       manifest as a failure to send a zero-sum basket to the
       BRDB. But in old Horizon, apparently it was not
       immediately detected, so in this respect Old Horizon was
       possibly less robust than Horizon Online."
   A.  Yes.
   Q.  That follows from 662 where you have identified that the
       result of the problem, which was a time out or locking
       problem somewhere inside the Riposte product, was that
       the stock would disappear from the sending stock unit
       and not re-appear in the receiving stock unit?
   A.  Or there might be a double -- I think it might have come
       in twice on some occasions as well.
   Q.  Just focus on this point that you are dealing with at
       662 first, if we may.  You say at 662:
           "... a failure of double entry accounting which was
       not evident to the subpostmaster at the time."
   A.  That is right, yes.
   Q.  Just pausing there.  What actually is happening is that
       what Horizon is showing on the system is wrong?
   A.  Showing to whom?  You mean storing in its database?
   Q.  Yes.  What Horizon is recording is wrong?
   A.  Yes, I think so.  I mean I think Callendar Square
       typically was, you would transfer out of a stock unit
       once and because of these Riposte problems you might
       transfer in twice.
   Q.  Okay.  Let's look.  You see at 662, the sentence I'm
       asking you about is on the second line, after the dash:
           "... a failure of double entry accounting ..."
           Yes?
   A.  Yes.  I mean double entry accounting is something goes
       out of one stock unit into another and they must exactly
       balance, so if they go in twice, as appears to happen at
       Callendar Square, that is a failure of double entry
       accounting, yes.
   Q.  Yes.  Because the initial failure was not evidence to
       the subpostmaster, you say that at 662?
   A.  Yes.  He didn't see it immediately and it wasn't brought
       to his attention straightaway.
   Q.  Exactly.
           So let's look at 664 and you say:
           "While the failure was not immediately visible to
       the Subpostmaster at the time of the stock transfer, it
       would always be visible later when balancing stock
       units."
   A.  Yes.
   Q.  You see that?
   A.  Yes.
   Q.  You say, referring to Mr Godeseth:
           ""It was also, as Mr Godeseth says at paragraph 13.7
       of his Second Witness Statement, soon visible to Fujitsu
       in two different ways (a flag from overnight processing,
       and a system event)."
           Yes?
   A.  Yes.
   Q.  And you identify that as potentially one of your
       robustness measures?
   A.  Yes.
   Q.  You then say:
           "So in the normal course of events, the
       Subpostmaster would see a discrepancy of some large and
       easily identifiable sum (because stock unit transfers
       generally involve larger sums than customer
       transactions) and would know, since he had not made any
       mistake to call the help desk. This was countermeasure
       MID."
   A.  Manual inspection by the postmaster of his stock, yes.
   Q.  Yes.  So the point you are making there is that what you
       have described at 665 is the countermeasure of manual
       inspection of data?
   A.  That's a part of it.  It can be manual inspection by
       lots of different people.
   Q.  Yes.
   A.  It can be back office or it can be the postmaster or --
   Q.  And you say:
           "As is shown by the PEAKs, the presence of the
       Riposte error was easily identifiable from system logs
       so the help desk would know it was not a user error and
       Post Office could correct any discrepancy if it arose in
       the branch accounts."
   A.  Yes.
   Q.  It actually doesn't sound that bad?
   A.  Well, we always have this issue of if there is
       a discrepancy, how obvious is it and therefore how much
       can one infer about whether it is likely to have been
       corrected or not?  And receipts/payment mismatch, which
       I think this eventually led to, is a pretty prominent
       red flag to Fujitsu.  And so a lot of receipts/payment
       mismatches I would expect -- you see them in PEAKs when
       they occur and you see the amount involved, so I would
       expect on a high proportion of cases generally
       R/P mismatches would be sorted out.
   Q.  On 662 you fairly observed it wouldn't be evident to the
       subpostmaster at the time, that's when it happens, yes?
   A.  That is right.
   Q.  If we go over the page to 667 {D3/1/157}, you say there:
           "At paragraph 15 of Mr Godeseth's Second Witness
       Statement, he says that this bug had impact on branch
       accounts in 20 [branches]."
           Yes?
   A.  Yes.
   Q.  You then go on to reason as follows:
           "For the receipts/payments mismatch bug, there is
       evidence that affected branches were compensated."
   A.  Yes.
   Q.  We will come back to that.
           "Because of this evidence, and because Fujitsu could
       always spot any occurrence of the bug in event logs, and
       because neither Post Office or Subpostmaster wanted
       Subpostmasters to suffer shortfalls from bugs in
       Horizon, I would expect the Subpostmaster to be left
       with a shortfall (i.e. not compensated) in only a small
       minority of cases, if any cases."
   A.  Yes.
   Q.  Now, pausing there, have you actually seen any evidence
       of any actual repayments to the subpostmasters and
       subpostmistresses who suffered in the receipts and
       payments mismatch bug?
   A.  No, I've seen that there was careful tabulation of the
       discrepancies, that's all I've seen.  The actual
       compensation process is outside the PEAKs and so on,
       so --
   Q.  Let's have a quick look while we're on the point and
       then we can take a break, if we may, when I finish this
       point, my Lord.
           {F/1001/1}.  You have seen this document?
   A.  When it comes.
   MR JUSTICE FRASER:  Is it 1001/1 we are going to?
   MR GREEN:  It is, my Lord.
   A.  This one, yes.  Fine.
   Q.  "Receipts/Payments Mismatch issue notes".  Attendees are
       from service delivery, security, network, IT, POL
       finance and Fujitsu:
           "Discrepancies showing at the Horizon counter
       disappear when the branch follows certain process steps,
       but will still show within the back end branch account.
       This is currently impacting circa 40 Branches since
       migration onto Horizon Online, with an overall cash
       value of circa £20k loss."
   A.  Yes.
   Q.  Do you see that?
   A.  Yes.
   Q.  If we go over the page {F/1001/2}, we see halfway down:
           "Note the Branch will not get a prompt from the
       system to say there is Receipts and Payment mismatch,
       therefore the branch will believe they have balanced
       correctly."
           Do you see that?
   A.  Yes.
   Q.  This is just a subpoint in relation to receipts and
       payments mismatch.  That is not the system alerting the
       subpostmaster or subpostmistress to what's going on, is
       it?
   A.  I agree that is different from other cases where I think
       receipts and payments mismatch shows in a trial balance
       or something that the postmaster sees.
   Q.  Honestly, Dr Worden, does that bit take you by surprise?
   A.  It does a bit actually.
   Q.  I'm grateful.
           My Lord, is that a convenient moment to pause?
   MR JUSTICE FRASER:  Yes.  Come back in at 3 o'clock.
   (2.52 pm)
                         (A short break)
   (3.00 pm)
   MR GREEN:  So Dr Worden, just picking up where we were
       before the break, this was in the context of your
       inference for the purposes of Callendar Square that
       given the experience in the payments mismatch case, you
       had confidence broadly in the matter being corrected.
   A.  I would say when an R/P mismatch is evident, in my view
       there is a high probability that it will be sorted out,
       the effects will be sorted out.
   Q.  I understand.  Just to clarify the position, if we look
       at this document that we are looking at now {F/1001/3},
       if we go back up one page, please {F/1001/2}, just under
       "Impact" it says --
   A.  Sorry, can I -- sorry to do this, but can I go back.
       {F/1001/3}
           The statement that surprised me said the branch will
       not get a prompt from the system.
   Q.  Yes, that's just above.
   A.  So he has to look at two numbers to see there is
       a mismatch rather than it being hidden from him.
           Sorry about that.  Let's get on, sorry.
   Q.  Isn't the true position on receipts and payments
       mismatch that it will appear to balance when it hasn't?
       Isn't that the real problem?  Not that he has to look to
       find out, it is not just the absence of a prompt.
   A.  I do not think that's it.  I think there is -- he gets
       a report and it has receipts on it and payments on it
       and the two figures are not the same.
   Q.  Well, this receipts and payments mismatch issue is not
       that, Dr Worden.  Look at the very page we are looking
       at now. {F/1001/2}
   A.  Yes.
   Q.  The sentence I was about to take you to, under "Impact":
           "The branch has appeared to have balanced ..."
   A.  Okay, yes.  Sorry about that.
   Q.  "... whereas in fact --"
   A.  "Appeared to have balanced" seems to be that it appears
       to balance, yes.
   Q.  Pausing there.  It wouldn't be apparent to the branch,
       would it?
   A.  It sounds like it, yes.
   Q.  And that's a fundamental point about this bug?
   A.  It doesn't appear to the branch.
   Q.  Yes.
   A.  Yes.
   Q.  If we look what they say underneath, they say:
           "Our accounting systems will be out of out of sync
       with what is recorded at the branch."
   A.  Yes, so --
   Q.  That's obvious?
   A.  RDS will pick it up.
   Q.  And it says:
           "If widely known could cause a loss of confidence in
       the Horizon System by branches."
   A.  Yes.
   Q.  "Potential impact upon ongoing legal cases where
       branches are disputing the integrity of Horizon data."
   A.  Yes.
   Q.  "It could provide branches ammunition to blame Horizon
       for future discrepancies."
   A.  Yes, okay.
   Q.  You see those?
   A.  Those last three points are kind of ramifications on --
   Q.  Now, if you are going to rely on your users to help you
       monitor what's going on with the system, is being candid
       with them about a clear problem to be expected for that
       countermeasure to work properly?
   A.  Yes, but I think for a problem one has to decide in
       terms of communication with users how many are affected
       and how many are likely to be affected and whether
       therefore you are going to confuse the great majority of
       users by telling them about some problem that occurs to
       a tiny minority.  So there are trade-offs there about
       how you communicate with users.
   Q.  And in terms of the inferences you might draw in your
       professional opinion about the effectiveness of the
       approach we see on this page?
   A.  Yes.  So the approach is?
   Q.  Post Office's approach to this on this page appears to
       be regarding at least as material or influential factors
       worries about loss of confidence in the Horizon system
       if it gets out that this has happened, ongoing legal
       cases, and branches getting ammunition to blame Horizon
       for future discrepancies.
