1 Wednesday, 8 March 2023 2 (10.00 am) 3 Announcements by SIR WYN WILLIAMS 4 SIR WYN WILLIAMS: Before we hear evidence this morning, 5 there's just some announcements that I'd like to make. 6 The first announcement is to report that over the 7 last few months two of the Inquiry's Core Participants 8 have passed away. Mrs Isabella Wall died shortly before 9 Christmas and Mrs Lynette Hutchings died more recently. 10 Each of those ladies were Core Participants, made Core 11 Participants shortly after the Public Inquiry was 12 constituted as such. 13 Each of them made a written statement, a written 14 witness statement, and the summary of that evidence was 15 read into the record, in Mrs Hutchings' case on 10 March 16 last year and, in Mrs Wall's case, the 17 March 2022. 17 The evidence demonstrates the hardship which both those 18 ladies suffered. 19 On behalf of the whole of the Inquiry Team and on my 20 own behalf, I extend condolences and deepest sympathy to 21 their family and close friends. 22 Mr Moloney, do you know whether compensation 23 payments were finalised in Mrs Hutchings' case? 24 MR MOLONEY: Not finalised, sir. 25 SIR WYN WILLIAMS: Mr Jacobs, what's the position with 1 1 Mrs Wall? 2 MR JACOBS: Sir, the letter concerning interim compensation 3 was in the post at the time of her death. Sadly, sir, 4 she died without ever knowing the sum. 5 SIR WYN WILLIAMS: That relates to interim compensation. 6 Can I take it that final compensation has not been 7 determined in her case? 8 MR JACOBS: That is correct, sir, yes. 9 SIR WYN WILLIAMS: Thank you very much. 10 The second announcement I wish to make relates to 11 a letter which I sent to the Department, BEIS, last 12 week, which I copied to the legal representatives of the 13 Post Office, concerning the statutory instruments which 14 were published by the Government relating to the 15 exemption from taxation for those participating in the 16 overturned Historic Convictions Scheme and the newly 17 constituted Group Litigation Scheme. 18 I queried whether or not such exemptions would, in 19 due course, apply to those who'd made applications to 20 the Historic Shortfall Scheme. I was hoping for a reply 21 from the Department by last evening but perhaps, 22 understandably, the Department have made a request which 23 I have granted for a short extension to respond to my 24 letter. Can I simply say at this stage that, once that 25 response has been received, I will disclose both my 2 1 letter and the response to Core Participants and publish 2 the letters on the Inquiry website. 3 The third announcement I wish to make relates to 4 today's programme. Much to my surprise, I managed to 5 get here from South Wales this morning but I'm told that 6 there is further snow forecast for this afternoon and 7 this evening and, for peace in the Williams household, 8 therefore, I wish to return before I am marooned. So 9 today's proceedings will cease at 1.00 pm. 10 I am told that will be sufficient time for Mr Beer 11 to ask the questions which he wishes to ask of Mr Dunks. 12 He also tells me that it's almost inevitable that 13 Mr Dunks will be asked to return in later phases of this 14 Inquiry and, accordingly, I am going to ask the Core 15 Participant representatives to bear with me and reserve 16 their questions for that later time so that I can 17 hopefully get on a train and go back to South Wales. So 18 thank you. 19 Over to you, Mr Beer. 20 MR BEER: Thank you very much. May I call Andrew Dunks, 21 please. 22 ANDREW PAUL DUNKS (sworn) 23 Questioned by MR BEER 24 MR BEER: Thank you very much, Mr Dunks. As you know, my 25 name is Jason Beer and I ask questions on behalf of the 3 1 Inquiry. Can you tell us your full name, please. 2 A. Andrew Paul Dunks. 3 Q. Thank you very much for coming to give evidence to the 4 Inquiry today and for the provision of your witness 5 statement. 6 In the hard copy bundle in front of you at tab A1 7 there should be a copy of that witness statement. Can 8 you open it, please. 9 A. Yes. 10 Q. It should be an 18-page witness statement dated 11 20 February -- 12 A. Yes. 13 Q. -- 2023. If you turn to the 18th page you should find 14 your signature. 15 A. Yeah. 16 Q. Is that your signature? 17 A. It is, yeah. 18 Q. Are the contents of that witness statement true to the 19 best of your knowledge and belief? 20 A. It is, yes. 21 Q. I'm going to ask you questions primarily about issues 22 that arise in Phase 3 of the Inquiry, albeit there are 23 some references to your engagement in individual 24 prosecutions, and the Group Litigation proceedings, 25 where those matters are relevant to the role that you 4 1 performed and the tasks that you undertook, which is 2 relevant to Phase 3 of the Inquiry. As the Chairman has 3 said, in any event, it was the intention to recall you 4 in Phases 4 or 5 of the Inquiry, and that's because, as 5 I think you know, you gave evidence in a number of 6 prosecutions and civil claims, including those of 7 Josephine Hamilton, Seema Misra and Lee Castleton. 8 Can I start with your background and experience, 9 please. You left school, I think, at the age often 16; 10 is that right? 11 A. Mm-hm. 12 Q. You went to a college undertaking a training course in 13 electronics; is that right? 14 A. Yes, yeah. 15 Q. You then worked building residential extensions; is that 16 right? 17 A. Mm-hm. 18 Q. Then took another job in installing acoustic vents? 19 A. Yes. 20 Q. You tell us in your witness statement that, in 1996, 21 a friend who worked for ICL offered to get you a job in 22 desktop computer support? 23 A. Yes. 24 Q. Did you get that job? 25 A. I did. 5 1 Q. Did that job involve providing IT support to ICL 2 employees? 3 A. Yes, it did. 4 Q. You tell us in your witness statement that you had no 5 experience at all in that sort of work. Was that 6 correct? 7 A. Yes. 8 Q. And no qualifications to undertake it; is that right? 9 A. No. That's right, yeah. 10 Q. To be clear, though, none of that work involved the Post 11 Office, Horizon, or the provision of IT support outside 12 ICL; is that right? 13 A. That's correct. 14 Q. Did you carry on doing that job until about 2002, so 15 about six years? 16 A. Yeah. 17 Q. You moved to the Customer Service Post Office Account 18 Security Team; is that right? 19 A. Mm-hm. 20 Q. That is sometimes abbreviated to CPSOA (sic)? 21 A. CSPOA. 22 Q. CSPOA, thank you very much. By that time, 2002, ICL had 23 become Fujitsu? 24 A. I believe so, yeah. 25 Q. By that time, when you took up this new role in the 6 1 security team, did you know anything about the operation 2 or integrity of the Horizon System? 3 A. Not at all. 4 Q. I think you were the cryptographic key manager for the 5 team? 6 A. I was, yeah. 7 Q. Although you were described as a manager, is it right 8 that you didn't manage anyone? 9 A. Correct, yeah. 10 Q. You had no reports to you? 11 A. Correct. 12 Q. You say in your statement that you reported to the 13 operational security manager? 14 A. Mm-hm. 15 Q. Can you remember who that was, please? 16 A. Well, at the time of joining, I think it was someone 17 called Bill Mitchell. 18 Q. Bill Mitchell? 19 A. Yes. 20 Q. They, in turn -- Mr Mitchell -- reported to the 21 information security officer? 22 A. I -- yes, I think so. 23 Q. Who was that? 24 A. I don't know. I can't -- I don't remember. 25 Q. Was the information security officer essentially the 7 1 head of this department? 2 A. Um ... yes. 3 Q. Where were you based? 4 A. In Feltham. 5 Q. How many people were in the Post Office Account Security 6 Team? 7 A. I think at the time about four. 8 Q. Did you receive any formal training prior to taking up 9 the role? 10 A. No. 11 Q. Did you ever receive any formal training from Fujitsu? 12 A. In what respect? I went on network -- I did a number of 13 courses within Fujitsu. 14 Q. What kind of courses? 15 A. Antivirus course, a networks course. 16 Q. What was the networks course? 17 A. Um ... I can't remember. It's about integrity -- not 18 integrity, sorry. It was about how networks work and IP 19 addresses and things like that. 20 Q. Who was it provided by? 21 A. I can't remember. 22 Q. Was it internal to Fujitsu or did you extend -- 23 A. I think it was an external company. 24 Q. How long did it last? 25 A. It was probably -- I think it was a day. 8 1 Q. Was that the nature of the training you got, sort of 2 a day here and a day there? 3 A. Yeah. 4 Q. How many days up until the time, say 2016, 2017? 5 A. I can't remember. 6 Q. Did you have an annual training programme? 7 A. There was an annual training programme but that didn't 8 mean we took it up or did any training. 9 Q. It was there on paper but you didn't necessarily always 10 do it? 11 A. Agreed, yeah. 12 Q. Why was that? 13 A. There was -- it was -- only went on a training course 14 that was specific or a need for it. 15 Q. Can you recall now any formal training that you 16 undertook with Fujitsu that was relevant to your role, 17 or has it passed into the ether? 18 A. Relevant to my role at the time of joining the Post 19 Office Account was a handover from the previous person 20 who looked after the cryptographic keys. 21 Q. How long did the handover last? 22 A. It would have been a week or two weeks. I really can't 23 remember. 24 Q. Did anyone in the Post Office Account Security Team have 25 any formal qualifications in information technology or 9 1 computer science? 2 A. I don't know. I can't remember. 3 Q. As you sit here now, nobody stands out in your memory as 4 being expertly qualified in those disciplines? 5 A. Not specifically, no, but I believed to become a CISO 6 you have to take the qualifications -- industry 7 qualifications. 8 Q. What happened did your job as a cryptographic key 9 manager involve? 10 A. Basically was to refresh the cryptographic encoding keys 11 on the counters of each branch. 12 Q. Just tell us what a cryptographic key is, please? 13 A. A cryptographic key encodes the data while it's being 14 transferred through the network to the database or the 15 Horizon system. It will encode it at source in the 16 counter that goes through the networks and will be 17 decrypted at the other end. So it's a secure transfer 18 of data, and those keys were refreshed every two years. 19 Q. So that was the period of periodic refreshment? 20 A. Yes. 21 Q. How was that done under Legacy Horizon? Do you 22 understand my use of the phrase Legacy Horizon, the 23 Horizon system before came along? 24 A. How was it done? I would have generated the new keys in 25 a secure room. 10 1 Q. How did you generate the new keys? 2 A. On a terminal in the secure room, there's a piece of 3 software, key generation software, and then from the 4 secure standalone PC they would be transferred from 5 there onto another PC which would be connected to the 6 Horizon system -- 7 MR BEER: Just pause a moment, it looks like something is 8 being said. 9 Can we just pause a moment, I think there's 10 a problem with the transcript. (Pause) 11 Sir, can I ask you to rise please whilst the problem 12 with the transcript is being fixed. 13 (10.18 am) 14 (A short break) 15 (10.26 am) 16 MR BEER: Sir, apologies for the interruption and to 17 Mr Dunks. 18 You were just telling us about the way in which you 19 provided, refreshed or updated cryptographic keys to 20 branches -- 21 A. Yes. 22 Q. -- and telling us that you generated them on 23 a standalone system at the Feltham office. 24 A. Yes. 25 Q. What happened then? 11 1 A. They were -- um, no, it wasn't at the Feltham office, if 2 I remember correctly, it would have been at -- oh, 3 actually I'm not sure. It was either Feltham or 4 Bracknell at the time. Once they were generated they 5 were transferred on a cassette onto another PC within 6 the room, and that had secure connection to the network, 7 the Horizon network, and that would then push the keys 8 out to the appropriate counters. 9 Q. How would the counters know about their new 10 cryptographic key? 11 A. I can't remember how that worked. 12 Q. Did they receive a communication separately from that 13 which was pushed out electronically? 14 A. I can't remember. 15 Q. Did the system change when you moved from Legacy Horizon 16 to Horizon Online? 17 A. Yes, it did. 18 Q. Was this your principal function: cryptographic key 19 manager? 20 A. Yes. 21 Q. You tell us in your witness statement that your rollover 22 time expanded to include other areas of information 23 technology security? 24 A. Mm-hm. 25 Q. Before it expanded into those other areas, did you 12 1 receive bespoke training in relation to each of the 2 areas? 3 A. We were given training to be able to do the job we were 4 asked to do, yes. 5 Q. Was that internal to Fujitsu? 6 A. Yes. 7 Q. I think you mentioned five areas. They are user 8 management, intrusion prevention, processing 9 applications for security checks, performing audit data 10 extractions and performing transaction reconciliations? 11 A. Mm-hm. 12 Q. Can I look at each of those five roles or functions in 13 turn? 14 A. Sure. 15 Q. Firstly, user management. You tell us in your 16 statement, it's paragraph 9, that user management 17 involved maintaining a database of all of the Fujitsu 18 employees with access to the Horizon System; is that 19 right? 20 A. Yeah. 21 Q. How many employees, broadly, were there within Fujitsu 22 who had access to the Horizon System? 23 A. I can't remember. 24 Q. Are we talking 5, 50, 500 or 5,000? 25 A. Oh, in the hundreds, yeah. 13 1 Q. In the hundreds? 2 A. It could have been 100 or 200 because not everybody 3 within the Post Office Account had access or log-on 4 access to the Horizon System itself. 5 Q. Were there different levels of access? 6 A. Yes. 7 Q. Can you describe, in broad terms, the different levels? 8 A. It varied from being able -- it depended on what system 9 they were -- that person or support person needed to log 10 on to and their level of access on what they were able 11 to do on that platform. So it would have been, if 12 I remember correctly, view only or read and then it went 13 up to an admin level where they were able to log on and 14 fix a problem or look at a problem at a higher level on 15 whatever database they had access to. 16 Q. Is that the best of your recollection now? 17 A. Yeah, that's still the same now. 18 Q. I forgot to ask you, what are you doing at the moment? 19 A. I'm still doing it the same job but specifically just 20 the key management. 21 Q. You don't do the other five things that I mentioned? 22 A. I haven't done for a while, no. 23 Q. Why is that? 24 A. We -- I think our teams expanded to seven or eight 25 people, so it's more bespoke and you're looking after 14 1 your area. 2 Q. Can we look at a document, please, FUJ00088036. Can you 3 see that this is a document entitled "Secure Support 4 System Outline Design", version 1.0 and it's dated 5 2 August 2002. 6 A. Yeah. 7 Q. So it's dated at the beginning of your role in the Post 8 Office Account Security Team; would that be right? 9 A. Yes. 10 Q. Can we please look at page 15 of the document, please, 11 and under paragraph 4.3.2, if we can just read the first 12 paragraph and the first bullet together: 13 "All support access to the Horizon systems is from 14 physically secure areas. Individuals involved in the 15 support process undergo more frequent security vetting 16 checks. Other than the above controls are vested in 17 manual procedures, requiring managerial sign-off 18 controlling access to post office counters where update 19 of data is required. Otherwise third line support has: 20 "Unrestricted and unaudited privileged access 21 (system admin) to all systems including post office 22 counter PCs ..." 23 Did that reflect the position as you understood it, 24 that those in the SSC, the third line support, had 25 unlimited and unrestricted privilege access to all 15 1 systems including post office counter PCs? 2 A. I don't know. I don't recall the level of actual access 3 that each individual had, although -- because we would 4 have given the access -- asked for and required for 5 their role and asked from their line manager. 6 Q. Did your team have the function of regulating such 7 access? 8 A. Only to the extent that we gave them the access that was 9 requested. 10 Q. So yes, you carried it out -- 11 A. Yes. 12 Q. -- ie limiting or expanding access? 13 A. It was more we got the request for access to, yes, 14 a system, and we would have passed on that request to 15 whoever then would set up the access. So we weren't 16 physically going in and editing or changing that 17 specific person's access, somebody else within another 18 team would do that. 19 Q. So who did you get the request from and to whom did you 20 send it? 21 A. I can't remember directly who it came from but it would 22 have been -- it would have come from a line manager, 23 there would have been a process in place. 24 Q. A line manager within Fujitsu? 25 A. Within whoever that person worked for. Line manager of 16 1 the person requesting or needing that access. 2 Q. Would it be within Fujitsu or from the Post Office -- 3 A. Oh no, it would be within Fujitsu, the Post Office 4 Account itself. 5 Q. Right. So -- and then you would send it to who? 6 A. We would -- I'm trying to think. We would pass it on to 7 the admin team that managed NT user accounts at the 8 time, which I believe, if I have remembered correctly, 9 and I think still is, is a support team in Belfast. 10 Q. Why was it sent through you or your team? 11 A. So we could keep records of who's got what access -- not 12 who's got what access -- who's got access to systems, 13 not the level of access. They've got to log on. 14 They've been granted permission for a log-on and it's 15 been set up. 16 Q. Was any conscious thought or brainpower applied to the 17 request that was coming in or did the fact that a line 18 manager had asked for expanded access mean that it was 19 always granted? 20 A. Yes. No, we -- for want of a better word, we were sort 21 of administering that request and passing on for it to 22 be actioned. 23 Q. So it was just an administrative function? 24 A. Yes, mm-hm. 25 Q. Did anyone, to your knowledge, apply what I've described 17 1 as brain power, ie think, "I've had a request in to 2 expand Mr X's access, the following reasons have been 3 given. I accept" or "I decline this request, pass on to 4 the accurate team to administer"? 5 A. No, that wasn't in question because we were -- no. We 6 just processed the request. 7 Q. This describes the third line support having 8 unrestricted and unaudited privileged access, including 9 to counter PCs, yes? 10 A. Yes. 11 Q. In your 21 years performing this function, did you know 12 that? 13 A. No, because I -- no, I didn't. 14 Q. You, I think -- we're going to come on perhaps next time 15 to discuss -- provided a witness statement in High Court 16 proceedings, the Bates litigation -- 17 A. Mm-hm. 18 Q. -- which I think you describe it as, the Group 19 Litigation, where you set out in a statement 12 control 20 measures -- 21 A. Yeah. 22 Q. -- the purpose of which, is this right, was to ensure or 23 assure the integrity of access to the system? 24 A. Those 12 controls were the controls put in place when we 25 extracted the ARQ data. 18 1 Q. They weren't a broader description of controls over 2 access to the system more generally? 3 A. No. 4 Q. So they're specifically about the control measures 5 concerning extraction of data? 6 A. Yes. 7 Q. You also provided -- we're going to come to discuss in 8 a moment -- witness statements in a number of criminal 9 investigations and prosecutions, in which you said words 10 to the effect of "I've looked at records of calls made 11 to helpdesks and there's nothing in those which leads me 12 to believe that the system was operating improperly or 13 the substance of the calls is relevant to the integrity 14 of the data". 15 A. Mm-hm. 16 Q. Wouldn't you want to know this kind of information that 17 we're looking at on this page in order to say that kind 18 of thing? 19 A. No. I wouldn't have needed to know that. 20 Q. There's a whole class of people who have got 21 unrestricted and unaudited access to a computer system 22 and, therefore, can make changes to it. 23 A. My witness statements were purely on individual calls 24 logged to the helpdesk and I went through each and every 25 of those calls and based my assumption or my resolution 19 1 on those specific calls. 2 Q. In the course of your time performing this function, 3 were you aware of any changes made to tighten or 4 restrict access to the third line support, the SSC? 5 A. During that time, I believe there was a project to 6 address or look at levels of -- or if people had the 7 right access within their log-ins. 8 Q. Why was there a project to look at whether people had 9 the right levels of access? 10 A. I don't know. I wasn't involved in it. I was aware of 11 it. 12 Q. How were you aware of it? 13 A. Because I think my line manager at the time was involved 14 in that project. 15 Q. Who was your line manager at the time? 16 A. It was very difficult. We had so many line managers 17 come and go. But I can't remember who specifically it 18 was at that time during that project. 19 Q. Can we look at page 1 of this document, please, and 20 scroll down. Starting from underneath the word 21 "Approved" in capital letters. 22 A. Mm-hm. 23 Q. Can you run through, please, the people mentioned, 24 starting with Peter Robinson, the IPDU Security. 25 A. Peter Robinson? 20 1 Q. Did I say a different word? 2 A. You see -- oh, sorry. I beg your pardon. I was looking 3 further down. 4 Q. Peter Robinson. 5 A. Mm-hm. 6 Q. What function did he perform? 7 A. I don't know who he was. 8 Q. Simon Fawkes? 9 A. Again, I don't know who he was. 10 Q. Colin Mills? 11 A. No. 12 Q. Then looking at the table, please, towards the foot of 13 the page, Ian Morrison? 14 A. No, the only person that I recognise is Mik Peach. 15 Q. What do you recognise about Mik Peach? 16 A. He was the head of or manager of the SSC's third line 17 support team. 18 Q. So the head of the team that we were just looking at 19 that had this unrestricted and unaudited access? 20 A. Yes, because it said the SSC, yes. 21 Q. What dealings did you have, how frequently and of what 22 nature with Mr Peach? 23 A. Actually -- infrequently, actually. 24 Q. What was the nature of your -- what was the purpose of 25 them, what was the reason for them? 21 1 A. I can't remember. I can't remember. 2 Q. Can we go over the page, please, and scroll down. In 3 that list of names is there anyone that you recognise? 4 A. Steve Parker, who was a member of the SSC team, who 5 worked -- 6 Q. And -- 7 A. Sorry? 8 Q. I'm sorry, go ahead. 9 A. Who worked for Mik Peach. 10 Q. Was your contact with him at the same level as with 11 Mr Peach? 12 A. I would probably have spoken to Steve Parker a lot more, 13 because -- to ask questions or get some information from 14 him. 15 Q. About? 16 A. Generally about the system or calls logged or -- it was 17 a number of different reasons why I would have spoken to 18 Steve. 19 Q. Could you outline to us in broad terms in what 20 circumstances you would go and speak to Mr Peach -- 21 sorry, Mr Parker? 22 A. No, I can't remember specifics that I spoke to him. It 23 would have been support issues and questions or help 24 that we needed at the time. 25 Q. Help about what? 22 1 A. About anything on the account, because they were very 2 knowledgeable about things. 3 Q. What things? 4 A. About Horizon. 5 Q. What about Horizon? 6 A. The workings of Horizon. 7 Q. What workings of Horizon? 8 A. Calls that would have been logged, that I actually had 9 to look into for the witness statements. It wouldn't 10 have just been Steve. There were many members of the 11 SSC we would have had dealings with. Within the 12 reconciliation process, we would have spoken to the SSC 13 and that could have been Steve Parker. 14 Q. Would you just speak to them or would your 15 communications be documented in any way? 16 A. I would say most of the time it was a phone call or I'd 17 walk up to the sixth floor and have a chat. 18 Q. The reason for me asking this, just so you understand, 19 is that you ended up providing witness statements in 20 a series of prosecutions -- 21 A. Yeah. 22 Q. -- which made certain assertions. 23 A. Yes. 24 Q. We're later going to explore whether those assertions 25 were true or misleading -- 23 1 A. Mm-hm. 2 Q. -- and, if untrue or misleading, what they were based 3 on, what you based your information on. So at the 4 moment I'm just trying gently to explore where you get 5 your information from; do you understand? 6 A. Mm-hm. 7 Q. So can you, with that background in mind, tell me a bit 8 more about when and in what circumstances you might go 9 to someone in the SSC? 10 A. If there was an area within calls that we'd passed on to 11 do reconciliation that we didn't quite understand the 12 wording that they'd put in within the call, um -- 13 Q. Did you treat them as the subject matter experts in 14 Horizon? 15 A. Yes, I did. 16 Q. Was there anyone else that you treated as a subject 17 matter expert in Horizon? 18 A. There were a number of different support teams, because 19 within the -- my remit of cryptographic keys there were 20 the development team for the cryptographic keys; the 21 audit system, they had a support and development team. 22 So whatever areas we worked in, there would always be 23 like a first point of contact we'd go to. 24 Q. Does the SSC stand out in your memory as -- 25 A. Oh, probably -- yes, yes, we would have gone through 24 1 them quite a lot. 2 Q. But the communications you had with them were mainly 3 verbal, either face-to-face or on the phone? 4 A. Yeah. 5 Q. That can come down, please. Can we turn to the second 6 of the five additional roles that your job expanded to 7 include and that's intrusion prevention. You tell us in 8 paragraph 10 of your witness statement that this 9 involved ensuring that antivirus software was updated 10 appropriately on the Horizon System. 11 A. Mm-hm. 12 Q. What was your role specifically in relation to that? 13 A. I wasn't heavily involved in that one but part of that 14 role was to have a look at all the platforms within the 15 Horizon System to see that they've had their virus 16 updated, signatures updated. 17 Q. Were you trained to do this? 18 A. I was trained and shown how to do that, yes. 19 Q. So you were shown how to do it? 20 A. Yes. 21 Q. So what did it involve doing? 22 A. Sorry? 23 Q. What did it involve you doing? 24 A. We'd log on to a piece of software or a platform, and 25 that would list all the platforms that were taking or 25 1 being updated with the antivirus, and if one hadn't been 2 update for a period of time, we would either -- I can't 3 remember what we did, either log a call or investigate 4 why it hasn't accepted the updates, and got it resolved. 5 Q. How would you get it resolved? 6 A. I can't remember. 7 Q. Is somebody in your team still doing this? 8 A. We're doing ESET updates. I believe so, yes. 9 Q. But you now can't remember or don't know? 10 A. No, it was a long time ago, though, that I had 11 involvement in ESET updates or antivirus updates. 12 Q. The way you describe it sounds like an administrative 13 function -- 14 A. Again -- 15 Q. -- rather than involving any technical expertise on your 16 part; is that fair? 17 A. Yes. 18 Q. Can I turn to the third role that you say you performed, 19 which is processing applications for security checks, 20 and you tell us in paragraph 11 of your statement that 21 this concerned providing administrative assistance to 22 facilitate the vetting being carried out on new 23 subpostmasters; is that right? 