   A.  Yes.
   Q.  Would you normally expect those factors to feature in
       your idea of the UEC countermeasure of how it should
       work ideally?
   A.  Those three bullet points are kind of psychological
       points about how it would influence mindsets and they
       don't seem to me to have a very direct bearing on UEC.
       Could you spell it out?
   Q.  Dr Worden, I probably didn't ask the question well
       enough.
           If Post Office is being held back from telling
       people about established bugs in the system on that
       basis --
   A.  I see.
   Q.  -- they are not making the best use of UEC, are they?
   A.  I see.  So you are saying that these psychological PR
       implications in their mind may influence their decision
       whether to talk candidly with users.
   Q.  That appears to be the case.  It is what they are
       saying.
   A.  Well, they are saying here are some impacts.  They are
       not saying these impacts affect our decision.  They are
       pointing out that here is a possible impact.
           I'm not being ingenious, really.
   Q.  You might have given the game away there.
           Dr Worden, the reason they are listing those impacts
       is because they are the impacts they had in mind in
       weighing up what to do, because you can see the next
       heading is "Identifying the issue and forward
       resolution".
           They are factors to which they are giving more or
       less weight but they are factors?
   A.  They are factors that they are pointing out in this
       summary of the whole impact of the incident.  I'm not
       clear whether they are saying these factors affect our
       decision how to communicate with postmasters, I can't
       draw that inference --
   Q.  Okay.  Let's go over the page to {F/1001/3}.  Top line:
           "The Receipts and Payment mismatch will result in an
       error code being generated which will allow Fujitsu to
       isolate branches affected this by this problem, although
       this is not seen by the branches."
   A.  Yes.  This is the 902s and 903s I think referred to.
   Q.  And the "not seen by the branches" appears to confirm
       what we have seen on the page above?
   A.  Yes.
   Q.  They say:
           "We have asked Fujitsu why it has taken so long to
       react to and escalate an issue which began in May."
   A.  Yes.  So this is about September, isn't it?
   Q.  September/October time.
   A.  Right.
   Q.  And they are going to provide feedback.
           If we just go down, the next paragraph begins
       "Fujitsu", the one after that says:
           "The code fix will on stop the issue occurring in
       the future, but it will not fix any current mismatch at
       branch."
   A.  Yes, I think it is obvious that you can't go backwards.
       That fix is a code fix for future, yes.
   Q.  So the state of play as at the date of this document,
       before they have decided what to do with affected
       branches, is that the Horizon system is recording the
       wrong figures.  There is a difference between the
       figures that the Horizon system is recording and the
       ones at POLSAP which it should be recording?
   A.  There are discrepancies, yes.
   Q.  And the Horizon system has the wrong figures on them?
   A.  There are lots of figures around the place.  Some of
       them are wrong, yes.
   Q.  Look at "Proposal for Affected Branches", if you would:
           "There are three potential solutions to apply to the
       impacted branches, the groups recommendation is that
       solution two should be progressed."
           So that is just the recommendation at this stage.
           "Solution one - alter the Horizon branch figure at
       the counter to show the discrepancy."
           So that would be, it looks like, dialling into the
       counter and altering the figure that would show on the
       counter?
   A.  "... alter the ... branch figure at the counter to show
       ..."
           It is not clear to me which branches that applies to
       at any given moment.
   Q.  They are talking about impacted branches as we can see,
       because the heading says "Proposal for Affected
       Branches", and the line underneath says:
           "There are three potential solutions to apply to the
       impacted branches."
           So we know they are talking about the branches that
       have been affected by this bug, don't we?
   A.  Yes.
   Q.  Then they say:
           ""Solution one - alter the Horizon branch figure at
       the counter to show the discrepancy.  Fujitsu would have
       to manually write an entry value to the local branch
       account."
   A.  Yes, that looks like, as you say, remotely going into
       the branch.
   Q.  Okay, so that is something they were able to do and were
       considering doing?
   A.  That was a possibility yes.
   Q.  "Solution two - P&BA will journal values from the
       discrepancy account into the Customer Account and
       recover/refund via normal processes. This will need to
       be supported by an approved POL communication. Unlike
       the branch 'POLSAP' remains in balance albeit with an
       account (discrepancies) that should be cleared."
           Yes?
   A.  Yes.
   Q.  "Impact - Post Office will be required to explain the
       reason for debt recovery/refund even though there is no
       discrepancy at the branch.
           "Risk - could potentially highlight to branches that
       Horizon can lose data."
   A.  Yes.
   Q.  So we can see that that is the adverse factor militating
       against solution two?
   A.  Yes.
   Q.  Notwithstanding at this stage there were recommending
       solution two, yes?
   A.  Yes, and they're saying solution two has this drawback
       in that it draws attention.
   Q.  Yes.  And then:
           "Solution three - It is decided not to correct the
       data in the branches (ie Post Office would prefer to
       write off the 'lost'.
           "Impact - Post office must absorb circa £20K loss.
           "Risk - Huge moral implications to the integrity of
       the business, as there are agents that were potentially
       due a cash gain on their system."
           So the point is although Post Office can decide what
       it wants to do as one corporate body, there are lots of
       different post offices and sub-post offices involved.
       Some will have losses, some will have gains?
   A.  Yes, I can't fully interpret solution three.
   Q.  Okay.  The short point we get from this document,
       Dr Worden, is that the correction of what had gone wrong
       was not automatic exactly, was it?  It was discretionary
       as to how they did it and whether they do it?
   A.  Yes, but this does refer to "recover/refund via normal
       processes", as though there were processes to do it.
   Q.  It is not that there weren't processes.  The question,
       which I think you fairly accepted, was it was
       discretionary rather than automatic?
   A.  Well, they were choosing how to sort it out.  They had
       three ways --
   Q.  And that was a discretionary choice that they had?
   A.  They had a choice of three ways to sort it out, yes.
   Q.  Now if we look at the joint statement for a moment
       {D1/4/5} at 3.22.
   A.  Yes:
           "... the same effects as a user error ..."
           Yes.
   Q.  What you and Mr Coyne agreed is:
           "Many software bugs can have the same effects as
       a user error (as illustrated, for instance, by the
       Dalmellington bug, which produced a remming error)."
   A.  Yes.
   Q.  And a remming error might look like a user error?
   A.  Absolutely.
   Q.  And that's why you refer to that?
   A.  Yes.
   Q.  Pausing there.  I think you were here for Angela Van Den
       Bogard's evidence, can you remember?
   A.  I do not think I was, actually.  Sorry about this.  But
       I certainly read the transcripts.
   Q.  Did you see a reference to UEB in her cross-examination?
   A.  No, you would have to take me to it.
   Q.  User error --
   A.  Oh, UEB.  It is a strange acronym.
   Q.  Yes, user error bias.  It was put to her whether she
       accepted that Post Office suffered from UEB or user
       error bias from time to time in relation to --
   A.  I have never seen that acronym myself.
   Q.  I understand.  But for the moment if it is right that
       Post Office suffers from user error bias in its dealings
       with subpostmasters, it is quite important, isn't it, in
       the context of what you and Mr Coyne have agreed at
       3.22, because you have agreed that many software bugs
       have the same effects as user error.  So they look
       similar, and then the subpostmaster is faced with
       dealing with an organisation that has a bias in favour
       of assuming it's user error when they look the same?
   A.  If a software bug looks like a user error, the resilient
       processes will compensate regardless of which one it is.
   Q.  Let's have a look and consider this in a little bit more
       detail.  If we go please to {H/6/3}, turning to
       Callendar Square now.  This is a letter of
       11 January 2017.
   A.  Yes.
   Q.  If we look at page 3 of this letter, do you see 7.8.1 at
       the top of the page?
   A.  Yes.
   Q.  This is Post Office's solicitors, Wombles, writing to
       the claimants' solicitors in January 2017.
   A.  Yes.
   Q.  And there they say:
           "The Falkirk/Callendar Square issue was only known
       to have affected that one branch."
   A.  Yes.
   Q.  And you have identified that it affected 20 branches in
       your report, that is correct?
   A.  Yes.
   Q.  If we look at how the Callendar Square story develops.
       If we look at {F/297/1}, please.  You are just going to
       be given a hard copy of this, Dr Worden.  This is
       PC0126042.  If we just go down to -- do you see
       15/09/50, 10.28, just after halfway down?
   A.  "Unable to find relevant KEL."
           That one?
   Q.  Yes.  And underneath "Unable to find relevant KEL" is:
           "Information: Faye at nbsc states that she went
       through 2 hours of checks."
   A.  Yes.
   Q.  If we go down to "Recommend", which is about seven lines
       down from the bottom?
   A.  Yes:
           "Please investigate ..."
   Q.  " ... as to why the stock unit aa on node 3 and node 4
       are showing varied amounts on counter daily reports."
           If we go over the page very kindly {F/297/2}, we
       have got at the top "Stock units vary on counters."
       Sorry, it is not stock units, "SU cash amounts vary on
       counters".
   A.  Yes.
   Q.  And we come down to the fifth box, "Cheryl Card",
       underlined.
   A.  Yes.
   Q.  15 September 2005 at 16.12.27:
           "Due to the Riposte errors on 14/09/05 from 15:30
       onwards (see call E-0509140700), messages were not
       replicated on counter 3.  As a result, 3 transfers in to
       stock unit AA were done twice, initially on other
       counters then again on counter 3.  The transfers in were
       for:
           "3000.00 (cash)
           "400.00 (cash)
           "89.69 (cheques)
           "This has resulted in a loss of 3489.69 in CAP 25 to
       the outlet, which POL may need to correct via an error
       notice."
   A.  Yes.
   Q.  "Phoned the PM to explain what the problem was. He is
       concerned about other transactions which he has input
       twice (3 Giro deposits and another cheque) because of
       the replication problem. Have advised him to contact the
       NBSC as this is a business issue."
           Do you see that?
   A.  Yes.
   Q.  We know eventually that it was actually a bug?
   A.  Yes.
   Q.  But what he is being told here is at least for part of
       this to contact the NBSC because it is a business issue?
   A.  Yes.  I mean what seems to have happened here is that
       because he had this stock problem which was caused by
       a bug the postmaster started thinking I need to re-enter
       these transactions, which was not to do with the bug.
       He thought I have to re-enter these transactions.  So it
       is a little confused to me.
   Q.  The approach you have taken in your report is that
       Post Office would -- you say:
           "Neither Post Office or subpostmaster wanted
       subpostmaster to suffer shortfalls from bugs in
       Horizon."
   A.  Yes.
   Q.  Because that was in paragraph 667 which I took you to.
   A.  667.
   Q.  It is on page 157.  If we go back to that for a second.
   A.  Yes.
   Q.  You say there:
           "Neither Post Office or subpostmaster wanted
       subpostmaster to suffer shortfalls from bugs in
       Horizon."
           Yes?  And it is obviously right that subpostmasters
       didn't want to suffer shortfalls, did they?
   A.  That is right.
   Q.  But if Post Office was gaining money at the expense of
       subpostmasters --
   A.  Yes.
   Q.  -- that in itself would not be an incentive to try and
       give the money back, would it?
   A.  Well, I was asked to consider Post Office's motivations,
       and in that context I think that one of Post Office's
       motivations is to keep down the administrative problems
       of things recurring and not being sorted, and if you
       don't sort the discrepancy and the postmaster keeps
       coming back and so on, your admin costs will soon rise.
       So it is a complicated -- there is a lot of motivations
       at play there.
   Q.  There are a lot of motivations at play.  If
       subpostmasters are, let's say hypothetically, pressured
       to pay regardless of who is at fault and they just pay
       up because of the way they are asked, hypothetically,
       that reduces your admin costs a lot, and if they have
       suffered a loss you don't have to give the money back,
       so that meets two objectives?
   A.  That is part of the trade off.  There will be the ones,
       as you say, that just knuckle under and take it, and the
       ones that keep banging the table will cost you a lot of
       money.
   Q.  Just on that point, were you aware of any general
       Post Office suspense accounts in --
   A.  Central suspense accounts?
   Q.  Yes.
   A.  Yes, there are I believe, and they may be to do with all
       the dealings with some client.
   Q.  Okay.  Well, what about -- because elsewhere in your
       report, I don't want to stray too much at the moment,
       but you also mention micro bugs, small bugs, being
       unlikely because you would expect to see large sums of
       money somewhere --
   A.  Money that disappears somewhere has to pop up --
   Q.  It's got to come back somewhere else, it's got to pop up
       somewhere else.
           Have a look at {F/333.1/1}, please.  Dr Worden, I'm
       asking you just to look at this to see whether you were
       aware that an issue had been raised about it, not
       evidence of it itself, yes?
   A.  Yes.
   Q.  This is the Second Sight report which you must have
       seen?
   A.  The part two report I have seen, yes.
   Q.  You have.  Let's look at page {F/1333.1/46}, please, and
       if we look at 22.11.
   A.  Yes.  (Reading to self)
   Q.  It says:
           "We note that Post Office's control and
       reconciliation procedures rely on correct information
       being supplied by third party clients. It follows that,
       if incorrect information is provided by any client
       company, this can give rise to a loss being charged to a
       branch. We also note that, for most of the past five
       years, substantial credits have been made to Post
       Office’s Profit and Loss account as a result of
       unreconciled balances held by Post Office in its
       Suspense Account."
           Now I'm not asking you about that as evidence of
       itself, I'm just asking were you aware that that was
       a concern that Second Sight had raised about substantial
       credits being made to Post Office's profit and loss
       account as a result of unreconciled balances held by
       Post Office in its suspense accounts?
   A.  I read the Second Sight reports and the Post Office's
       reply.
   Q.  But did you spot that?
   A.  I didn't spot that, no.
   Q.  Just whilst we are on that, if you will forgive me,
       going to the micro bugs point very briefly.  If we look
       at {D3/2/211}.
   A.  Yes.
   Q.  This is appendix F 2, your appendix F 2, and we are
       going to look at paragraph 460 in relation to micro
       bugs.
   A.  Yes.
   Q.  You say:
           ""Because POLSAP uses double entry accounting, in my
       opinion any effect of micro-bugs on branch accounts must
       also show, aggregated over all branches, in some Post
       Office central account. If that effect were significant,
       then in my opinion it would inevitably have been noticed
       by some Post Office manager or external auditor."
   A.  Yes.
   Q.  But you weren't aware of what I have just shown you when
       you wrote that?
   A.  No, no.
   Q.  And having seen that now, that would be at the very
       lowest a line of enquiry that you would wish to follow
       up before continuing to hold the opinion you have
       expressed there?
   A.  I would like to kind of reconcile those two paragraphs
       and work out how much I knew about Post Office central
       accounts and that is limited.
   Q.  It would make a bit of a difference how substantial the
       sums were as well, wouldn't it?
   A.  It would.  I mean substantial -- one would like to know
       what are the sums that Second Sight were referring to
       versus what are the sums that micro bugs might add up
       to.  One might want to make that comparison in order to
       drill further into that issue.
   Q.  Dr Worden, can I bring you back now to Callendar Square
       because we are really looking at Callendar Square and
       how it starts in the context of what you said you would
       expect to happen.
           Now, I have shown you what happened on receipts and
       payments mismatch --
   A.  Any receipts and payments?
   Q.  No, the particular --
   A.  The particular one, right.
   Q.  And it was discretionary how they would approach it.
       I have shown you the existence of the suspense accounts.
   A.  Yes.
   Q.  Does either of those alter your expectation of how
       efficiently and helpfully the Callendar Square bug would
       have been dealt with?
   A.  Sorry, which two points alter my expectation?
   Q.  The fact that there is a suspense account into which
       unresolved unreconciled credits go and are ultimately
       credited three years later to Post Office's accounts,
       and the fact that it wasn't absolutely automatic that
       a transaction correction would be issued, as we have
       seen from receipts and payments mismatches.  Do either
       of those alter your expectations about how elegantly the
       problem that Mr Alan Brown suffered at Callendar Square
       would be sorted out one way or the other?
   A.  I think my opinion is if there is a receipts/payment
       mismatch it gets noticed in several ways and my opinion
       is there is a high probability that therefore it will be
       sorted out.
   Q.  So it doesn't change your view?
   A.  I do not think that view has changed, no.
   Q.  I wanted to ask you that because it seems to bear on the
       introduction of your analysis of Callendar Square.
           Let's see what actually happens at Callendar Square.
       We have looked at the PEAK at {F/297/1}, if we go there
       you will see it.  That was the one where he was
       concerned about other transactions, if you look on
       page 2, do you remember?  It is in the fifth box down.
       {F/297/2}
   A.  Yes, the postmaster had done some other transactions.
   Q.  Which is input twice, three Giro deposits and other
       cheques because of the replication problem, do you see
       that?
   A.  Yes.
   Q.  That's what he is concerned about.  Were you here,
       I think you said you were here when Mr Godeseth gave his
       evidence?
   A.  Yes.
   Q.  You heard I think me take him through the history of
       Callendar Square?
   A.  Yes.
   Q.  And if we look at {Day8/58:1}.
   A.  Page 58, yes.
   Q.  This was in the context -- do you remember that the
       suspense account team were not prepared to authorise the
       entry of part of the discrepancy into his suspense
       account, do you remember that?
   A.  I don't recall that detail.
   Q.  I can show you.  But let's just, for the moment, look at
       his answer.  I say:
           "Question:  So it was not easy for the
       subpostmaster, was it?"
   MR JUSTICE FRASER:  Before you do that, you really need to
       start at the bottom of page 57, I think.
   MR GREEN:  My Lord, I'm happy to do that.  Can we go up
       a tiny bit.  {Day8/57:10}.
   A.  Right, "the suspense account" probably means the
       suspense account for that branch?
   Q.  Yes, it does.  If I can help you with it possibly.  Page
       57, line 10:
           "'This office had severe problems balancing on
       [week] 25, resulting in a shortage of £6,414.46.  After
       checking various reports I am satisfied that the error
       is made up of ...'
           "And they are then broken down carefully there and
       you can see that the SPMR is saying there is a Horizon
       software problem and so forth, giving the history ..."
   A.  Can I ask what that quote is quoting from?
   Q.  From the document we are just looking at.  I can take
       you to the document, I'm just at the moment asking you
       whether you recall that this was the sort of problem
       that the Callendar Square subpostmaster, Mr Alan Brown,
       was faced with, or can you not really remember?
   A.  Well, obviously he was faced with a shortfall, that's
       what I remember.  Details of suspense accounts and so on
       are not so prominent in my mind.
   Q.  Have a look at what -- the problem is if you look at
       line 18.
   A.  Yes.
   Q.  It says:
           "Question:  Then speaking to the Horizon support
       centre at the bottom of the page.  If we go over the
       page, please:
           "'They told the SPMR that they would report to NBSC
       that they had identified and rectified the problem and
       that the amount could be held in the suspense account.
       However, as part of the shortage relates to transfers
       and no error notice will be issued, then the suspense
       Account Team are not prepared to authorise the entry.'
           So it wasn't easy for the subpostmaster, was it, you
       can see here?"
           And Mr Godeseth says:
           "Answer:  No, indeed, a horrible position to be in."
   A.  Yes.
   Q.  So the picture that emerges from the documents in the
       case of Mr Alan Brown is not a rosy one, is that fair to
       accept?
   A.  I believe so.  I don't know what the suspense account
       team were talking about, why they were not prepared to
       do it and whether they thought some other mechanism was
       right.
   Q.  Let's have a look at {F/300.1/1}.  This is the area
       manager intervention log, you can there it is
       "19 September 2005 Horizon Problems".
           If we could go over the page, please {F/300.1/2}.
       You can see the amounts there broken down, £3,489.69
       transfers, £2,870 Giro deposits, and £54,52
       unidentified?