24 A. Yes. 25 Q. What was the nature and extent of the good character 26 1 checks carried out on subpostmasters before they were 2 appointed, to your knowledge? 3 A. I don't know the exact -- what checks were carried out, 4 because that was carried out by -- oh, the team -- it 5 was a security team based on the ground floor. 6 Q. A Fujitsu team or a Post Office team? 7 A. Fujitsu team. 8 Q. So there was a team on the ground floor, a security team 9 carrying out what I've described as character checks, 10 good character checks -- 11 A. Yes. 12 Q. -- on subpostmasters? 13 A. Yes. 14 Q. Why were Fujitsu carrying out the character checks on 15 subpostmasters? 16 A. I have no idea. 17 Q. Do you know what those checks involved? 18 A. No, I'd be guessing. 19 Q. You tell us in your statement that your role was 20 processing applications for security checks. What did 21 that involve, your role, processing the applications for 22 security checks? 23 A. It would have been receiving -- if I remember correctly 24 because they stopped quite a long time ago -- we would 25 have received an email application from the Post Office, 27 1 including photographic evidence of passports and -- 2 I can't remember what else. I remember passports. We 3 would have passed all the information of that applicant 4 down to Fujitsu security. They would then carry out 5 whatever checks, financial/background, I don't know, 6 checks to them -- for them. If it -- most of the time 7 it came back okay. Nearly all the time it came back -- 8 I can't recall when it didn't. 9 They would then come back and say, "Yes, all good". 10 We would then request a pass to be created with the 11 subpostmaster's photograph and name and I think a unique 12 ID number. We would get that and then put it in the 13 post to the Post Office. 14 Q. You said that you can't recall a check ever coming back 15 as a negative, meaning that it couldn't be refused? 16 A. Been refused -- yeah. No, I don't remember. 17 Q. At this time, say between 2000 and 2015 -- so admittedly 18 you only came into the role in 2002 -- were you aware in 19 general terms that subpostmasters were being prosecuted 20 for criminal offences? 21 A. Yes, I was aware. 22 Q. I think the answer must be yes because you provided 23 witness statements -- 24 A. Oh, yeah, yeah -- 25 Q. -- to help to prosecute them? 28 1 A. Yeah. 2 Q. Were you aware of the numbers involved of the 3 prosecutions? 4 A. No. 5 Q. Was there ever any conversation in the office? I mean, 6 we know now that between, I think, the year 2000 and 7 2015 there were about 850 prosecutions brought resulting 8 in over 700 convictions? 9 A. I wasn't aware of numbers, no. 10 Q. Was there any conversation in the office that you heard 11 about -- 12 A. No. 13 Q. -- that "We're putting all these people through these 14 good character checks, they're all coming back okay, and 15 then they're turning out to be people who engage in 16 criminal conduct"? 17 A. No, I don't recall any conversation along those lines. 18 Q. So it wasn't coming back down the line that "A large 19 number of our subpostmasters are criminals"? 20 A. No. 21 Q. Again, this sounds like you were just performing 22 an admin function; would that be fair? 23 A. Correct. 24 Q. Is that why you might not know about the bigger picture 25 that I'm describing, namely looking at the whole 29 1 dataset, how many prosecutions there have been, how many 2 people are being convicted, despite the character checks 3 we're carrying out on these people? 4 A. Correct. I'm unaware. 5 Q. The fourth task that you mention or role that you 6 mention is performing audit data extractions. You tell 7 us in paragraph 12 of your witness statement this 8 involved responding to audit record queries, ARQs? 9 A. Mm-hm. 10 Q. Is that what you understood the acronym ARQ to stand 11 for, an audit record query? 12 A. Yes. 13 Q. Would an ARQ, a query, refer to a common dataset or 14 would there be subsets within it, the request? 15 A. No, they were specifically requesting specific -- 16 Q. So if somebody said "Give me the ARQ for this Post 17 Office branch", that would be an absurd request. They 18 would have to say, "within this date range and this type 19 of data"? 20 A. Correct. 21 Q. Were you aware of any difference between Credence data, 22 ARQ data, raw data, and enhanced ARQ data? 23 A. No. 24 Q. Do you understand what Credence data is? Do you 25 understand the reference to Credence data? 30 1 A. No, I've heard of Credence data but I didn't know what 2 it was. 3 Q. In what context had you heard of Credence data? 4 A. I don't know. I don't remember. 5 Q. Had you heard of reference to raw data? 6 A. No. 7 Q. Had you heard any reference to enhanced ARQ data? 8 A. No. 9 Q. You tell us in paragraph 12 of your witness statement 10 how ARQ extractions were carried out. We've heard some 11 evidence in the Inquiry from Gayle Peacock to the effect 12 that part of the contract between the Post Office and 13 Fujitsu included the provision of an agreed number of 14 ARQ files that could be requested free of charge -- 15 A. Correct. 16 Q. -- or without specific charge. Is that something that 17 you knew about? 18 A. Yes. 19 Q. But that if the Post Office exceeded the ceiling of the 20 permissible requests for ARQ data then there was 21 a charge to be levied to the Post Office; did you know 22 about that? 23 A. Yes. 24 Q. What did you understand about the nature of the charge 25 if they exceeded the ceiling of permissible requests? 31 1 A. I don't know. I wasn't involved in those conversations. 2 Q. Had you heard of a figure of £400, for example? 3 A. No. 4 Q. What was the annual limit, to your understanding, of the 5 permissible number of ARQ requests that could be made by 6 the Post Office without incurring specific individual 7 charges? 8 A. I can't remember specific because that number went up 9 over the years. It either started below or above 700, 10 7 -- I can't remember. 11 Q. 700 or? 12 A. 750. 13 Q. Can you recall how many requests were made within that 14 ceiling -- 15 A. No. 16 Q. -- and then above that ceiling, if it was exceeded -- 17 A. No -- 18 Q. -- for which a charge was made? 19 A. -- I can't remember. 20 Q. Presumably there was a record kept of the number of 21 requests that were made to your team, so that Fujitsu 22 would know whether the -- 23 A. Yes. 24 Q. -- ceiling was being reached or not? 25 A. Well, the ARQs had a specific number, so it started on 32 1 1 April as ARQ1 and it incrementally went up during the 2 year. 3 Q. So the number of the ARQ itself will tell you whether 4 you had exceeded or they had exceeded the ceiling or 5 not? 6 A. Correct. 7 Q. Can you recall in your years working, performing this 8 extraction function, how frequently the Post Office 9 exceeded the ceiling? 10 A. I can't recall, no. 11 Q. Were you aware of any of the other commercial 12 arrangements between the Post Office and Fujitsu for the 13 provision of ARQ data -- 14 A. No. 15 Q. -- such as turnaround times? 16 A. There were SLAs for certain amounts of data that were 17 requested, yes. 18 Q. Can you help us with those? 19 A. I can't remember what they were. It may have -- sorry. 20 I can't remember but I would be guessing that some 21 were -- it depended on the number of days requested, how 22 long we had to extract it and return it to the Post 23 Office. 24 Q. Ie the size of the dataset -- 25 A. Yeah. 33 1 Q. -- that you were asked to harvest -- 2 A. Yes. 3 Q. -- affected the timeliness of the provision of it? 4 A. That's what I remember, yes. 5 Q. Can you recall anything else about the commercial 6 arrangements between the Post Office and Fujitsu, for 7 example whether the provision of witness statements was 8 included within the price -- 9 A. No. 10 Q. -- for which no additional fee was levied or whether 11 a witness statement came at a cost? 12 A. I have no idea no. 13 Q. Is that because you now can't remember or it wasn't 14 something that you would ever have known about? 15 A. I don't believe I ever knew the cost or charges that 16 Fujitsu had the Post Office. 17 Q. You were the person, as we'll come on to discover, that 18 was actually providing the witness statements -- 19 A. Mm-hm. 20 Q. -- about the extraction of data? 21 A. Yes. 22 Q. How you'd gone about it, what it consisted of, and what 23 you thought it showed? 24 A. Yes. 25 Q. Were there never any discussions about how much Fujitsu 34 1 was earning from this function and therefore the work 2 that you put into it? 3 A. No, never. 4 Q. Was there any limitation ever put on the work that you 5 put into the investigatory activity that you carried out 6 before providing a witness statement? 7 A. No. 8 Q. So they didn't say, "We're getting [X] pounds, Fujitsu 9 are getting [X] pounds for providing this witness 10 statement" -- 11 A. No. 12 Q. -- "and therefore you should only spend [Y] time doing 13 the work"? 14 A. No, not at all. I'd never heard of that. That was 15 never a discussion. 16 Q. So you could spend as much time as was necessary in 17 order properly to research the issue that you were being 18 asked to address in the witness statement before 19 providing the witness statement? 20 A. Oh, definitely. I would have needed as much time as 21 I needed to understand the nature of the call. 22 Q. It's correct, isn't it, that in broad terms ARQ that was 23 branch data that related to all of the key strokes on 24 the system that somebody in the branch had undertaken? 25 A. Not key strokes. That probably was part of the data. 35 1 It was more the transaction and what was paid for, what 2 was -- and how much each transaction. 3 Q. It was an insight into what tasks were being undertaken 4 in branch, at what the end user was doing on the system 5 and when? 6 A. Yes. 7 Q. So it was a good window, a good insight into what was 8 going on in the branch? 9 A. I would say so, yes. 10 Q. You tell us in your witness statement that the requests 11 for ARQ data would specify the branch, the date range, 12 and the data type to be extracted; is that right? 13 A. The? 14 Q. The branch, the date range and the data type to be 15 extracted? 16 A. Not the data type. It just would have been the data 17 within that date range. 18 Q. Just look at WITN00300100. Please look at page 3, and 19 look at paragraph 12 at the bottom and look at the third 20 line. If this could be highlighted please: 21 "Each ARQ would specify the relevant Post Office 22 branch, date range, and data type to be extracted." 23 That's where I got that from. 24 A. The data type would have been the transactional data. 25 Q. I don't understand what you're meaning by saying, "Ah, 36 1 but it would have been the transactional data". Can you 2 explain, please? 3 A. They were -- the request on the ARQ would have been the 4 archived transactional data and that's the data type. 5 Q. So what different specifications could there be for data 6 type? 7 A. There wouldn't have been any that I can recall. 8 Q. So why did each ARQ need to specify the data type to be 9 extracted, if there was only one type? 10 A. I don't know. 11 Q. What was the purpose of -- I mean, where did this appear 12 on the form or the document: "Data type to be 13 extracted", and then it would always say the same thing? 14 A. I can't remember if it specifically said "This data 15 type". 16 Q. Can you just explain what you were meaning, then, in 17 this sentence in your witness statement: 18 "Each ARQ would specify ... the data type to be 19 extracted." 20 A. That would have meant that they were after -- the ARQ 21 meant that they were after the transaction data. That's 22 my meaning of that. 23 Q. Was it explained on the request the purpose to which the 24 ARQ data that had been requested was to be put? 25 A. Sorry, say it again? 37 1 Q. Was it set out on the request, was it explained on the 2 request, the purpose to which the data that had been 3 asked for was going to be put? 4 A. No. 5 Q. What did you understand the purpose to which the data 6 that you were being asked to provide was going to be 7 put? 8 A. They would be using it for investigation of any type. 9 Q. What do you mean investigation of any type? 10 A. Investigating any fraud that was possibly going on. 11 That was my understanding. 12 Q. So you knew that it was about a fraud investigation? 13 A. Yes. 14 Q. There wasn't a field on the request form that said, 15 "This is for [X] purpose or [Y] purpose"? 16 A. Not that I remember, no. 17 Q. Was the request filled in by someone in Fujitsu or the 18 Post Office? 19 A. The Post Office. 20 Q. How did you receive the request? 21 A. Via email. 22 Q. In a standard form -- 23 A. Yes. 24 Q. -- or -- 25 A. Yeah, yeah, yeah. Sorry, it would have come to -- the 38 1 CSPOA Security Team had a shared email account and that 2 would have come into that account asking for, "Can you 3 please supply the attached data", and the attached would 4 have been the ARQ in a Word document. 5 Q. Right. So that would be an email directly from somebody 6 in the Post Office? 7 A. Yes. 8 Q. The attached Word document, was that a pro forma? 9 A. When you say pro forma? 10 Q. A template document? 11 A. Yes. 12 Q. Whose template document was it? 13 A. I -- 14 Q. Was that a Fujitsu one or a Post Office one? 15 A. I have no idea where it originated from. 16 Q. But that template document would have fields in it which 17 said, "Post Office branch", "data sought from this date 18 to that date". 19 A. Yes. 20 Q. Were there any other fields in the template document? 21 A. I'm trying to remember. There were ones which asked 22 whether HSD call hardware calls were required. 23 Q. Yes, explain to us what that additional request might -- 24 why that additional request might be made? 25 A. Because they wanted to see what calls -- helpdesk calls 39 1 were logged at that particular branch between that 2 date -- at that date range. 3 Q. So that was an add-on, was it? That wasn't always 4 requested? 5 A. Correct. 6 Q. So that might be specifying the type of data sought, 7 just thinking back to your witness statement? 8 A. Yes, I suppose it could, yes. Yeah. 9 Q. Yes. Please continue. Were there any other types of 10 add-ons, as I've called them, that might be specified on 11 the template? 12 A. There were whether a witness statement was required, yes 13 or no. 14 Q. Yes. 15 A. Within -- oh, God -- I think there was a section of "Any 16 other" or "Any additional", and they would possibly 17 sometimes specify a specific transaction, or "Can you 18 find or highlight a transaction that took place on", 19 a certain day for a certain amount of money. That again 20 would be another request, within the -- on the ARQ form. 21 Q. So a much more targeted request? 22 A. Yes. 23 Q. Anything else? 24 A. I can't remember anything else, no. 25 Q. Were you told within the request form whether the audit 40 1 extraction sought, the product of it, was to be used for 2 civil or criminal litigation purposes? 3 A. I don't think it -- no, I don't think so. 4 Q. The request for a witness statement might give a clue to 5 that, mightn't it? 6 A. Yeah, sorry, yes, if it was requesting a witness 7 statement, yes. 8 Q. Was there any difference in the way that you went about 9 harvesting the data sought or the means by which you 10 supplied it if you knew it was going to be used for 11 those purposes, criminal or civil litigation? 12 A. None whatsoever. 13 Q. There wasn't an additional standard applied or different 14 steps undertaken? 15 A. No. 16 Q. It was all the same? 17 A. Yes. 18 Q. When were you first asked to perform these audit 19 extractions? 20 A. I couldn't tell you. I joined, as I said, 2002. 21 Somebody else was running ARQs at the time. I may have 22 done some in 2002 or 2003, if that person was on -- 23 there was only one person doing the ARQs at the time. 24 Q. Who was that? 25 A. I can't remember her name and I can't tell you the exact 41 1 date of my very first ARQ that I ran. 2 Q. Was that person, the lady you can't remember the name 3 of, the person that gave you the on-the-job introduction 4 to how to do this? 5 A. Yes. 6 Q. Was there anything more developed or involved than that? 7 A. No, no. 8 Q. Who was your boss at this time? 9 A. I can't remember at the time who my boss was when 10 I joined. 11 Q. Why did you take over or your role expand to include 12 this function? 13 A. I think it was because that person left. 14 Q. What did you think of the task that you were being asked 15 to perform? 16 A. What do you mean what did I think about it? 17 Q. Did you think, on the one hand, "This is data 18 extraction, it's a process driven function, I get 19 a request in, I type into a computer the information 20 sought and then I pass it on" -- 21 A. Correct. 22 Q. -- or did you think, "I'm performing an important 23 function, the data which I produce may be used in 24 criminal prosecutions, which prosecutions may seal the 25 fate of an individual subpostmaster"? 42 1 A. It would have been the first. 2 Q. So did you have any sense or idea of the significance of 3 the function that you were performing? 4 A. The significance was that we were extracting the data 5 and it had to be the exact data that was requested. So 6 it was what they required, no more. They hadn't -- 7 Q. So you had to get the date range right? 8 A. Yes, we had to get the data that they requested was 9 correct and pass it on, yes. 10 MR BEER: Can we look, please -- in fact, that might be an 11 appropriate moment for a morning break. Could we take 12 a slightly shorter break -- 13 SIR WYN WILLIAMS: Yes, of course. 14 MR BEER: -- and maybe come back at 25 past, please? 15 SIR WYN WILLIAMS: Certainly, yes. 16 MR BEER: Thank you, sir. 17 (11.14 am) 18 (A short break) 19 (11.26 am) 20 MR BEER: Thank you, sir. 21 Mr Dunks, can we look please at FUJ00002000. This, 22 is, you'll see from the title, a "Service Description 23 for the Security Management Service". It's dated 24 6 March 2006, it's version 3. Then if we just scroll 25 forward to page 3 of the document. The first box at the 43 1 top of the page, "Issued for Information -- Please 2 restrict this distribution list to a minimum". 3 You are one of the people to whom it was 4 distributed? 5 A. Yes. 6 Q. I use this document because it provides a description of 7 some of the data that could be requested and provided on 8 an ARQ and other request. Can we go, please, to page 11 9 of the document and go to beyond halfway down to 10 paragraph 3.10. You'll see that there are some 11 definitional sections. I'm not too worried about the 12 purpose to which these were put but I just want to see 13 whether you recognise the distinctions that are being 14 drawn in this description of the security management 15 service of which you were a part. 16 You will see firstly there's a defined term: 17 "'Banking Transaction Record Query' means a Record 18 Query in respect of a Banking Transaction which the Data 19 Reconciliation Service has reconciled or has reported as 20 an exception, the result or records of which are 21 subsequently queried or disputed by the Post Office or 22 a third party ..." 23 Then: 24 "'Audit Record Query' [an ARQ] means a Record Query 25 which is not a Banking Transaction but which relates to 44 1 Transactions ..." 2 Do you recognise the distinction being drawn between 3 those two things? 4 A. Yes, I think so, yes. 5 Q. Would you sometimes receive requests for banking 6 transaction record queries and sometimes receive 7 requests for ARQ, audit recovery queries? 8 A. I don't recall or remember them being a distinction on 9 the ARQ form. 10 Q. Can we continue and look at "Old Data", do you see "Old 11 Data is defined as meaning: 12 "... extraction of records created before 3rd 13 January 2003, but not earlier than 18th May 2002 before 14 which data was automatically deleted ..." 15 Just stopping there, does that ring a bell with you? 16 Does that accord with your recollection that there was 17 a time at which data was automatically deleted from the 18 system? 19 A. Yes. 20 Q. Can you remember what the period of deletion was and 21 whether it was uniform across all datasets? 22 A. My recollection is that it was six or seven years. 23 Q. This document was written in March 2006 and it suggests 24 that data just under 4 years old had been automatically 25 deleted. Your recollection is different? 45 1 A. No, my recollection is when I knew it was being -- there 2 was a deletion, was, I think around six or seven years. 3 At the time of this I wouldn't have known that it was 4 being deleted. 5 Q. Why was that? In what circumstances did you come to 6 know about the automated deletion of data? 7 A. Later on in years, when we were requesting or we got 8 an ARQ, and the date range included and it came back, 9 and there was no data -- part of that data, was, say, 10 missing, there weren't any transactions for certain 11 dates, then I had queried the missing data and then was 12 informed it's gone past the date of deletion. 13 Q. I understand, I think. It continues in the third line 14 of "Old Data": 15 "... relating to Transactions, other than Banking 16 Transactions meeting the Search Criteria." 17 "Search criteria" is itself a defined term. If we 18 go over the page, please, and scroll down: 19 "'Search Criteria' means: 20 "In the case of an Audit Record Query ..." 21 You remember it distinguished earlier by saying 22 audit record queries are not banking transaction record 23 queries: 24 "'Search criteria' means ... 25 "(a) Date or dates (not exceeding 31 consecutive 46 1 days) Branch FAD and PAN (or equivalent identifier); or 2 "(b) Date or dates (not exceeding 31 consecutive 3 days), and Branch FAD code; or in the absence of a FAD 4 Code the full Branch Postal Address ..." 5 So can you remember what a branch FAD or FAD code 6 was? 7 A. I don't know what FAD stood for but it was the unique 8 branch code. 9 Q. It was a unique identifier that related to an individual 10 branch? 11 A. Yes. 12 Q. Would it relate to an individual counter on the 13 branch -- 14 A. No -- 15 Q. -- or the branch as a whole? 16 A. -- the branch as a whole. 17 Q. Thank you. PAN? 18 A. PAN is the unique -- I can never remember what it was. 19 It's in my witness statement. It was the unique number 20 associated to, I believe, a credit card. 21 Q. A credit card? 22 A. Yeah, a card used for payment. 23 Q. So was that one of the search criteria that you were 24 provided with? 25 A. Yes, I was, yes. Because within the ARQ, where it was 47 1 asking for certain transactions for certain amounts, 2 they would then ask for if it was there, for the PAN 3 number to be supplied, as well. 4 Q. You think "PAN" might refer to a Primary Account 5 Number -- 6 A. Yes, sorry, yeah. 7 Q. -- rather than a credit card? 8 A. Yes. I wouldn't fully -- yes. Yes, it was. We always 9 associate it with a card number. I don't know why. 10 Q. So the account number would be what, of the 11 subpostmaster? 12 A. No. I believe it's the person who is making the 13 payments -- 14 Q. The customer? 15 A. Yes. 16 Q. Okay. Does this section here, looking at the 17 specification of what the search criteria should be, 18 reflect your understanding of how ARQ data was 19 extracted? 20 A. Yes. 21 Q. You tell us in paragraph 12 of your witness statement 22 that the person undertaking a search would log on and 23 enter the parameters, you describe them as. Would the 24 parameters be the search criteria here? 25 A. Yes. 48 1 Q. Yes? 2 A. Yes. 3 Q. Could audit data be extracted for a date period longer 4 than 31 days? 5 A. Yes, it could, but they would have been the split-up 6 into individual ARQs. An ARQ would have been a month's 7 worth of data. So if they wanted two months of data, it 8 would have been two ARQs. 9 Q. So if a search period exceeded a 31-day consecutive date 10 period, that would count as a multiple request for the 11 purposes of charging the Post Office? 12 A. I believe so. As I say, I wasn't aware of charging the 13 Post Office. I just knew we were allowed -- we had 14 a set/finite number of ARQs to process so I wouldn't 15 have known how much one was or two was being charged. 16 I didn't believe that we were charging on 17 an individual -- I wasn't aware we were charging on 18 an individual basis. I think they were charged for the 19 total and if they used that total or below that total, 20 we were still being charged -- or they were still being 21 charged that set amount. That's my belief. 22 Q. So if a single ARQ request came in seeking to extract 23 data for a period of years, would that be chunked up by 24 you into a series of ARQs, each for a 31-day period? 25 A. We wouldn't have chunked it up. The Post Office were 49 1 aware that we only did that in 31 days so they would 2 have supplied the ARQ numbers to represent the amount of 3 days. 4 Q. So if ARQ data was sought for, say, a two-year period, 5 Post Office would know that they would need to put in 24 6 ARQs? 7 A. Yeah. 8 Q. Did that happen, that you would have ARQ requests for 9 a considerable period of time, a number of years? 10 A. Yes, that did happen, yes. 11 Q. How frequently did that happen? What was the typical 12 period for which you were asked to extract data? 13 A. (The witness laughed) 14 Q. Was it generally a period within a month or was it 15 generally multiple months? 16 A. It varied. It could have been two days or a day's worth 17 of data. It could have been two months, six months or 18 a year. It varied each time. 19 Q. Can we look at page 13 and the table on it, please. 20 This I think sets out the limits of queries, both ARQs 21 and banking transactions, in successive tables. Can you 22 see the way that the table is constructed? Along the 23 top are the "Limits on Banking Transaction Record 24 Queries", and I think you said you weren't aware of 25 those coming in as a species on their own? 50 1 A. I couldn't remember those coming in as -- no. 2 Q. Therefore, if we look on the right-hand side, "Limits on 3 Audit Record Queries Carried out by Security and Risk 4 for Post Office", and the "Limit & Target Times": 5 "Subject to [another paragraph], the limit per year 6 ... shall be the first of the following to be reached: 7 "720 [ARQs] consisting of Old or New Data or APOP 8 Voucher Queries." 9 Can you remember what APOP voucher queries were? 10 It's a defined term in the document. I just wanted to 11 see whether -- 12 A. I don't know what -- I can't remember what APOP stood 13 for. 14 Q. Did you ever conduct such queries, so far as you can 15 remember? 16 A. I may have done. I can't remember. 17 Q. In any event, 720 in a year or "15,000 Query Days". Can 18 you remember that approach, a query day? That's 19 a defined term meaning each date against which an audit 20 record query is raised? 21 A. I don't remember that being a limit. 22 Q. Then: 23 "The limit per ... month, allowing a 'burst rate' of 24 14% ..." 25 Do you remember that, a discussion of a burst rate 51 1 of 14 per cent? 2 A. No. 3 Q. So: 4 "The limit per ... month ... shall be the first of 5 ... 6 "100 [ARQs], of which not more than 10 shall be APOP 7 Voucher Queries or. 8 "2,100 Query Days subject to the constraints of the 9 agreed annual limits above." 10 Do you remember that? 11 A. No. 12 Q. Did any of this that I'm showing you now affect the way 13 you carried out your work? 14 A. No. 15 Q. You just got a query in and you did it? 16 A. Yes. 17 Q. Is that -- 18 A. Yes. 19 Q. -- a fair way of describing it? 20 A. Yes. 21 Q. Would you again see your role as an administrative one? 22 A. Yes. 23 Q. The 720 sounds like something that you were familiar 24 with because you mentioned it earlier? 