   A.  Yes.  Do we understand these are stock transfers that
       went in twice to some stock?
   Q.  Exactly.  You see there it says:
           "The Spmr claims that there was a Horizon software
       problem on 14.09.05 from 15.30 onwards. This was picked
       up when a member of staff noticed that a transaction,
       which had been taken by another member of staff, had not
       been entered onto the system, so therefore she put the
       transaction through. She checked at the time with her
       colleague who said that she thought she had put it
       through already however she accepted that she could have
       made a mistake."
           Pausing there.  What's actually happening here is
       the fact that Horizon is not correctly displaying what's
       happened is misleading the staff in the sub-post office
       to make a mistake.
   A.  What's happening is it is not replicating properly.
   Q.  Yes.  So just to be clear, the Horizon system is not
       showing correctly what has happened?
   A.  Absolutely, because Riposte is not replicating when it
       is supposed to.
   Q.  And we saw they had quite a lot of Riposte problems?
   A.  A lot of Riposte problems?
   Q.  -- chuck it over the fence to Escher?
   A.  I mean there are a number of PEAKs and KELs and so on
       where Fujitsu say this is a Riposte problem, we need
       Escher to fix it.  Callendar Square is not the only one.
   Q.  If you look at the bottom of that paragraph, it says:
           "Following on from that, it was picked up that other
       giro business deposits that had been entered had not
       come up on the system, so they were re-keyed."
           Yes?
   A.  Where is that below?
   Q.  It is just at the end of that paragraph that we were
       looking at, the big paragraph.  Three lines up from the
       bottom.  "Following on from that", in the middle.
   A.  "... it was picked up that other giro business deposits
       that had been entered had not come up on the system, so
       they were re-keyed."
           Yes.
   Q.  So they were re-keyed as well?
   A.  Yes.
   Q.  So that is how we got the two lots, the two numbers we
       have seen.
           "There was also a problem with transfers from one
       stock to another, in that they had doubled up."
   A.  Yes.
   Q.  "The Spmr made several telephone calls to the NBSC,
       telling them about his problems and he was advised to
       carry on with balancing and produce his Cash Account."
           Yes?
   A.  Yes.
   Q.  Is that what, in your expectation of how this process
       should work, is that what you would expect to happen?
   A.  Well I don't know the detail, but in many cases NBSC say
       don't try balancing, in some cases they do, and I don't
       know the exact rationale for one or the other.
   Q.  He is told to produce this cash account.
           "Whilst doing this a warning came up, however the
       NBSC told the staff to continue to roll over. The result
       was that the office balanced £6,414.46 short."
           Do you see that?
   A.  That is the sum, is it?
   Q.  Yes:
           "The Spmr spoke to the Horizon Support Centre (ref
       E0509150123) who investigated and agreed that there had
       been a navigation problem that had now been rectified."
   A.  Yes, not quite clear what that means.
   Q.  Then:
           "They told the Spmr that they would report to NBSC
       that they had identified and rectified the problem and
       that the amount could be held in the suspense account."
   A.  Can we go back, who are "they" now?
   Q.  The Horizon support centre.
   A.  Okay.  Sorry.
   Q.  Which is now run by Atos.
   A.  Yes.
   Q.  So:
           "However, as part of the shortage relates to
       transfers, and no error notice will be issued, then the
       Suspense Account team are not prepared to authorise the
       entry."
   A.  Yes.
   Q.  "I telephoned the suspense account team (Ann Wilde) ..."
           This is an SPM being assisted here by someone at
       Post Office.
           " ... who told me that checks could be made with
       Girobank after next Wednesday, and if that shows that
       duplications have been made, then they will authorise
       the amount to be moved to the suspense account, until
       the office receives an error notice. However, Ann stands
       by what she said about the transfer problems, and that
       they would not move this amount to The Suspense
       Account."
   A.  Yes.
   Q.  Is that how you think the system should work?
   A.  Well, there's obviously some policy about the suspense
       account team and how they work and how certain things
       are handled.
   Q.  I understand, that's obvious.  I'm asking --
   A.  That's what Ann is quoting.
   Q.  But was it your understanding when you were looking --
       did you even know that had happened at Callendar Square?
   A.  Well, it seems to me that what's happening here is --
   Q.  Can we just pause.  Did you know about that?
   A.  I was not aware of this detail, no.
   Q.  In fact we see this in a number of the bugs, that you
       are not aware of a huge amount of the detail, is that
       fair?
   A.  The procedural side of how someone was compensated for
       a bug and how this team pushed numbers around and so on,
       that procedural side is outside the PEAKs and generally
       not something I'm -- you know, how the suspense account
       team worked, what their policy was, what you could do,
       and so on, that sort of stuff I don't know.
   Q.  But your expectation that it won't amount to a lasting
       discrepancy --
   A.  Yes, is that this procedure will somehow work out and
       these teams will decide eventually: you do it, we do it,
       we have got to do it.
   Q.  So you formed a view about how seamlessly or otherwise
       this would work and on the basis of that view reached
       your opinion about whether there would be lasting
       discrepancies or not?
   A.  My view is that regardless of procedural issues like
       this, in the majority of cases if there is
       an R/P mismatch it will be sorted eventually.
   Q.  You formed that view without knowing how the actual
       individual person at the Callendar Square branch after
       whom the bug is named was dealt with?
   A.  I didn't know the details of this process.
   Q.  So the answer is yes?
   A.  I formed that view not knowing the details of this
       process.
   MR JUSTICE FRASER:  Now Mr Green went through this in some
       detail with Mr Godeseth.  Can you just remind me, were
       you reading the transcript for Mr Godeseth or were you
       here?
   A.  I was here.
   MR JUSTICE FRASER:  You were here?
   A.  Yes.
   MR JUSTICE FRASER:  Okay, Mr Green.
   MR GREEN:  I will take it reasonably swiftly, if I may,
       given that you have not looked at it in this detail.
   MR JUSTICE FRASER:  I do not think you need to put
       everything to this witness that you put to Mr Godeseth.
   MR GREEN:  I'm certainly not going to do that, my Lord.
           Can I identify, please, that at {F/312.1/1}, just to
       take a couple of aspects of what happened.  If we look
       at page 2 of that log -- sorry, page 1, I do
       apologise -- do you see at the top.
   A.  (Reads to self)
           I see that's ... yes.
           Is AIO area intervention -- oh, A/O?  What are they?
   MR GREEN:  "Area intervention officer knows about it."
   A.  All right, as opposed to manager --
   Q.  If we go over the page, please {F/312.1/2} and look at
       "Expand on any letter requested/clarify any point",
           Do you see the second line:
           "Spmr concerned that he has now made a fraudulent
       entry in that he has rolled over to the next trading
       period and put the loss into local suspense he has then
       gone on to state that the cash has been made good, which
       it hasn’t. This was done on the advice of the Helpdesk."
   A.  Yes.
   Q.  Now, that's because he is being forced to make good part
       of the cash that can't go into the suspense account.
       Did you know any of this?
   A.  It seems to be so, yes.
   Q.  Did you know any of it?  Or should I take your answer
       before, that you didn't really know this detail?
   A.  I haven't gone into this detail.
   Q.  I understand.
           If we go quickly to a couple of other points and
       then I will move on {F/324.1/1}.  This is a telephone
       contact, a response by SPM:
           "Telephoned the office and Allan said that he was
       having problems again with transfers. He has contacted
       the Horizon helpdesk who have subsequently come back to
       him to say that there is no system problem and that he
       should contact NBSC."
           Do you see that?
   A.  Yes.
   Q.  If we look quickly at {F/332.1/1}, "Response by SPM":
           "Alan will continue to log a call each time he has
       a problem.  I told him that this would help to build
       a case for having the alleged faulty kit exchanged."
   A.  Yes.
   Q.  Then just taking it forward before I ask you a
       compendious question about these, {F/333.1/1}.  Now,
       this is an email chain.  And can I ask you to look
       please at page 11, which is where it begins
       {F/333.1/11}, and that is the end of an email from
       Sandra MacKay as you can see.
           If we to the next page quickly, you will see this is
       11 January 2006.  If we go back to the email below, and
       you see at the top:
           "You may recall that in September the above office
       had major problems with their Horizon system relating to
       transfers between stock units the Spmr has reported that
       he is again experiencing problems with transfers,
       (05.01.06) which resulted in a loss of around £43k which
       has subsequently rectified itself."
           On your understanding of the Horizon system, is that
       something that should or should not happen if it is
       working correctly?
   A.  I think it should not really.
   Q.  No.  If we go forward, please, to page {F/333.1/9}, if
       you look at the bottom of that do you see:
           "Since then it appears to have happened again,
       although Fujitsu are saying no issue could be detected.
       I am concerned that there is a fundamental flaw with the
       branches configuration ..."
           Do you see that?
   A.  Yes.
   Q.  So I mean I'm not going to take you through the whole
       thing, Dr Worden, but if we -- you would accept,
       wouldn't you, that the premise of everything being
       corrected is dependent on all these processes working
       properly and satisfactorily.  That's uncontroversial?
   A.  I do not think it is quite uncontroversial because in
       the process of trying to correct something, there will
       be false steps, and I think you have shown me evidence
       there have been false steps.
           In spite of that I would expect people to persist,
       as they you see them persisting here, until things are
       sorted out.  So false steps on the way, yes, they do
       happen, but I would expect when there are false steps on
       the way people will persevere until they have got to the
       bottom of it.
   Q.  There are about 30 branches identified in the document
       we have for Callendar Square.
   A.  Yes.
   Q.  And it suggests that probably 10 of them didn't have
       shortfalls?
   A.  Mm.
   Q.  So that is how you have derived your figure of 20
       branches?
   A.  Yes.
   Q.  Did you get a feel in your reading into this problem of
       how long this problem had been around for and how many
       branches it was actually affecting?
   A.  Well, there is a real problem about the definition of
       what "this problem" is because there is the Riposte bug
       and then there's certain event storms which causes
       problems in replication, which may be short-term
       problems for a few minutes, and then there are event
       storms which make them long-term problems, and then
       there's what happens in event storms and in particular
       the double transfer in.  So the whole of
       Callendar Square is those things all happening together,
       whereas I think some of the 20 PEAKs or 30 PEAKs,
       whatever, are different from that, different
       combinations.
   Q.  Let's just go forward one last message in this line of
       emails, this is from Anne Chambers at {F/333.1/3}.
       I assume you didn't look at this before you did your
       report or before today?
   A.  Sorry, which one?  It has not come up yet.
   Q.  Anne Chambers, halfway down.  From Anne Chambers to
       Mike Stewart, 23rd February 2006?
   A.  This is Anne Chambers, right, okay.  I have not seen
       this email, no.
   Q.  You have not seen it?
   A.  No.
   Q.  Because it might be quite helpful in getting a feeling
       for the scale of what was actually going on.  It says in
       the second paragraph:
           "Haven't looked at the recent evidence, but I know
       in the past this site had hit this Riposte lock problem
       2 or 3 times within a few weeks. This problem has been
       around for years and affects a number of sites most
       weeks, and finally Escher say they have done something
       about it. I am interested in whether they really have
       fixed it which it why I left the call open - to remind
       me to check over the whole estate once S90 is live -
       call me cynical but I do not just accept a 3rd party's
       word that they have fixed something!"
           Did you have even any conception that this was
       an issue which was affecting a number of sites most
       weeks for years when you formed the views you did about
       the significance of this problem?
   A.  Well, this is exactly the point.  The Riposte lock
       problem leads to different things, and the Riposte lock
       problem leading through to that double transfer in thing
       is not the same as the Riposte lock problem.
   Q.  Okay.  But just re-putting the question, if I may.
   A.  Yes.
   Q.  In forming the views that you did in your reports you
       were unaware of this email?
   A.  It looks a bit familiar actually.
   Q.  You said --
   A.  As I said, my view has always been that there is a chain
       of events and the Riposte lock problem, which is at the
       source of the chain, happens much more frequently than
       the whole chain.
   Q.  You were not aware of the scale of that problem as
       reported there when you wrote your reports, were you?
   A.  I expected the scale of the source, the Riposte lock
       problem, would be more extensive than the consequence
       which required the event storm and required the double
       transfer in and so on and so forth, and that must be
       more rare than the original Riposte lock problem.
   Q.  Dr Worden, one last attempt.  You were not aware of this
       evidence about the scale of the Riposte lock problem
       itself when you wrote your report?
   A.  I was aware of some investigations by Anne Chambers and
       the fact that she was looking at this broader scope of
       Riposte lock problem, I was aware of that, and I was
       aware -- it was my opinion, it still is my opinion, that
       the origin of the chain, the Riposte lock problem, is
       more frequent, probably much more frequent than the
       whole chain occurring.
   Q.  The KEL that was raised in 2002 and updated in 2010 is
       at {F/565/1}.  You did actually look at KELs, didn't
       you?
   A.  Not in this format actually.
   Q.  Can you remember if you looked at this KEL in any
       format?
   A.  I believe I did, yes.
   Q.  If we look at page {F/565/2}, please.  February 2003,
       about three-quarters of the way down?
   A.  Yes.
   Q.  "We are seeing a few of these each week, on Wednesdays
       during balancing. This can lead to problems if the PM is
       balancing on the counter generating the events, as it
       may not have a full view of transactions done on other
       counters."
   A.  Yes, I mean this illustrates that the cause, the Riposte
       problem, has different consequences.  For instance, it
       stopped transfers for instance in balancing.  And what
       one expects, depending on the duration of the problem,
       obviously an event storm that leads to Riposte failing
       to replicate for a long period on some terminal is
       different from the lighter cases where Riposte fails to
       replicate for some short period, and maybe in balancing
       you miss some transactions done in on a terminal in a
       that short period.  So there are all sorts of scales of
       possibility there.
   Q.  Yes, and it varies?
   A.  It varies, yes.
   Q.  In June 2004 we see:
           "This event can also give rise to transfer
       problems."
           Yes?
   A.  Yes.  This is the double stock thing.
   Q.  If we go over the page {F/565/3}, at the top:
           "This problem is still occurring every week ..."
           September 2005.
           " ... in one case at the same site on 2 consecutive
       weeks."
   A.  Yes, and that might be just a subpostmaster noticing he
       has a problem and saying -- ringing up.
   Q.  If we look halfway down or just before, do you see the
       words "reboot" in capitals halfway down that large
       paragraph?
   A.  Yes.
   Q.  And then you see:
           "If they are in the process of balancing, it is
       strongly advised that they reboot before continuing with
       balancing as they are at risk of producing an incorrect
       balance. Warn the PM that if transactions appear to be
       missing, they should not be re-entered - they will
       become visible after the counter has been rebooted."
   A.  Yes.
   Q.  Then it says:
           If a reboot/Cleardesk does not resolve this problem,
       send the call over for further investigation - SSC can
       rebuild the messagestore on the affected counter."
   A.  Yes.
   Q.  So that ties in with what we have seen about the way
       messagestore was rebuilt by SSC, yes?  It is
       an example --
   A.  Yes, it is an example of rebuilding a messagestore.
       That sounds like the sort of full replication job.
   Q.  Now, at Mr Godeseth's second -- just before we move,
       they are, at the bottom of that page, still giving
       advice on this in 2010, aren't they?
   A.  Yes.
   Q.  This was going on for quite a long time?
   A.  This is on the message correspondence server and it is
       a different thing from failure to replicate in the
       branch.
   Q.  Yes, it is another problem but in the same line --
   A.  It may be the same, it may be different.  I'm not quite
       sure.
   Q.  Mr Godeseth at paragraph 15 of his witness statement, do
       you remember, he relies on the list from Mr Lenton.  We
       see that at {F/322.1/1}.  Do you remember that list?
   A.  I'm not there yet.  (Pause)
           This is the thing Anne Chambers put together,
       I think.
   Q.  Yes.  It turns out from the properties we can see it was
       Anne Chambers in 2015?
   A.  Yes.
   Q.  And what's said there is:
           "NB many other branches had multiple events,
       preventing replication, but these are the majority of
       those which came to PEAK, having either reported
       a problem or it caused a reconciliation report entry."
           Do you see that?
   A.  Yes.
   Q.  So this is a list of the majority retrospectively
       compiled by Anne Chambers in 2015?
   A.  Yes.
   Q.  So it does not suggest, does it, nor I think does
       Post Office or Fujitsu claim, that there was
       a systematic problem management system in place to
       collate everything into one place and produce this sort
       of data automatically?
   A.  What do you mean by a systematic problem management
       process?
   Q.  Well, we have seen reference to a problem management
       system that was considered to be brought in, and
       Post Office has given evidence that they didn't bring it
       in, that would have produced information of this sort
       automatically and collated it?
   A.  Well, no, that's a rather different document in my
       opinion.  The problem management document is a high
       level strategic generic document about all sorts of
       problems whereas this is a specific type of problem.
   Q.  So she is having to go back in 2015 to try and identify
       the majority of branches affected?
   A.  Yes.  Obviously I'm not quite sure of what her search
       criteria were to pick these things up.
   Q.  But fingers crossed?
   A.  I don't know about fingers crossed at all, she was
       a pretty competent woman in my opinion so she would not
       wing it.
   Q.  So she says the competent woman is trying to find -- she
       thinks she has got the majority of them?
   A.  I think she would do the best that can be done and she
       has obviously picked up the receipts and payments PEAKs
       that have a connection with this kind of Riposte
       problem.
   Q.  Look at the blue box at 26:
           "This set reported problems but probably didn't have
       losses as a consequence."
   A.  Yes.
   Q.  And because she says they "probably didn't have losses",
       that's why you have limited your number to 20, is that
       right?
   A.  Yes.
           You see lots of consequences here like frozen slow
       counter and so on which PMs might report.
   Q.  Yes.  Let's have a look at Mr Godeseth's second report
       at paragraph 16, it is {E2/7/6}.  At paragraph 16 on
       page 6 you will see there that Mr Godeseth says:
           "While the issue at Callendar Square was reported by
       the Subpostmaster after he spotted a receipts and
       payments mismatch, it would have been picked up in any
       event by a batch process that is run every night which
       picked up the mismatch ..."
   A.  Yes.
   Q.  But as we have seen, this is not something that's going
       to be corrected overnight, is it?
   A.  I do not think so, no.
   Q.  You would agree that it arose, from what you have seen,
       in or about 2000?
   A.  Yes, the first occurrence of the Riposte problem I think
       was around there.
   Q.  And it certainly persisted until 2006?
   A.  I think so.  It seems it wasn't finally fixed by Escher
       in all that time.
   Q.  And it looks as if there may have been the same or
       a related problem in 2010 but we don't know exactly?
   A.  We don't know.
   Q.  Do you regard this as a significant failing in the
       system?
   A.  It is obviously significant but what one means by that
       word ... It has been significant in this case,
       obviously, and in my investigations.
   Q.  Riposte was part of the Horizon system, wasn't it?
   A.  It was, absolutely.
   Q.  Central to it and fundamental?
   A.  It was part of the supporting software.  It was like
       a database layer actually at the time.
   Q.  But it was very important?
   A.  It was very important.  Replication was absolutely key
       to how it did it --
   Q.  Now we discussed the difference, identifying the
       difference between a bug that has affected one branch
       and one that has affected ten?
   A.  Yes.
   Q.  And the Dalmellington bug affected 112 -- had 112
       occurrences over 88 branches?
   A.  Yes.
   Q.  That is pretty significant as a bug?
   A.  It is significant in terms of the lasting effect is not
       significant.
   Q.  We have your point on transaction corrections.  We are
       trying to focus on the system first.
   A.  It was a bug and it affected 112 branches, we can agree
       that.
   Q.  Let's leave aside, if we may, your point on transaction
       corrections one day correcting something?
   A.  Well, transaction corrections or reversals by the
       postmaster in this case.