25 A. Yes. 52 1 Q. Did that ever change over time? 2 A. I recalled it going up but I can't recall what it went 3 up to. 4 Q. What did you understand the purpose of the limitation to 5 be? 6 A. That's what we were contracted to do. That was the 7 limit. 8 Q. Did you understand it was about money, essentially? 9 A. No, no, I didn't. Well, yes, because that's what they 10 paid for, 720 queries so, yes, it was about money. 11 Q. So did you know that if they went above that, there 12 would be additional money needed to change hands? 13 A. I don't recall because I wasn't involved in any of those 14 discussions at that level. 15 Q. Can we turn on, please, to page 15 of the document, and 16 look at the bottom of the page, under paragraph 3.10.8, 17 "Litigation Support". Can we just read it together: 18 "Where Post Office submits an Audit Record Query or 19 Old Format Query, at Post Office's request Fujitsu 20 Services shall, in addition to conducting that query: 21 "a) Present records of Transactions extracted by 22 that query in either Excel 95, Excel 97 or native flat 23 file format, as agreed between the parties ..." 24 Does that ring a bell? 25 A. The Excel does but not the native flat file format. 53 1 I wouldn't know what that was. 2 Q. So did the extractions always occur in Excel? 3 A. That I recall, yes. 4 Q. Over the page, please: 5 "b) Subject to the limits below: 6 "Analyse: 7 "The appropriate Fujitsu Services Helpdesk records 8 for the date range in question; 9 "Branch non-polling reports for the Branch in 10 question; and 11 "Fault logs for the devices from which the records 12 of Transactions were obtained." 13 So the request that came in on the template 14 document, would that specify which of these three things 15 the Post Office wanted you to do? 16 A. I only recall the first one, which was the helpdesk 17 calls. 18 Q. Did you ever do the second or third things? 19 A. Not that I remember, no. 20 Q. Would you know how to do the second and third things? 21 A. No. 22 Q. So the template document, did that include these things, 23 and they weren't ticked or they were crossed through? 24 A. I can't remember, actually. 25 Q. So the request didn't come in a batch lot, essentially 54 1 saying, "Please do all of these things"? 2 A. No. 3 Q. You were only ever asked to analyse the appropriate 4 Fujitsu Services helpdesk records for the date range in 5 question? 6 A. No, it wouldn't have said "analyse", it would have said, 7 "Please supply the helpdesk calls". 8 Q. Well, there's a difference between the supply of 9 a record of something and an analysis of it, isn't 10 there? 11 A. Yes. 12 Q. Where did you get the understanding from that your duty 13 was limited to the supply of existing records, rather 14 than the analysis of them? 15 A. From our training that we had and from our management 16 team. 17 Q. Who gave you the training? When was that given? 18 A. For audit retrieval, it would have been the person who 19 was running it at the time I joined the team. 20 Q. So the lady whose name you can't remember -- 21 A. Yes, yes. 22 Q. -- who gave you some on-the-job training? 23 A. Yeah. 24 Q. You said your managers. Can you remember any 25 conversations or discussions with them as to whether 55 1 your job was just to supply the records of helpdesk 2 calls or whether you needed to conduct an analysis of 3 them, ie to set out what they showed, in your view? 4 A. That wasn't a request. That was never a request, unless 5 it was a specific request from the Post Office Security 6 Team. 7 Q. How would the Post Office Security Team make such 8 a specific request? 9 A. On the ARQ form. 10 Q. So when the Post Office Security Team made a specific 11 request to analyse, that was identified on the form? 12 A. No. Again, the form would have said, "Can you please 13 supply", I don't know the exact wording but it was 14 basically "Supply a list of all the helpdesk calls in 15 that date range". 16 Q. So did you never understand that it was your role to 17 analyse the data that you were supplying? 18 A. It wasn't a specific role. But that's something that 19 I undertook later on when -- 20 Q. Why did you undertake it later on? 21 A. Because we had a request for a statement for analysis of 22 those calls. 23 Q. So it was only when you were asked to provide a witness 24 statement, did you analyse the data that you were 25 providing? 56 1 A. Correct. 2 Q. So does it follow that, save where there was actually 3 a prosecution or civil proceedings afoot, ie it had got 4 to that stage, the Post Office never asked you to 5 analyse the data that you were providing to set out what 6 it showed? 7 A. Yes. 8 Q. What kind of litigation did you think the witness 9 statements were being used for? 10 A. Like I said earlier, it was for prosecutions. 11 Q. Did you know about civil proceedings? 12 A. No, I didn't -- wouldn't know what the difference was. 13 Q. If we carry on reading, the third thing under the 14 heading "Litigation support", if the Post Office 15 submitted an ARQ then Fujitsu shall, in addition to 16 conducting that query: 17 "c) In order to check the integrity of records of 18 Transactions extracted by that query; 19 "Request and allow the relevant employees of Fujitsu 20 Services to prepare witness statements of fact in 21 relation to that query, to the extent that such 22 statements are reasonably required for the purpose of 23 verifying the integrity of records provided by Audit 24 Record Query or Old Format Query, and are based upon the 25 analysis and documentation referred to in this 57 1 paragraph 3.10.8 ..." 2 The contractual requirement or Fujitsu's own 3 description of it is, in some cases, to provide 4 a witness statement of fact. When you were providing 5 witness statements, did you understand the distinction 6 between a witness statement of fact and a witness 7 statement that provided opinion? 8 A. Yes. 9 Q. Did you consciously limit your witness statements to 10 statements of fact? 11 A. Sorry, say that again? 12 Q. When you provided witness statements, did you 13 consciously limit them to include only statements of 14 fact? 15 A. No, because I'd supplied two different types of witness 16 statements. 17 Q. What were the two different types? 18 A. One regarding ARQ data and one regarding helpdesk calls. 19 Q. For ARQ data was that a statement of fact? 20 A. Yes, it was. 21 Q. Was that really producing records? 22 A. Yes. 23 Q. For the other species of witness statement, did that 24 include statements of opinion? 25 A. Yes. 58 1 Q. When you were making those witness statements, you 2 realised that you were doing something different from 3 the first type of witness statement? 4 A. I believe so, yes. 5 Q. Was that ever a discussion point between you and other 6 people in the team or your managers? 7 A. No, I don't believe so, no. 8 Q. Now, speaking in general terms here at the moment, what 9 differential level of analysis and investigation did you 10 undertake when you were providing a witness statement 11 that included opinion? 12 A. Sorry, can you -- 13 Q. Yes. What difference of approach did you have, if any, 14 when you were providing a witness statement that 15 included opinion? 16 A. The different approach I would have taken was to fully 17 understand the information that was listed and so 18 I could make that judgement of opinion. 19 Q. What analysis would you therefore undertake when you 20 were providing these statements of opinion? 21 A. I would have looked at each -- because these referred to 22 individual calls to the helpdesk, so I would have 23 analysed each of the calls on an individual basis, using 24 what knowledge or tools I had to my -- that were -- that 25 I could have. 59 1 Q. Did you ever speak to anyone when you were providing 2 that opinion? 3 A. Yes. 4 Q. Who would you speak to before you provided the opinion 5 in the witness statements? 6 A. To get a clear understanding of the call, I would 7 either -- if I didn't need an opinion, and to my 8 knowledge of the Horizon account I would have based that 9 on my knowledge of the account, and the Horizon 10 System -- I would either -- then if I -- I would have 11 spoken to a member of the team. 12 Q. Which team? 13 A. The security operations team. 14 Q. Your colleagues in -- 15 A. The yes. 16 Q. -- in the four or five growing to seven or eight? 17 A. Yeah. I would have looked at the detail specifically 18 for that helpdesk call or the text and everything 19 contained within it, and I would -- another option would 20 be to speak to the SSC to gain their knowledge around 21 what's happening on the call. 22 Q. They were the people whose actions were recorded in the 23 records of the helpdesk option? 24 A. Yes. 25 Q. So you'd go back to the people whose documents you were 60 1 looking at? 2 A. Sorry? 3 Q. You'd go back to the SSC? 4 A. Yes, I mean, most of the -- I say most, I think all of 5 the calls were dealt with by the SSC. So I would have 6 spoken to them to get a clear understanding, so I could 7 make my judgement on that particular call. 8 Q. Did anyone give you any instruction or guidance as to 9 what you should include in your witness statement that 10 reflected the background work that you undertook before 11 you wrote the witness statement? 12 A. Sorry, say that again, sorry? 13 Q. Yes. Did you receive any guidance or instruction about 14 including in the witness statement a narrative of what 15 investigatory work you had undertaken -- 16 A. No. 17 Q. -- who you'd spoken to? 18 A. No. 19 Q. So does it follow that you just decided to do what you 20 thought you needed to do and that was best? 21 A. Well, the -- 22 Q. Because when we look at your witness statements, you'll 23 see that the thing that you're describing is all dealt 24 with in a single sentence, essentially -- 25 A. Yes. 61 1 Q. -- and it's pretty much the same sentence in each 2 witness statement? 3 A. What I would have based my witness statement -- the 4 first one that I actually did was -- again, would have 5 been a request of helpdesk calls logged from that 6 branch. I would have then -- which -- where I was 7 coming from was to enable the Post Office to understand 8 what type of calls those calls were logged -- that were 9 logged involved and what type of call it was. And 10 that's what I was -- my witness statement and the 11 details were about. 12 Q. We will see in due course that you include a sentence in 13 the witness statement when you're dealing with the calls 14 to the helpdesk along the lines of "None of these calls 15 to the helpdesk relate to faults that would have had 16 an effect on the integrity of the information held on 17 the system". 18 A. Mm-hm. 19 Q. Something like that? 20 A. Yes. 21 Q. Was that taken from your predecessors' production of 22 witness statements? 23 A. I believe so, yes. 24 Q. So were you using a wording that had been sort of passed 25 on, like some oral tradition, from one person to the 62 1 next? 2 A. Yes, there would have been a template to use. 3 Q. No one said to you, "When you say that kind of thing, 4 you really need to say what work you've done to reach 5 that opinion, who you've spoken to, what they've told 6 you and the extent to which it affected your opinion"? 7 A. No. 8 Q. You just thought, "So long as I am of that view, I can 9 reprint the standard line"? 10 A. Yes, because that's what I believed at the time. 11 Q. You seem to have provided witness statements in many of 12 the cases involving subpostmasters and many of the 13 significant cases which this Inquiry is going to look 14 at. Did you undertake more of this litigation support 15 role than anyone else in the security team? 16 A. No. That was really run -- the litigation support side 17 of it was run by a colleague, Penny Thomas. 18 Q. When you say the litigation support was run by Penny 19 Thomas, what do you mean by "run"? 20 A. She controlled or managed what went on. 21 Q. Was she a manager of you? 22 A. No. 23 Q. Was she the same level or grade as you? 24 A. Yes. 25 Q. So it was just her job function to manage? 63 1 A. Yes. 2 Q. So how did it come about that you appear to have 3 provided many witness statements involving significant 4 cases that this Inquiry is looking at? 5 A. I don't know, actually. Because I believe I was 6 running -- doing ARQs before Penny joined the team and 7 then the majority of ARQs -- I wouldn't say ARQs -- 8 anything to do with litigation would have been picked up 9 by Penny Thomas. 10 Q. Was it just the pair of you that provided witness 11 statements or was there anyone else in the team, to your 12 recollection? 13 A. I think it was just the two of us. 14 Q. Did you have any contact with anyone from the Post 15 Office's Legal Division about what it was permissible or 16 impermissible to say in a witness statement? 17 A. I had no contact like that at all, no. 18 Q. Were you aware of the Post Office making ARQ requests 19 for the purposes of deciding whether or not to prosecute 20 a subpostmaster in a criminal court? 21 A. No. 22 Q. Were you aware that the Post Office was not requesting 23 ARQ data prior to or when prosecuting some 24 subpostmasters in relation to their shortfalls? 25 A. Can you say -- 64 1 Q. Yes, were you aware that they were proceeding with 2 prosecutions without having first asked for ARQ data? 3 A. No, I wasn't aware. 4 Q. Were you aware of any discussions within your team about 5 that? 6 A. No. 7 Q. "They're going ahead with prosecutions without having 8 come to us first asking for ARQ data"? 9 A. No, I would -- no. 10 Q. Can we look at FUJ00095195. If we just look at the 11 whole page first so we can capture Mr Simpson's name and 12 his signature block. Can you recall Alan Simpson, 13 security incident senior in Post Office operations in 14 Ashford? 15 A. I remember -- yeah, there was an Alan Simpson, yeah. 16 Q. What was your understanding of Mr Simpson's role? 17 A. That he worked in the Fujitsu -- Fujitsu? -- Post Office 18 Security Team. 19 Q. Your team was described in some documents as the 20 security team, was this different, then? 21 A. I don't know what -- the workings or what their security 22 team did. 23 Q. Anyway, he's emailing you on 12 April 2010, under the 24 subject "Monthly incident log for March 2010" and 25 there's attached a spreadsheet called "IncidentLog", and 65 1 says: 2 "Hi Andy, 3 "Attached is the incident log for last month. 4 "32 calls [and he gives the references]. I have 5 tried to find closing details for as many as I can but 6 the following funds are awaiting updates from Fujitsu 7 ..." 8 Then he sets them out, including: 9 "642 -- Horizon alleged system integrity issues." 10 Can you see that. 11 A. Yes. 12 Q. He ends his list: 13 "Could you please chase these ones up and I will see 14 you on Friday." 15 Can you assist what Mr Simpson was asking you to do 16 by following up these incidents? 17 A. I can't remember exactly what that was about. 18 Q. Was this a regular occurrence, an incident log for the 19 previous month -- 20 A. I don't -- 21 Q. -- sent to you by Excel spreadsheet? 22 A. I don't remember an incident log. 23 Q. He says that he's going to come and see you. Was that 24 a regular occurrence? 25 A. I don't remember meeting him. 66 1 Q. The mention of an alleged Horizon System integrity 2 issue, do you remember those being raised with you? 3 A. No. I mean, from this, I would take that he's asking 4 for updates on those particular calls. I wouldn't have 5 had any dealings with the calls. I think I would have 6 gone and asked for an update with whoever is dealing 7 with the call. 8 Q. Which area of your five roles is this concerned with, 9 then? Which one of your five roles is this about? 10 A. Erm ... I don't remember. As I say, I don't remember 11 this type of email or the email, so I don't know which 12 role that fitted in. 13 Q. But the calls would be from who to who? 32 calls, these 14 are the reference numbers. 15 A. The only calls that I remember were PEAK calls. So 16 these could be referencing PEAK calls. 17 Q. In what respect would they need following up? 18 A. They may have not actually been resolved yet. 19 Q. Why would it be your function to resolve them? 20 A. Oh, I wouldn't have resolved them; I would have chased 21 up whoever is dealing with those calls. I would have 22 asked for an update. 23 Q. Why was it your function to chase up unresolved PEAK 24 calls? 25 A. At the time I -- no idea. 67 1 Q. Did you have access to PEAKs? 2 A. Yes. 3 Q. Therefore, to take 642, if the description of this is 4 correct, "system integrity issue" with Horizon, you'd be 5 aware from being able to look at that call, that 6 an issue had been raised about the integrity of the 7 Horizon System? 8 A. If I wanted to, yes. 9 Q. Would you want to? 10 A. I hadn't -- I probably wouldn't have had any need to. 11 I would have probably passed this on to whoever -- if 12 they were PEAK calls, and they were being dealt with by 13 the SSC, I would have put a chase on members or the SSC 14 for an update on those calls. 15 Q. Why is somebody in security speaking to you when, and 16 emailing you to chase up something that rests with the 17 SSC? 18 A. I think because we had a dialogue between -- I don't 19 think he had access or contacts within -- I'm only 20 assuming here -- but within the SSC. 21 Q. In your witness statement, you suggest that you had 22 limited knowledge of the technical operation of 23 Horizon -- 24 A. Yes. 25 Q. -- and less still knowledge of any bugs errors or 68 1 defects in the system? 2 A. Mm-hm. 3 Q. Yes? 4 A. Yeah. 5 Q. You explain in paragraph 19 that, aside from your 6 limited role in the transaction reconciliation process, 7 you had no role in the investigation of errors reported 8 by the system or by system users? 9 A. Correct. 10 Q. You explain that you didn't work in the helpdesk and had 11 no role within it, yes? 12 A. Yes. 13 Q. You say that on occasion you were requested to provide 14 the Post Office with records of calls made by the 15 helpdesk by a particular Post Office branch and, if 16 requested, to summarise these in witness statements? 17 That's paragraph 20 of your witness statement; is that 18 right? 19 A. That's correct. 20 Q. Was your role a purely procedural, administrative or 21 mechanical one, therefore? 22 A. Mm-hm. 23 Q. You describe in that paragraph that your role, if 24 requested, was to summarise the calls in a witness 25 statement. Our discussion earlier suggests that you 69 1 went further than that: that you analysed the calls and 2 offered an opinion about the calls; is that fair? 3 A. Yes. 4 Q. Why in paragraph 20 of your witness statement did you 5 say that your role was to summarise? 6 A. Well, that -- to summarise -- my understanding is to 7 summarise the calls and -- but part of the witness 8 statement is the wording of the witness statement. The 9 summarisation is of the calls, not the wording of the 10 witness statement. 11 Q. Can I try and understand what you mean there. You said 12 that, if you were just asked to provide ARQ data and 13 nothing more, you wouldn't analyse it, you would just 14 provide it? 15 A. Yes. 16 Q. If you were asked, however, to provide a witness 17 statement, you would analyse it? 18 A. If the witness statement -- no -- I'd analyse the 19 helpdesk calls. 20 Q. Yes. 21 A. Yes. 22 Q. And you would offer an opinion about it, you agreed 23 earlier. 24 A. Yes. 25 Q. That's different from providing summary of it, isn't it? 70 1 A. Not that I understand, no. The summary would have been 2 an overview of each call. 3 Q. But you went further than that, didn't you? 4 A. Yeah, based on that summary, I made a statement. 5 Q. Were you trying to minimise your role, in this 6 paragraph? 7 A. No, not at all. 8 Q. Were you trying to paint the picture in the witness 9 statement that your role was a purely procedural, 10 administrative or mechanical one? 11 A. Not really, no. 12 Q. Do you believe that you had the qualifications, 13 experience and technical understanding to offer 14 an opinion as to whether issues raised in helpdesk calls 15 that you were analysing went to the integrity of the 16 Horizon System? 17 A. Based on my investigation or using due diligence for 18 each call, I would have based my -- that statement on my 19 knowledge and understanding. 20 Q. What was the due diligence that you conducted? 21 A. As I think I said earlier, it would have been my current 22 knowledge of Horizon, speaking to members of the 23 security team, looking at the PEAK itself and going 24 through the PEAK and the wording and what was done to 25 resolve that PEAK and, if needed, I would have spoken to 71 1 a member of the SSC to clarify what was going on. 2 Q. But you wouldn't maintain a record of all of those 3 things that you did? 4 A. No. 5 Q. You wouldn't explain them in the witness statement 6 itself? 7 A. No. 8 Q. So the reader wouldn't know what background work or 9 homework you'd undertaken in order to offer the opinion 10 that you were offering? 11 A. No. 12 Q. Did you ever feel uncomfortable about doing this? 13 A. No, I didn't, no, because I believed at the time -- when 14 I wrote that statement, I believed the wording and I was 15 happy. I wouldn't have signed it, otherwise. 16 Q. Can we look, please, at FUJ00080215. Can we see the 17 date of this document at the foot of the page, please. 18 14 June 2011 and it's version 2. Then look at the top 19 of the page, the title of the document, "Reconciliation 20 and Incident Management Joint Working Document". 21 The abstract describes the document as a: 22 "Joint Working Document to support the 23 Reconciliation Service provided to Post Office Limited 24 by Fujitsu Services." 25 We can see the author is Penny Thomas who you've 72 1 described and the distribution includes you. Can you 2 see under the internal distribution? 3 A. Yeah. 4 Q. Were you part of the team who provided this service, 5 reconciliation and incident management? 6 A. I don't remember the incident management side of it but 7 we were -- I was a member of the security operations 8 team that took on the reconciliation role. 9 Q. So you do remember providing reconciliation services -- 10 A. Correct. 11 Q. -- but not incident management; is that right? 12 A. Yeah, I think so, yes. 13 Q. If we look, please, at page 9 of the document, 14 a description of what reconciliation is: 15 "End-to-end Reconciliation within [Horizon Online] 16 is the mechanism by which [Post Office] and Post Office 17 Account ... establish which transactions are complete 18 and correct, and which are not. An incomplete 19 transaction is not necessarily a Reconciliation error, 20 but it might become one if it is not completed in 21 a timely manner. An incorrect transaction is 22 a Reconciliation error." 23 Does that fairly describe what you understood 24 reconciliation to be? 25 A. Correct. 73 1 Q. "Each and every reconciliation error is the result of 2 some system fault. That might, for example, be 3 a software bug (introduced through either design or 4 coding), a system crash, or a telephone line being dug 5 up. Such faults may affect transactions, thus it is the 6 job of Reconciliation Service to detect when and how any 7 transaction is affected by any system fault." 8 A. Yes. 9 Q. Does that fairly describe the nature of the bugs, 10 crashes or other faults that might require 11 a reconciliation to occur? 12 A. Yes. 13 Q. When did you first become involved in reconciliation? 14 A. No idea when we started doing that. 15 Q. Was there an equivalent service for Legacy Horizon? 16 A. I've no idea. 17 Q. Or can you recall was it only established in order to 18 support Horizon Online? 19 A. I have no idea. 20 Q. From at least this time onwards then, from at least 21 2011, you would have been aware that bugs, errors and 22 defects could cause imbalances within the subpostmaster 23 accounts, discrepancies, yes? 24 A. I wasn't aware that bugs and errors caused 25 reconciliation. 74 1 Q. This says, the fault might be "a software bug". 2 A. Yes. 3 Q. Why wouldn't you be aware that a software bug could 4 cause a reconciliation error? 5 A. Reading this, and I don't remember this document -- and 6 if I'd read this at the time, yes, I would have known 7 that a bug would have -- may have caused 8 a reconciliation error. 9 Q. Did you read documents that were sent to you? 10 A. Not every document. 11 Q. Why not? 12 A. Because they were really -- they were aimed at a certain 13 distribution list and we would receive documents to 14 review, loads of documents to review, and not any of 15 them -- not all of them would have been relevant to our 16 role. 17 Q. Why were you being sent a document that wasn't relevant 18 to you? 19 A. Because sometimes there's a scatter-gun approach on 20 documentation. 21 Q. So this document that records that reconciliation errors 22 might be the fault of Horizon software bugs is one that 23 didn't make it into your conscience; is that right? 24 A. I may have read this. I don't remember. 25 Q. Were you aware that software bugs within Horizon might 75 1 cause reconciliation errors? 2 A. I don't recall. I don't know. 3 Q. When you were carrying out the task of reconciliation, 4 did you ever think "Hold on, it might be a software bug 5 that's causing the error, we'd better look at that"? 6 A. No. 7 Q. So, so far as you were aware, you worked on the basis 8 that Horizon had such integrity that no bugs within it, 9 either introduced through design or coding errors, could 10 cause reconciliation errors; is that right? 11 A. To an extent, yes, because the reconciliation within the 12 team was a process and it didn't involve the 13 investigative side of that transaction or an incomplete 14 that needed reconciliation. 15 Q. Was your view a commonly held one amongst your team, do 16 you think, that reconciliation errors are not caused or 17 could not be caused by Horizon software bugs? 18 A. I honestly couldn't tell you. 19 Q. Well, had you ever had a discussion with other members 20 of the team "We've got a reconciliation error here, 21 let's think of the possible causes of it. Is it due to 22 a telephone line being dug up, is it due to a system 23 crash or a power failure or is it due to a software bug? 24 We'd better look at these alternatives"? 25 A. No, that wasn't part of the remit within the 76 1 reconciliation team. 2 Q. Whose job was that? 3 A. The SSC. 4 Q. It was their job to investigate, on your 5 understanding -- 6 A. Yes. 7 Q. -- the causes of the reconciliation error? 8 A. Yeah. 9 Q. Did you ever read documents from the SSC that revealed 10 that they considered that a software bug within Horizon 11 might be the cause of a reconciliation error? 12 A. I don't recall, no. 13 Q. Can we look, please, at POL00039193. This is a record 14 of an investigation report concerning a complaint made 15 by Mr Thomas -- give me a moment to catch up in my 16 papers -- as part of the Complaint Review and Mediation 17 Scheme. Within it, if we just look at page 4 of the 18 document, please, in the second box down, in the third 19 paragraph, it is recorded that: 20 "... a witness statement provided by Andy Dunks of 21 Fujitsu dated 6th April 2006 for the purposes of the 22 criminal proceedings ... states that during the period 23 1st November 2004-30th November 2005, he [that's you] 24 reviewed 13 calls made to the [Horizon Service Desk] 25 from the Gaerwen Post Office Network. His professional 77 1 opinion was that 'none of these calls related to faults 2 which would have had an effect on the integrity of the 3 information held on the system'." 