   Q.  Let's focus on whether the Horizon system itself goes
       wrong, and taking a view about that, at the beginning of
       the Callendar Square questions I asked you: it is
       important, isn't it, to get a feel for whether something
       has affected one branch or perhaps ten?
   A.  Yes.
   Q.  And you accepted that is a significant difference?
   A.  Absolutely.
   Q.  And it would be equally important to work out whether it
       has affected ten or 88?
   A.  Yes.
   Q.  And this bug did in fact cause errors in branch accounts
       that were then required to be corrected?
   A.  Yes.
   Q.  And so what Horizon was showing before it was corrected
       was wrong?
   A.  Error correction was needed, yes.
   Q.  What Horizon was showing before it was corrected was
       wrong?
   A.  Yes.
   Q.  Why did you not mention the number of occurrences and
       the number of branches in either of your reports?  Is
       there a reason for that?
   A.  Yes, there is a reason, and the reason is because the
       Dalmellington error was -- looked like a user error and
       was corrected in the normal event of things, it did not
       lead to Fujitsu investigations and PEAKs, and therefore
       the normal mechanisms for detection -- therefore my
       views about how many branches are affected and how
       Fujitsu can detect the number of branches affected are
       not affected by that, because Fujitsu were not called up
       about Dalmellington for good reason, because it looked
       like a user error of which there were 20,000 a year
       which got corrected.
   Q.  Let's take it in stages.  In trying to assess whether
       there was in fact a bug in Horizon which had the
       potential to affect a number of branches it is important
       to look at Dalmellington, isn't it?
   A.  It is a useful example to look at, yes.
   Q.  In your appendix at {D3/2/118}, appendix D3 to your
       first expert report, you are dealing with 62 KELs
       referred to by Mr Coyne, aren't you?
   A.  Yes.
   Q.  And at 5.23 is the Dalmellington KEL?
   A.  Which I didn't recognise as Dalmellington at the time.
   Q.  You didn't recognise it and you hadn't been told that
       there had been a Dalmellington bug by anyone?
   A.  Well, I had read Mr Coyne's report which had three
       different references to Dalmellington but they weren't
       actually connected, and the reference to this KEL didn't
       say -- it was one of the three references that didn't
       say it is Dalmellington, so that's why I didn't
       recognise it as Dalmellington.
   Q.  But you didn't recognise this was the Dalmellington KEL
       either, did you?
   A.  No, I didn't obviously.  It's not there.  I recognised
       it was a remming KEL and so that was the basis of my
       opinion.
   Q.  Now, you explain why you didn't recognise it in your
       second witness statement at page {D3/6/43} at
       paragraph 163.
           You say:
           "The reason I did not recognise that KEL acha621p
       related to Dalmellington was that I was responding to Mr
       Coyne's reference to the KEL - and in the two paragraphs
       in which he referenced the KEL (paras 5.23 and 5.130 of
       his report) he did not relate either of the paragraphs
       to Dalmellington (addressed at his paras 5.16 - 5.19),
       or to each other. It was not evident from Mr Coyne's
       report that these three separate extracts all referred
       to the same incident."
           Yes?
   A.  Yes.
   Q.  And so what we see in your table is you say that:
           "Any error will be corrected so there is no
       permanent effect on branch accounts."
           If we go back to {D3/2/118}.
   A.  Let me just read that.  (Pause)
   MR JUSTICE FRASER:  Do you want on the common screen
       {D3/2/118}, Mr Green, is that right?
   MR GREEN:  My Lord, yes, please.
           And you are looking at 5.23.
   A.  Yes.
   Q.  And third paragraph you say:
           "As above, when physical cash is counted and monthly
       balancing is done, any error will be corrected."
           As a result of that reasoning you conclude:
           "So there is no permanent effect on branch
       accounts."
   A.  In this case there are several safety nets.  There is
       the postmaster who recognises that he has done a double
       rem in and he reverses one rem.  That's one safety net.
       Then there is the postmaster who does a cash count and
       recognises his cash is wrong and does some reversal.
       And finally there is a TC.  So there are three safety
       nets there.
   Q.  It is common ground that there were transaction
       corrections for the Dalmellington branches or at least
       most of them?
   A.  I can't remember the exact numbers.
   Q.  We will come to that.
   A.  The report says they were fixed by either reversal or
       TC.
   Q.  We will come to that.
           You say on your table just below there:
           "The Peak implies that the problem may have been
       around for some time. Some Subpostmasters spotted it and
       reversed the error immediately those who did not spot it
       would see the discrepancy later, when they counted cash,
       and have to correct it in their monthly balancing."
           You obviously had to look at the PEAK to form that
       view, didn't you?
   A.  Well, I had a fairly general view that this is how cash
       transfers and remming work.
   Q.  Pause there, Dr Worden.  You say "The PEAK implies", so
       you must have read the PEAK?
   A.  I did read the PEAK, yes.
   Q.  It is not referenced in your table which PEAK it is, but
       you do reference other PEAKs.  Is that just
       an oversight?
   A.  Just an oversight.
   Q.  Let's look at the KEL at {F/1426/1} please.  You see the
       problem described there?
   A.  Cash remmed in; recorded; yes.
   Q.  "... received at an outreach branch and scanned into
       Horizon. The manual process was followed and 2 Delivery
       Receipts printed."
           Yes?
   A.  Yes.
   Q.  In the middle:
           "They were then able to press Enter again and
       another Rem In slip was printed -- And the same amount
       of cash was recorded a second time."
   A.  Yes.
   Q.  "They may have repeated several times before using
       Cancel to escape, resulting in much more cash being
       recorded on the system than they actually have."
   A.  Yes.
   Q.  You see at the bottom:
           "Known problem should now be fixed so any further
       occurrences need to be investigated - send call to
       Peak."
   A.  Yes.
   Q.  "Outreach branches can avoid the problem by making sure
       that they do not press Enter again after they have
       printed both Delivery Receipts and the Rem In slip - if
       they find the Rem In screen is still displayed,they
       should press Cancel to get out of it, ignoring the
       mental that not everything has been printed."
           Pausing there.  The system is telling them that
       nothing everything has been printed which is why they
       are progressing rather than --
   A.  The system is misleading them.
   Q.  Correct.  And it says:
           "However they are unlikely to notice immediately
       that they are on the wrong screen, and will probably.
           Have duplicated the Rem In before realising
       something is wrong."
   A.  Yes.
   Q.  It says:
           "We have seen some outreach branches apparently
       resolve the problem by remming out the excess amount but
       NBSC should advise on this. The cause of the problem is
       being investigated but it will not retrospectively
       correct the accounts at affected branches."
   A.  Yes.  I think that is the usual statement that, fixing
       the code, we will do it in future but not for the ones
       that have already suffered from it.
   Q.  At this stage you had seen the KEL.  This doesn't
       actually say that transaction corrections will be
       issued, does it?
   A.  KEL doesn't say that. No.
   Q.  No.  So on what basis when you were looking and writing
       your report did you know that these had all been
       addressed by transaction corrections?
   A.  Well, at some stage I read the document which says here
       are 112 and so many had been fixed and so on and that
       was explicit, but before that my expectation was that
       this is how remming happens.  There are 20,000 remming
       TCs per annum, therefore, my expectation is that that
       would have happened.
   Q.  So you inferred from a KEL that didn't say it that
       transaction corrections would be issued?
   A.  I mean very often one has to infer from KELs things that
       are not said.  They are written by people who know
       things that we don't know and they are not sort of
       written for us.
   Q.  You have spread that across other KELs which don't
       mention transaction corrections and reached the same
       inference, haven't you?
   A.  I have made that same inference in several cases, yes.
   Q.  And Mr Coyne found this bug by chance, didn't he?
   A.  I can't remember.
   Q.  Let's look at {D2/1/58}, paragraphs 5.16 to 5.19 on
       page 58.  Here you can see there the Dalmellington bug
       at the foot of the page?
   A.  Yes.
   Q.  £24,000 discrepancy.  Over the page {D2/1/59} we can see
       at 5.19 he concludes that:
           "The fact that Atos made a change to the Horizon
       system to prevent re-occurrence is therefore consistent
       with this being a software bug."
   A.  Atos made a change to the Horizon system is a bit
       peculiar, but it is consistent with the fact that there
       was a bug(?).
   Q.  So what Mr Coyne was doing was trying to identify
       whether there had in fact been a bug or defect in the
       Horizon system that had the potential to impact branch
       accounts here, yes?
   A.  Yes.
   Q.  And he seemed to think that that was relevant and he was
       right about that for that question?
   A.  Well, I was looking for bugs which had a lasting effect
       on branch accounts and therefore we had different
       criteria.
   Q.  If we look at {F/1394/3}.  You can see there that it
       says:
           "Please can you help.  A very strange case."
           October 2015.  You can see it says there:
           "... the remittance team in Chesterfield are aware
       of this fault and can issue a transaction correction for
       the 'extra' remittances...  They can see that the one
       barcode accepted the £8000 remittance four times (even
       though there was one item). They are unable to issue a
       transaction correction to her Outreach as it doesn't
       have a unique number. My understanding is that they have
       told her if she rems out to her core branch the
       non-existent £24,000 loss this error has created, they
       will correct/remove it from her suspense account."
           So they are well aware of this in 2015 and if we
       look please --
   A.  This is the Chesterfield team.
   Q.  Yes.  If we look please at {F/1425.1/1}.  I'm not going
       to take you through this Dr Worden, but had you looked
       at this email before you wrote your report?
   A.  It doesn't look familiar to me I must admit.
   Q.  Let's go forward to {F/1495.2/1} please.  This is
       an email looking into effectively the Dalmellington
       error which you see halfway down:
           "Subject: The Dalmellington Error in Horizon."
   A.  Yes.
   Q.  It says:
           "Dalmellington error in Horizon [then a vertical
       slash mark, then all one word] "problemswithpol".  It is
       referring to a blog by Tim McCormack campaigning against
       PO and Horizon.