4 I'm dealing with things at a relatively high level 5 at the moment. In the future we'll come back and look 6 at the detail here. That sentence, "none of these 7 related to faults which have had an effect on the 8 integrity of the information held on the system", that 9 was the standard line that we were talking about 10 earlier? 11 A. Mm-hm. 12 Q. Was that the line you took from your predecessors' 13 witness statements? 14 A. I believe so. I can't recall. 15 Q. We know that, in relation to the ARQ data obtained in 16 relation to Mr Thomas's case, that it was a dip sample 17 only, that it was checked only for evidence of zero 18 transactions and that the data was not checked for any 19 bugs, errors or defects. Was that a common approach, 20 that you would dip sample? 21 A. I have got no idea what a "dip sample" was. 22 Q. So you would look at a period only, rather than the 23 entirety of, for example, the period over which the 24 subpostmaster was accused of theft and false accounting? 25 A. We would only have looked -- I would only have looked at 78 1 what was requested from the Post Office. 2 Q. In the witness statement you provided to the Inquiry, 3 you have suggested that you had limited technical 4 knowledge of the operation of Horizon and of any bugs, 5 errors or defects within it. 6 A. Mm-hm. 7 Q. How would you go about satisfying yourself that none of 8 the calls in this case related to faults which would 9 have had an effect on the integrity of the information 10 held on the system? 11 A. I would have done -- as I said before, I would have 12 conducted my own due diligence of an investigation of 13 that -- each and every call, within its own merits. 14 Q. Did you intend, by making a statement that included 15 a line such as that, to convey the impression that you 16 had conducted an analysis of information exchanged in 17 the calls and concluded that there was no question of 18 any error, bug or defect within Horizon? 19 A. I'm not quite sure what you're asking. 20 Q. To a person that's not familiar with the nature of the 21 role that you were, in fact, performing, that 22 statement -- "None of these calls related to faults 23 which would have had an effect on the integrity of the 24 information held on the system" -- might give the 25 impression that you had conducted an analysis of the 79 1 information exchanged in the calls and reached the view 2 that, of the things mentioned, there could be no 3 question of errors, bugs or defects within Horizon. 4 A. I still don't really understand the question. 5 Q. Well, let's take -- let's look at it a different way. 6 Can we turn up POL00003219. 7 It can't be displayed. That would have been 8 a document setting out the number of occasions on which 9 you provided witness statements or cases for a period 10 between August 2004 and March 2005. How frequently do 11 you think you provided witness statements? 12 A. Hazarding a guess, it may have been one a month, one 13 every two months. From my recollection, it was very, 14 very infrequent. 15 Q. Who else was providing witness statements? 16 A. The only person that I can recall would have been Penny 17 Thomas. I don't know, prior to that -- or the person 18 before me running ARQs -- whether they did. 19 Q. When you made the witness statement, did you anticipate 20 being required to attend court? 21 A. No, I didn't. 22 Q. Were you ever called to court? 23 A. Yes, I was. 24 Q. On how many occasions? 25 A. Again, I can't remember. Half a dozen times? 80 1 Q. Were they spread around the country? 2 A. Yeah. I can't remember every one. 3 Q. So about half a dozen, you think? 4 A. Yeah, I think so, yes. 5 Q. Did you engage with those that were conducting the 6 prosecution, people from Post Office Legal, before you 7 gave evidence? 8 A. I don't believe that -- I can't recall. I'm not 9 saying -- I may have met them before at the case -- at 10 the court itself, but I don't recall that happening. 11 Q. Were you given any advice or assistance on the proper 12 limits of the evidence that you could give, whether you 13 in particular were a witness of fact who was producing 14 documents or an expert witness statement who was 15 analysing what the documents showed? 16 A. I wasn't told the limits of what I could give 17 evidence-wise, no. My understanding was I was there to 18 elaborate my witness statement, to be true. 19 Q. Can we look, please, at POL00073280. This is an exhibit 20 sheet to your witness statement prepared in the case of 21 Post Office v Lee Castleton, a civil claim. Can you see 22 that? 23 A. Yes, I can. 24 Q. Dated 27 September 2006. 25 A. Mm-hm. 81 1 Q. It's your exhibit AD1. 2 A. Yeah. 3 Q. If we just go over the page, please, and just expand it, 4 thank you. This a call log, isn't it? 5 A. Yes, it is. 6 Q. If you just keep skipping, please, Frankie, and keep 7 going. There is a series of call logs, yes? 8 A. Mm-hm. 9 Q. Was it your practice always to exhibit the call logs in 10 this way when you provided a witness statement for the 11 purposes of legal proceedings? 12 A. I can't remember. I can't actually remember supplying 13 the witness statement, that witness statement, with that 14 call log in it. 15 Q. Can we look, please, at FUJ00083726. This is a summary 16 of call logs prepared for the purposes of Jerry Hosi's 17 prosecution. If we just expand it so we can see the 18 whole page. You can see there's a breakdown at the top, 19 and then: 20 "Call reference details and an overview of each call 21 is given in date order below." 22 Then an example is given, that the reference, who 23 the call was taken by, the resolution and the outcome. 24 Then if we go over the page, please, there's another one 25 and another one and another one? 82 1 A. Yeah. 2 Q. Was it your practice, again, always to exhibit the call 3 logs as we've seen in the civil proceedings of 4 Mr Castleton or to provide a summary analysis of the 5 call logs, as we can see for Mr Hosi's -- sorry, Jerry 6 Hosi's prosecution? 7 A. What, you're asking whether that -- it was standard? 8 I would have supplied exactly what I was asked for from 9 the Post Office. 10 Q. When you were trying the witness statement, what was 11 your understanding of what you needed to do for the 12 witness statement? 13 A. Again, the instruction from the Post Office. If they'd 14 asked for a breakdown of the calls that were logged. 15 Q. Did you understand that you also needed to exhibit them, 16 produce them? 17 A. I don't recall that, no. 18 Q. That can come down, thank you. 19 Did you know anything about the contractual 20 obligations placed on Fujitsu as to the provision of 21 evidence and data that was compliant with a legal 22 standard -- 23 A. No, I wasn't aware of that, no. 24 Q. -- that if the contract existed as between Post Office 25 and Fujitsu, which said when Fujitsu provides 83 1 information for the purposes of a criminal prosecution, 2 it's got to hit this mark, it's got to reach this 3 standard? 4 A. No, I never -- I wasn't aware of anything like that. 5 Q. Were you provided with any training in relation to this 6 is aspect of your role, the provision of evidence in 7 court proceedings against subpostmasters and your 8 obligations and duties to the court? 9 A. There was no trading on the production of witness 10 statements. They were quite -- it's quite 11 straightforward to understand what was required. There 12 was no specific training for attending court either. So 13 ... 14 Q. I think that's a no. 15 A. Yeah, if that answers your question, yes. Yeah. 16 Q. I'm thinking about somebody who provides opinion 17 evidence, analysis evidence -- 18 A. Mm-hm. 19 Q. -- the steps that they ought to take to satisfy 20 themselves as to the accuracy of what they're saying and 21 also describing within their evidence the steps that 22 they have been taking. Was there any training or 23 instruction or guidance or help on those issues? 24 A. No. No. I would have used the standard template as 25 before, for producing the witness statements. 84 1 Q. In all of the prosecutions where you gave evidence 2 against subpostmasters, did the template always say the 3 same thing, "There's nothing in the documents I have 4 looked at that would affect the integrity of the data"? 5 A. No, they did vary over time. 6 Q. Did any of them say that the faults that were being 7 reported did have an effect on the integrity of the 8 information held on the system? 9 A. No. 10 Q. They always said that it didn't? 11 A. Correct, yes. 12 Q. Did you ever disclose anything about the ability of 13 Fujitsu staff, including in the third line of support, 14 remotely to access Horizon terminals without the 15 knowledge of subpostmasters? 16 A. Did I what with that information? 17 Q. Did you ever give any evidence about that? 18 A. Evidence in court? 19 Q. Yes. 20 A. No. 21 Q. Evidence in witness statements? 22 A. No. 23 Q. Did it ever occur to you that that might affect the 24 ability -- or that might affect the ability to say that 25 "There's nothing in the information I've looked at that 85 1 would affect the integrity of information held within 2 the system"? 3 A. No, not at all. 4 Q. The fact that there are people in Fujitsu who have 5 access, and can change data at the terminal end, without 6 the subpostmaster's knowledge? 7 A. I wasn't aware that was possible. 8 Q. Was that ever a topic of discussion? 9 A. No. 10 Q. Can I turn back to the transaction reconciliation 11 process. Can we look, please, at FUJ00080215. Can we 12 look at page 9, please. We've looked at the first and 13 second paragraphs under paragraph 1.1, yes? 14 A. Mm-hm. 15 Q. We looked at those a moment ago. Was it your 16 understanding that errors created as a result of 17 software bugs were identified by the system itself? 18 A. Was I what, sorry? 19 Q. Were you aware that any reconciliation errors caused as 20 a result of software bugs -- 21 A. No, I wasn't. 22 Q. That follows because you weren't aware of any software 23 bugs, or the possibility of software bugs; is that 24 right? 25 A. No, sorry, I was aware of software bugs within the 86 1 Horizon System, but not all of those, or any of them 2 that I am aware of, were the result of a reconciliation 3 error. I was not -- did not believe, or was aware that 4 any of those bugs caused reconciliation issues. 5 Q. What were the causes of reconciliation errors, then, if 6 they never included software bugs? 7 A. Reconciliation -- a reconciliation error is the 8 breakdown of the transaction somewhere along the line. 9 So it hadn't been completed, and that's what we dealt 10 with. 11 Q. All of these were faults caused by the system, weren't 12 they? 13 A. No, no. 14 Q. Not by the sub -- 15 A. No they weren't, no. Because I think it said before, it 16 could have been caused by a power outage or a loss of 17 connectivity to the branch. These were the main causes 18 that I was aware of, of reconciliation issues. 19 Q. So looking at that second paragraph again, under 1.1, 20 where it says, "Each and every reconciliation error is 21 the result of some system fault", and then three 22 examples are given: a software bug introduced through 23 either design or coding; the second one is a system 24 crash; and the third one is a telephone line being dug 25 up, you're only aware of the second and the third them; 87 1 is that right? 2 A. Yes, I don't recall any reconciliation issues that 3 resulted -- or the resolution was to do with a software 4 bug. 5 Q. So in the decade or more that you were performing this 6 function, did you never hear any discussion that there 7 might be something wrong with the system itself, by way 8 of coding or design error? 9 A. No. 10 Q. It was never mentioned? 11 A. No, not -- no. 12 Q. Did you see the same problem coming back to you time and 13 time again for a transaction correction to be made? 14 A. For a reconciliation? 15 Q. Yes. 16 A. Yes, yeah. The most common -- there were a number of 17 common reasons. 18 Q. What were the common reasons? 19 A. The common reasons were loss of connectivity to the 20 branch. 21 Q. Do you remember a Computer Weekly article being 22 discussed in 2009 onwards? 23 A. No. I never read Computer Weekly. 24 Q. I'm not suggesting you read it; I'm asking whether you 25 remember it being discussed within Fujitsu? 88 1 A. No, no. 2 Q. Do you remember a campaign starting from about 2009 3 onwards? 4 A. Yes, I was aware of something going on, yes. 5 Q. What was the something you were aware of going on? 6 A. Erm ... it would have been a postmaster's -- how do you 7 say it? -- were appealing or saying that they weren't at 8 fault for the losses, and it was -- 9 Q. What were they saying was at fault? 10 A. The Fujit -- the Horizon System. 11 Q. What was the discussion in the office about what they 12 were saying? 13 A. I honestly can't remember if there was a discussion at 14 all about it. I was aware of it through probably press 15 or whatever, but I don't recall having a conversation 16 with anybody about it. Not -- I'm not saying I didn't, 17 but I don't recall one. 18 Q. You were producing witness statements to courts? 19 A. Mm-hm. 20 Q. Around the country? 21 A. Mm-hm. 22 Q. Saying, "I've analysed the records of calls by these 23 very same subpostmasters to the helpdesk"? 24 A. Yeah. 25 Q. Saying that, "On occasion, there's an imbalance or 89 1 a discrepancy which I cannot explain. I believe it's 2 the fault of the Horizon System". 3 Was there no discussion in the office: "Well, hold 4 on, is anyone looking into this?" 5 A. No. 6 Q. You just carried on providing the witness statements? 7 A. In my -- our area of the team, no, I don't think we did 8 discuss it at all. 9 Q. Looking back, do you think it ought to have been the 10 topic of some discussion? 11 A. At a higher level, possibly. Whether that went on, 12 I don't know. It wasn't for us to discuss or make 13 judgement. 14 Q. You were the one that was going along to court or 15 providing witness statements? 