   A.  Yes.
   Q.  It says the blog is independent from Sparrow but clearly
       related and so forth --
   A.  Sorry where are we?
   Q.  Bottom paragraph --
   A.  Sorry, I haven't got that blog independent paragraph.
       Where are we?
   Q.  It is the bottom of the page.
   A.  Right.  "Independent of Sparrow" whatever Sparrow is.
   Q.  It says:
           "I'm most concerned that we/our suppliers appear to
       be very lax at handling £24k. And want to know we've
       rectified all the issues raised, if they happened as Tim
       explains."
   A.  Yes.
   Q.  Then --
   A.  That's chief exec.
   Q.  Yes and then what's happening there is, second from the
       top, an urgent review and then at the very top:
           "Can you stand down on this please?"
   A.  So Sharon Gilkes says "Can you stand down?"
   Q.  Yes.
   A.  I don't know who -- sorry, the top email, who is it
       from?
   Q.  It is from a chap called Rob --
   A.  That's Rob Houghton, right.  Both of them from him.
       Yes.
   Q.  So it is clear that at least through 2015 and 2016 there
       was a considerable amount of investigation into this?
   A.  Yes.
   Q.  Were any of the documents about the investigation into
       Dalmellington drawn to your attention in your
       instructions?
   A.  No.
   Q.  Was Mr Coyne's first report the first time when you
       learnt of the Dalmellington bug?
   A.  I think it must have been.  Obviously I had seen the KEL
       and I had formed the opinion it wasn't a lasting bug,
       when I equated the two then --
   Q.  Your first report was 7th December 2018?
   A.  Yes.
   Q.  The second witness statement of Mr Godeseth and the
       first witness statement of Mr Parker were
       6th November 2018 and you had had sight of those before
       you wrote your first report?
   A.  Yes.
   Q.  16th November 2018 was their witness statement?
   A.  Yes, that is right.  It was quite close to the wire in
       terms of getting a report together.
   Q.  When you get things close to the wire it can cause
       difficulties, can't it?
   A.  Yes.
   Q.  You get hundreds of thousands of KELs or PEAKs or that
       sort of thing?
   A.  Well, those witness statements were quite close to --
   Q.  I see.  Do you remember whether you considered them
       before you did your first report?
   A.  I did consider them, yes, I'm saying it was --
   Q.  You specifically relied on them in relation to various
       issues, didn't you?
   A.  I think I did.
   Q.  Mr Godeseth gave in his second witness statement
       evidence on four bugs, Callender Square, receipts and
       payments mismatch, local suspense accounts and
       Dalmellington, didn't he?
   A.  Yes.
   Q.  Mr Godeseth's second statement at {E2/7/9},
       paragraph 34, he says:
           "Bugs:
           "In addition to the Callendar Square issue I have
       been asked by Post Office to explain how the following
       three bugs came to light and were resolved."
   A.  Yes.
   Q.  "The receipts and payments mismatch in September 2010.
           "The local suspense account issue in 2011;
           "and an issue which occurred at the Dalmellington
       branch in October 2015."
   A.  Yes.
   Q.  So he had been asked by Post Office to explain that in
       addition to Callendar Square.  There had been three bugs
       one of which was Dalmellington?
   A.  Yes.
   Q.  And you expressly relied on Mr Godeseth's evidence in
       relation to those three bugs, didn't you?
   A.  Mr Godeseth's evidence on Dalmellington really didn't
       add much to my previous view that it was a remming
       problem, these would get corrected by TCs and that's --
       remming problems in my mind don't generally lead to
       lasting effects on branch accounts.
   Q.  Will you accept from me, Dr Worden, that you expressly
       relied on Mr Godeseth at paragraph 649 of your witness
       statement?
   MR JUSTICE FRASER:  Expert report.
   MR GREEN:  I'm so sorry.
   A.  Can we go to 649 and see what it is?
   Q.  Certainly.  {D3/1/153}.  649.
   A.  "... and reaches conclusions similar to my previous
       conclusions."
           Yes.
   Q.  Yes and you then refer again to him in relation to
       receipts and payments mismatch?
   A.  Yes.
   Q.  Paragraph 650.
   A.  Yes.
   Q.  And then in relation to Callendar Square we saw you have
       done the same thing at paragraph 667, which I do not
       think we need to go to.
   A.  Yes.
   Q.  And suspense account bug paragraph 681 {D3/1/160}
   MR JUSTICE FRASER:  You are going quite quickly.
   MR GREEN:  Sorry, my Lord.
   MR JUSTICE FRASER:  Just out of fairness to the witness.
   MR GREEN:  The short point, Dr Worden, is you go through
       every bug in Mr Godeseth's witness statement apart from
       the Dalmellington bug which affects 88 branches, despite
       relying on his witness statement expressly for the other
       three, why is that?
   A.  Because my opinion has been since long before that that
       this was not a bug with a lasting effect on branch
       accounts and therefore, in terms of the scope of my
       investigation, was not an important bug because it
       doesn't leave a subpostmaster with a lasting shortfall.
   Q.  But it was an important bug because of the scale of the
       branches it affected which then required corrections?
   A.  Well it affected this 100 and so branches that is
       correct.
   Q.  And that was an important number to have a feel for to
       look at the scale of branch impacts that are possible
       from bugs in Horizon?
   A.  No, it is not because I'm looking at the scale of impact
       from bugs that don't look like something that's normally
       corrected.  If something is normally corrected then the
       investigation of it will not lead to the same result as
       something -- you see what I mean?  Something that's --
       the other three, there's real discrepancy and had to be
       investigated.  The Dalmellington one never came to
       Fujitsu for a good reason.
   Q.  Let's have a look.  {F/1415/1} we have just got time to
       look at this.  This is the Fujitsu presentation and did
       you see that presentation?
   A.  I have seen that one, yes.
   Q.  On the first page it is for "PO's internal purposes
       only", confidential.
           On the second page {F/1415/2} two potentially
       separate issues at play, the combination of which may
       lead to the scenario above.  Yes?
   A.  Yes.
   Q.  On the third page {F/1415/3} clear findings about 112
       occurrences?
   A.  Yes.
   Q.  And detail there.  Do you see at the bottom:
           "4 items still to be confirmed."
   A.  Yes.
   Q.  Then on page {F/1415/7} we see "Detailed Preliminary
       Findings"?
   A.  Yes, this is the by year findings.
   Q.  By year.  65 incidents in 2010 to 2011.  On page
       {F/1415/8} we can see 0 calls raised with Fujitsu.
   A.  Yes.
   Q.  0 calls raised with Fujitsu, 2012.  2013, 0 calls raised
       with Fujitsu and that's where we pause and see two
       unknown outcomes: value £25,000 and £2,500.  Did you
       notice that when you were doing your report, Dr Worden?
   A.  When I was doing my report it seemed to me that the main
       point was that 108 out of 112 were corrected as part of
       the normal process.  I was therefore not so concerned
       about the two which there has been a lot of subsequent
       discussion about and I believe has now turned out to be
       a different effect.
   Q.  Well, can you just answer the question just quickly.
       When you were doing your report, did you notice that
       there were two unknown outcomes, one of £25,000 and one
       of £2,500?
   A.  Well, I read this document and I must have noticed it
       but, as I say, my feeling of the importance of it in the
       context of the overall analysis of remming bugs was not
       important because things at the edge of a sample -- a
       sample of 108, four things at the edge, it is difficult
       to know what the detail to those four cases are, so
       I was concerned with the majority.
   Q.  Dr Worden, if you had seen and noticed those figures,
       you should have included this bug in your report for two
       reasons:  (1) the large number of branches affected (2)
       the size of the two unknown outcomes, do you accept
       that?
   A.  No.  The large number of branches affected is similar to
       the large number of branches affected by manual remming
       errors, much larger number.  So I don't have to -- no,
       the fact that some software errors look like human
       errors and those human errors are corrected, very much
       alters the significance of different errors, and I was
       concerned with the overall significance of Dalmellington
       and my opinion was and remains that remming errors get
       corrected.
   MR GREEN:  My Lord, is that a convenient moment?
   MR JUSTICE FRASER:  I think it is.  Thank you very much
       Dr Worden.
           I did give Mr de Garr Robinson this opportunity on
       his last day, do you want to start at 10.15 am tomorrow
       or do you think 10.30 is adequate?
   MR GREEN:  I think 10.30 should be adequate.
   MR JUSTICE FRASER:  Dr Worden, we are going to start again
       at 10.30 tomorrow.  I'm now going to listen to -- who
       knows it might be a couple of minutes, it might be
       slightly longer about disclosure.  There's no need for
       you to wait because quite frankly I don't know how long
       I would be asking you to stay, so why don't you just --
   A.  I shall slack off.
   MR JUSTICE FRASER:  I would not put it quite like that.  By
       all means you can go and we are going to revert to the
       point that Mr Green started trying to make this morning.
       Right.
                            Discussion
   MR JUSTICE FRASER:  Right, Mr Green.
   MR GREEN:  My Lord, there has been an additional thread
       added as you may have appreciated during the course of
       today, which is that at 1.02 pm we got the ARQ figures.
       The only missing year -- we were told up to 2014, they
       run back to 2004.  We discovered that there was
       a missing year.
   MR JUSTICE FRASER:  What year was that?
   MR GREEN:  Up to 2013.
   MR JUSTICE FRASER:  Is that what you were given today?
   MR GREEN:  That's what we have got.  Sorry, the year is 2013
       to 2014 is what I meant to say, I may have said the
       wrong thing.  It turns out that -- we have had to press
       for that.  It turns out there were more than the
       allowance of 720 ARQs in that year.
   MR JUSTICE FRASER:  Used?
   MR GREEN:  Used.  More than that number requested.  But as
       Dr Worden doesn't know about that I didn't put those
       figures to him.  Then, the matter which I raised this
       morning is the letter, which I understand I think may
       have been sent to the court as well.
   MR JUSTICE FRASER:  I will tell you what I saw about that.