16 A. Yeah. 17 Q. It was your name at the bottom of the piece of paper 18 that was signed? 19 A. Mm-hm. 20 Q. Saying, "This is true"? 21 A. Mm-hm. 22 Q. "I know I can be prosecuted", I think it would have 23 said. 24 A. Mm-hm. 25 Q. "... if I have stated in it anything which I know to be 90 1 false." 2 A. Yes. 3 Q. Did you not think that was quite a serious undertaking 4 you were engaged in? 5 A. Yes, I did. 6 Q. You heard, through the media and the like, that the 7 subpostmasters were saying, "There were faults in the 8 system, the Horizon System, that are causing 9 discrepancies for which I am not responsible." 10 You were providing witness statements at the same 11 time, saying, "There is nothing that I've seen in the 12 documents I've examined that could explain 13 a system-generated discrepancy"? 14 A. Well, as you just stated, I would have probably taken it 15 as it's their opinion that there's something wrong. I'm 16 not -- wasn't aware there was something wrong, so 17 I still believed my statement, on the witness statements 18 I gave, were true at the time. 19 Q. Can we look, please, at FUJ00086882. Can we just go to 20 the last page, please, and scroll up. Thank you. It's 21 an email chain to which you were copied; can you see 22 that? 23 A. Yes. 24 Q. Of 26 January 2010. Ernst & Young. Who did you 25 understand Ernst & Young to be? 91 1 A. Auditors. 2 Q. "They're in the process of auditing the Royal Mail Group 3 financial systems. Part of the audit includes systems 4 that are managed by Fujitsu on behalf of the Royal Mail 5 Group, particularly the Horizon and Credence POLMI 6 systems." 7 When did you read that, did you think: hold on, 8 that's talking about Credence -- I don't know what 9 Credence is? 10 A. No, I don't remember thinking that, no. 11 Q. Anyway: 12 "One area of the audit concerns user access, and 13 whether an individual should have continued access. 14 Ernst & Young have identified a sample of users based on 15 the existence of the user in the ACE Server Database." 16 Do you remember what the ACE Server Database was? 17 A. No, I don't. 18 Q. "... and are requesting that confirmation -- the user 19 still requires access to Horizon's own Credence. Each 20 of you have been identified as the line manager for an 21 individual or individuals excluded within the sample. 22 Each user has access to the system since January 2009. 23 Can you please confirm if the users associated with your 24 name are still employed by Fujitsu and if they require 25 access to Royal Mail Group systems as part of their job 92 1 role." 2 Then, please, if we go on to FUJ00086945 and scroll 3 forwards. This document is a 2011 production by Ernst & 4 Young which raises issues about access to, and integrity 5 of, the Credence system. Can you remember getting this 6 document? 7 A. No, I don't remember seeing this document. 8 Q. Can you remember, by reference to the previous email and 9 to this document, whether concerns were raised by the 10 auditors over the integrity of the system and access to 11 it? 12 A. No, I wasn't made aware. 13 Q. That can come down; thank you. 14 You were somebody who was responsible for the 15 cryptographic keys? 16 A. Mm-hm. 17 Q. And that was for the subpostmasters? 18 A. The counters. 19 Q. Yes. 20 A. Yes. 21 Q. Did part of your role involve consideration of who was 22 able to access, within Fujitsu, the Horizon System? 23 A. No, it wasn't. 24 Q. Was that the responsibility of anyone within your team? 25 A. No, not that I believe so, no. 93 1 Q. Were you responsible, at a mechanical level, for 2 granting or removing access, as instructed, of Fujitsu 3 employees? 4 A. Not on a mechanical level. I wouldn't -- we wouldn't 5 be -- we wouldn't administer the physical change. 6 Q. Was that not a function of anyone within your team? 7 A. No. 8 Q. Can we look, please, at FUJ00083703. Can you see this 9 is a witness statement signed by you? 10 A. Mm-hm. 11 Q. Just if we expand it a little bit, please, and just 12 scroll over the page and over the page and over the 13 page. Over the page. Thank you. Keep going. Keep 14 going. Keep going -- and again and again. Just keep 15 going, and that's the end. 16 So back to the beginning, please. You'll see this 17 was a witness statement of the species that provided 18 summaries. 19 A. Mm-hm. 20 Q. -- of call logs. 21 A. Yes. 22 Q. Was that the normal way in which you did things? 23 A. There was no normal way, because it depended on what the 24 request from the Post Office was. 25 Q. Would the Post Office specify "We want you, in your 94 1 witness statement, either to (or not to) exhibit call 2 logs"? 3 A. I can't remember specifically how it was requested. 4 Q. Or would they just ask you to provide a witness 5 statement? 6 A. Erm ... I can't remember, actually. 7 Q. Can you try and help us how you went about your task of 8 deciding whether to summarise records of calls, the 9 helpdesk calls, or whether you exhibited them? 10 A. When you say "exhibited them", as in on the witness 11 statement? 12 Q. Attach them, like we saw in the Castleton case? 13 A. Yeah, whether that was a request from the Post Office or 14 not, I can't remember the process of how I was asked to 15 exhibit them, or I vaguely remember them saying, "Can we 16 have a list of calls", or how many there were. And they 17 may, I think, may have come back to me saying, "Oh, can 18 you expand on this?" I really cannot remember how that 19 process worked. 20 Q. If we just look through your witness statement, please, 21 in this case. This is for the Porters Avenue branch, 22 Mr Jerry Hosi's case. Can we see that it's dated 23 3 June 2008, and you say: 24 "I have been employed by Fujitsu on the Post Office 25 Account since 11th March 2002 as an IT security 95 1 analyst ..." 2 Is that an accurate, short description of your job, 3 a "security analyst"? 4 A. It was the title we had. I believe everybody within 5 that team was called an IT security analyst. 6 Q. Does it accurately describe your job that you're -- 7 A. Analyst? No. 8 Q. Why were you called something that didn't accurately 9 describe what you did? 10 A. That was the job title. 11 Q. An analyst might be understood to be somebody with 12 technical expertise who would undertake a qualitative 13 assessment of data, mightn't they? 14 A. Could be. 15 Q. How would you describe your job, shortly, if you were to 16 provide a job description that wasn't an IT security 17 analyst? 18 A. It's difficult to put it in words, because although we 19 were classed as an IT security team, a lot of the roles 20 and jobs that we did didn't really fall into IT 21 security. So it was a hard one to describe our role. 22 Q. The way you describe it in your witness statement 23 provided to us for this Inquiry, you might describe 24 yourself as an administrator? Or is that being unfair 25 to you? 96 1 A. No, it's more than that. The role involved a lot of 2 administrative and procedural work, but there was more 3 to it than that, at times. 4 Q. In any event, you say: 5 "I've a working knowledge of the computer system 6 known as Horizon." 7 How did you gain that working knowledge? 8 A. Through experience of working on the account, and 9 furthered by speaking to -- having conversations, and my 10 interaction with other account members, the SSC, support 11 teams. 12 Q. Did you ever undergo the training that subpostmasters 13 underwent on the operation of the system? 14 A. I did once, I think many years ago. I can't remember 15 the date. I think Penny and I went and did a half day 16 or a day's course, and I can't remember where that was. 17 Q. You continue: 18 "I'm authorised by Fujitsu to undertake extractions 19 of audit data held on the Horizon System ..." 20 Why was it called audit data? Wasn't it just data? 21 A. I don't know why it was called audit data. 22 Q. Why did you call it audit data? 23 A. Because that's what it was referred to as. It was the 24 audit system, so it's audit data. 25 Q. "... and to obtain information regarding system 97 1 transaction information processed on the Horizon System. 2 "I make this witness statement from facts within my 3 own knowledge unless otherwise stated." 4 In the witness statement, do you state otherwise, ie 5 that you have made it from information that's not within 6 your knowledge? 7 A. No, because when I made the statement, my knowledge was 8 enough to make that statement. 9 Q. So for the purpose of making this witness statement, you 10 didn't speak to anyone else? 11 A. No, I probably did. 12 Q. That line suggests that when you go through what you're 13 about to say, you're going to identify if you have 14 spoken to anyone else, or have obtained information from 15 anyone else? 16 A. Mm-hm. 17 Q. Ie matters that are not within your own knowledge. 18 In the pages of the statement that follow, the 19 13 pages of it, take it from me, you don't identify that 20 you've spoken to anyone else. 21 A. But within my due diligence, my knowledge I'd undertook 22 for each call, my knowledge was then suffice to make 23 this statement. 24 Q. You continue: 25 "Any records to which I refer in my statement form 98 1 part of the records relating to the business of Fujitsu. 2 These were compiled during the ordinary course of 3 business from information supplied by persons who have 4 or may reasonably be supposed to have personal knowledge 5 of the matter dealt with in the information supplied, 6 but are unlikely to have any recollection of the 7 information or cannot be traced, since the nature of the 8 Helpdesk involves many engineers at, all at differing 9 levels, and any number could be involved in a particular 10 call. As part of my duties I have access to these 11 records but I was not involved with any of the technical 12 expects of these calls. This area is not my particular 13 area of expertise and I make this statement simply to 14 help clarify the call logs for the benefit of the 15 court." 16 Was that paragraph essentially standard wording? 17 A. Yes. 18 Q. From where did you obtain it? 19 A. From the standard witness statement, or previous witness 20 statements. 21 Q. From your predecessor? 22 A. Yes. 23 Q. You continue at the foot of the page: 24 "An important element of the support provided to 25 subpostmasters and counter clerks is the Horizon System 99 1 Helpdesk (HSH). The HSH is the Horizon user's first 2 'port of call' in the event of their experiencing 3 a problem with the Horizon System or requiring advice 4 and guidance. If the system were to malfunction, upon 5 discovery the Horizon users (ie the subpostmaster or 6 counter clerk) would raise a call to the HSH seeking 7 clarification or advice. HSH is a service run by 8 Fujitsu or the Post Office. I have been asked to 9 provide details and information on the calls for advice 10 and guidance logged by HSH recorded during the period 11 1/9/05-29/11/06 for the Porters Ave branch. A report 12 outlining each call was created and I produce the 13 resultant CD as exhibit APD/01. This CD was sent to the 14 Post Office investigation section by Special Delivery on 15 19th February 2007." 16 Then this: 17 "I have reviewed the HSH calls pertaining to the 18 Porters Ave branch during the period. There were 33 19 calls from the branch to HSH and all the calls are of 20 a routine nature and do not fall outside the normal 21 working parameters of the system and in my opinion would 22 have had no effect on any counter discrepancies." 23 What does "routine nature" and "do not fall outside 24 the normal working parameters of the system" mean? 25 A. My understanding of that statement is they weren't 100 1 extraordinary calls. A lot of the calls were of 2 a routine -- it says "routine", I keep saying routine -- 3 was expected, or common faults or common calls to the 4 helpdesk. 5 Q. So you would describe calls of a routine nature, meaning 6 ones that were made frequently? 7 A. Yes. 8 Q. What about the substance of the call? If the 9 subpostmaster was saying, "There is a discrepancy for 10 which the system is responsible that I cannot explain", 11 and a number of them were saying that, time and time 12 again? Would that be a routine call or a call of 13 a routine nature? 14 A. I don't recall seeing calls that said that that I had 15 a look at, but you could call them a routine call, yes. 16 Q. You continue: 17 "In my opinion, it would have had no effect on any 18 counter discrepancies." 19 What steps would you take to satisfy yourself that 20 the substance of the calls would have had no effect on 21 any counter discrepancies? 22 A. I would have based that statement on my due diligence 23 and the steps I had mentioned earlier. 24 Q. Looking back now, do you think you were technically 25 qualified to make that statement? 101 1 A. Yes, I do. 2 Q. Why? 3 A. Because I'd gained enough knowledge of those particular 4 calls from the appropriate people to satisfy myself 5 that -- to make that statement. 6 MR BEER: Sir, that's all I'll ask for the moment. Thank 7 you. We have reached 1.00. There is in fact still more 8 for me to do, but maybe we can do that on a future 9 occasion. 10 SIR WYN WILLIAMS: Yes. I think that's probably right, 11 Mr Beer. 12 Mr Dunks, it's inevitable, I think, that you will be 13 asked to return to give further evidence. 14 THE WITNESS: Yes. 15 SIR WYN WILLIAMS: There may be many more questions to come. 16 So you'll be notified in due course when that will be, 17 and you will be given, I hope, significant notice of 18 that, so that it doesn't disrupt your life unduly. 19 All right, we'll break off until tomorrow now. 20 MR BEER: 10.00 tomorrow, sir. Thank you very much. 21 (1.01 pm) 22 (The hearing adjourned until 10.00 am the following day) 23 24 25 102 I N D E X Announcements by SIR WYN WILLIAMS ....................1 ANDREW PAUL DUNKS (sworn) ............................3 Questioned by MR BEER .........................3 103