       I saw an email from you which was pursuant to a request
       I had just made about some references and then I read
       the letter which came in as a result of your email and
       that's about I think the extraction of data into a more
       usable form which went in the WBD document and that is
       MSC data which was disclosed anyway, is that right?
   MR GREEN:  My Lord that's absolutely correct.  It was
       disclosed in separate spreadsheets and then as I hope
       I correctly and accurately explained to the court it was
       then disclosed to us in a new and different form.
   MR JUSTICE FRASER:  I understand.
   MR GREEN:  Putting content from different documents into one
       document and I cross-examined on the difference between
       the two.
   MR JUSTICE FRASER:  I understand.  That's what you wanted to
       mention this morning?
   MR GREEN:  I wanted to make sure there was no
       misunderstanding.  From our perspective that is under
       CPR 31.9, those are new documents in the same way that
       the copy with the manuscript edition that someone wants
       to rely on is a new document because they have come from
       three different disclosed documents and they have been
       put together and the way in which they have been put
       together differs and we rely on the difference.
   MR JUSTICE FRASER:  All right.  But if and insofar as that
       is a point, that's a point for submission, argument and
       for me, it doesn't affect the cross-examination.
   MR GREEN:  It was just to explain why --
   MR DE GARR ROBINSON:  It doesn't, my Lord, but I would
       welcome the opportunity to explain.  My learned friend
       during the course of his cross-examination has on
       a number of occasions said that documents have been put
       in the trial bundles.
           My Lord your Lordship will appreciate that's been
       happening more or less on a continuous basis by both
       sides throughout the entirety of this case.
           Those MSCs, they were inserted as a result of my
       request.
   MR JUSTICE FRASER:  Which I understand from the letter to
       put it in a usable form, is that right?
   MR DE GARR ROBINSON:  Exactly.  My Lord what happened was in
       Mr Coyne's second report, I think, you will forgive me
       if I can't remember particular paragraphs, but
       paragraphs 3.315 and 5.242 spring to mind, it might be
       5.424.
   MR JUSTICE FRASER:  You are just showing off.
   MR DE GARR ROBINSON:  It is a memory test.
   MR JUSTICE FRASER:  But at two places in the report?
   MR DE GARR ROBINSON:  Mr Coyne referred to MSCs that were of
       interest to him or to PEAKs that were of interest to him
       that related to MSCs.
           My Lord, I asked for the data relating to those MSCs
       to be extracted from the spreadsheets because I'm not
       very good with spreadsheets, frankly.  I find the
       smallness of the text very difficult.  My instructing
       solicitors therefore downloaded that data which
       everybody already had onto clean documents so that they
       could be easier to deploy.  I rather optimistically
       thought I would have the opportunity and time to
       cross-examine Mr Coyne about the MSCs and the issues
       that he was discussing and so I asked for those
       documents, which as I say just clarified data that had
       already been disclosed, and indeed was already in the
       trial bundles.  I asked for those to be put into the
       trial bundle.
           As it turns out my optimism proved unfounded, I ran
       out of time, so I didn't have the opportunity to
       cross-examine him on his report.
           So my Lord to the extent that there are any dark
       intimations being conjured up by this process, I'm fully
       responsible and I was trying to be helpful and I believe
       had I had an opportunity to cross-examine Mr Coyne, it
       would have been helpful.
   MR JUSTICE FRASER:  So the short points are: the data in
       those MSC documents was already available in disclosed
       documents but in spreadsheet form; they were put
       together in a more usable form for cross-examination
       purposes; and there are no dark intimations.
   MR DE GARR ROBINSON:  Indeed.
   MR JUSTICE FRASER:  I have that.  Thank you very much.  That
       was included, effectively, in the letter but of course
       it is very helpful to have it explained.
   MR DE GARR ROBINSON:  There are conspiracy theories often
       suggested and I was quite concerned to scotch that
       particular one.
   MR JUSTICE FRASER:  That's entirely understood.  Thank you
       very much.
           Mr Green, anything more to say about that?
   MR GREEN:  My Lord you will appreciate from the
       cross-examination our concern was there was a key
       document which missed out the bad bits and they are put
       together in different ways.
   MR JUSTICE FRASER:  No, I understand.  There is a point I'm
       going to raise with both of you about disclosure but it
       is not this point, but so far as the cross-examination
       of this witness is concerned, the exchanges this week
       have taken us where they have taken us and it is
       irrelevant -- I beg your pardon -- it is not going to
       affect what happens tomorrow, let's put it that way?
   MR GREEN:  Exactly.
   MR JUSTICE FRASER:  Because the timetable of this trial has
       already been affected by one or two other matters and
       that's my main concern.
           My second concern -- I shouldn't say concern but
       given the point has been raised I'm going to address it
       now rather than tomorrow.  In Mr Coyne's
       cross-examination he was asked about OCPs and OCRs and
       in re-examination it was said, I think, that there were
       two and a half thousand that were very recently
       disclosed and -- I have got the note somewhere -- that
       was also one of those eventful days in late May, is that
       correct?
   MR GREEN:  No.  That was 18th April, my Lord.  So mid-flow.
   MR JUSTICE FRASER:  Right.  Now did that come with
       a covering letter?
   MR GREEN:  I think it may have done.  My Lord would you like
       us to send you the reference?
   MR JUSTICE FRASER:  No, what I would like to do is just
       explore now, firstly with Mr de Garr Robinson,
       a quantity of documents of that number coming at that
       stage in this trial requires an explanation.
   MR DE GARR ROBINSON:  Yes.  Perhaps I can give it now?
   MR JUSTICE FRASER:  Well, you can but by all means don't
       feel obliged because I'm going to ask for a witness
       statement, but by all means tell me the explanation.
   MR DE GARR ROBINSON:  My Lord, the position is this: the
       OCPs and OCRs are maintained on the Fujitsu system and
       they were disclosed when they were disclosed back in
       January.  My Lord, so far as Post Office were concerned
       that was that.  Then much later Fujitsu discovered
       an old database that had been copied more than ten years
       previously on a system somewhere and told Post Office
       that they had found this collection of documents.
           Post Office, within a matter of days, realising they
       were disclosable, I'm not sure there was any order for
       disclosure but realising it was appropriate for those
       documents to be disclosed voluntarily in the way that
       the previous OCPs and OCRs had been disclosed, Post
       Office immediately wrote to Freeths in order to explain
       that they had learned from Fujitsu that this unexpected
       cache of OCRs -- it should be remembered we are talking
       about OCRs not OCPs, these aren't document relating to
       changes which might have been made directly to branch
       accounts -- but that information was provided as quickly
       as could be done and, my Lord, as I say, the rest is
       history.
   MR JUSTICE FRASER:  Right.  And that's what led to the
       documents being provided on the 18th April?
   MR DE GARR ROBINSON:  Yes.
   MR JUSTICE FRASER:  Let me put myself neutrally, it does not
       necessarily surprise me that they have come from Fujitsu
       rather than documents that the Post Office already had,
       but it seems to me a witness statement of explanation is
       required for my purposes.  I have looked in the H bundle
       and I have not found a letter which explains that
       situation to me the way you have explained it.
   MR DE GARR ROBINSON:  There is correspondence about this.
   MR JUSTICE FRASER:  I have seen quite a bit of
       correspondence about it but I rather ran out of steam
       when I had looked at about 10 or 20 letters.
   MR DE GARR ROBINSON:  That is entirely forgivable if I may
       say so.
   MR JUSTICE FRASER:  I'm not going to impose a draconian
       deadline on you and it is not going to affect tomorrow
       at all, but I would like please a witness statement of
       explanation about that tranche of disclosure.
           The MSC cross-examination creation document scenario
       doesn't bother me in the least.  I used to do the same
       myself and sometimes data that's already in documents is
       more usefully packaged in different forms.  I don't
       intend to say anything more about that.  Mr Green can
       explore that if and when he wants, when he makes his
       closing submissions if he feels he needs or wants to.
           But the disclosure of those documents, albeit coming
       from Fujitsu, I would like a witness statement to
       explain that.
   MR DE GARR ROBINSON:  My Lord, that will be done.  Can I say
       two things.  Ms Keating has very helpfully drawn my
       attention to two H documents which may be helpful for
       your Lordship's purposes.
   MR JUSTICE FRASER:  Yes.
   MR DE GARR ROBINSON:  {H/263/1} and {H/273/1}.  And my Lord
       deadline for the witness statement?
   MR JUSTICE FRASER:  It is not going to be before noon next
       Wednesday.  But what I would like it -- I'm not going to
       dictate all the information that needs to be included --
       but I would like to know the dates when the
       Post Office's solicitors or the Post Office was told and
       in accordance with the rules of the CPR, if the
       information is coming from Mr X or Ms X at Fujitsu, it
       should say "I was contacted by Mr X or Ms X".  It should
       not say --
   MR DE GARR ROBINSON:  Sources of information.
   MR JUSTICE FRASER:  Well in modern witness statements now
       often one just finds "I understood from company X" and
       that's not good enough.  12 o'clock next Wednesday is
       fine.  We will put that in its own separate box for the
       moment.
   MR DE GARR ROBINSON:  Thank you.
   MR JUSTICE FRASER:  There is one other point since we are
       having a sort of general round up and this isn't for
       tomorrow and it is probably not even for the closings,
       save the end of day 2 of the closings.  There are two
       case management conferences in the court diary for this
       case going forward still from the timetable as it was
       set down before March.  I will just remind you what they
       are.  One is 23rd July and one is 18th September.
           They were directed as part of what was the intended
       2019 progress of this action which has obviously not
       unfolded exactly as one would have expected and at the
       end of day 2 of the closings I think we are just going
       to have to have a brief stock-take about the shape of
       the remainder of this calendar year, and I was going to
       mention again that tomorrow but on the basis we are
       dealing with other matters, I thought I would mention it
       to you now.  Neither of you need to say anything about
       it, but it is just something we have to think about.
           So 10.30 am tomorrow.  Thank you very much.
   (4.41 pm)
         (The court adjourned until 10.30 am on Friday,
                         14th June 2019)