1 Tuesday 15 November 2022 2 (10.00 am) 3 MS HODGE: Good morning, sir. 4 SIR WYN WILLIAMS: Good morning. 5 MS HODGE: Can you see and hear me clearly? 6 SIR WYN WILLIAMS: Yes, thank you. 7 MS HODGE: Thank you, sir. May I call Mr Booth, please. 8 ROBERT BOOTH (affirmed) 9 Questioned by MS HODGE 10 Q. Good morning, Mr Booth. Please give your full name. 11 A. Robert Jonathan Booth. 12 Q. Thank you. May I ask you to raise your voice slightly 13 to ensure you can be heard by all in the hearing room 14 and by the Chair. 15 A. Certainly. 16 Q. Thank you. You should have in front of you a witness 17 statement dated 16 September of this year. Do you have 18 that open before you? 19 A. I do. 20 Q. That statement runs to 80 pages, I believe? 21 A. Correct. 22 Q. Could I ask you please to turn to page 63 of your 23 statement. Do you see your signature there at the end 24 of your statement? 25 A. I do, yes. 1 1 Q. Is the content of the statement true to the best of your 2 knowledge and belief? 3 A. It is. 4 Q. Thank you. I'm going to begin, Mr Booth, by just asking 5 you a few questions about your professional background, 6 if I may. In terms of your education, you obtained 7 a degree in mechanical engineering from the University 8 of Surrey; is that correct? 9 A. That's correct. 10 Q. And upon graduating you worked for approximately six 11 years as a programmer for a company called Computer 12 Analysts and Programmers Limited; is that right? 13 A. That's correct. 14 Q. Rising over the time of your work there to the role of 15 a team leader? 16 A. That's correct. 17 Q. I believe you joined Post Office Counters Limited in 18 October 1990, and were assigned to work on the 19 development of an electronic point of sales system know 20 as ECCO+? 21 A. That's correct, yes. 22 Q. Could you please describe for us what ECCO+ involved. 23 A. ECCO+ was a computerised system which would assist the 24 directly managed branches within Post Office to do their 25 accounts, to do basic transaction capture, and at the 2 1 time it ran on a PC per counter and was probably the 2 first proper automation at Post Office branch. 3 There had been previous attempts with a thing 4 called Thames Valley, which was before my time there, 5 and at the time PCs were relatively new, and 6 subpostmasters were buying other systems to assist them 7 with their manual balancing, but it was still very much 8 a paper based system and ECCO+ was starting to move into 9 an automated world. 10 Q. In your view, was ECCO+ a successful automation project 11 for the Post Office? 12 A. Yes, it was. 13 Q. What do you believe accounted for the success of the 14 ECCO+ program? 15 A. I think because the IT was developed effectively 16 in-house and with people who were ex-counter clerks, and 17 it was very close collaboration with the actual Post 18 Office Limited as it was Post Office Counters. There 19 was fully open -- we had a common goal to deliver 20 something. We understood what was needed and we had 21 direct access to people who'd either used the counters 22 in the past or were setting an election from the 23 information system services within Post Office Counters 24 Limited about what they were wanting to achieve. So it 25 had all the right components there. 3 1 Q. Do you recall what, if any, consideration was given at 2 the time to extending ECCO+ to the wider Post Office 3 network? 4 A. I wouldn't have been privileged to that. It was very 5 much aimed at the directly managed branches. Post 6 Office, as you probably know, works on the basis of 7 franchisees -- subpostmasters run their own business -- 8 and then about probably 750/800 directly managed 9 branches which has reduced over the years, and those are 10 owned and managed by Post Office. It was very much 11 looking at how those branches, the bigger branches, 12 could be automated, and I think the success of that kind 13 of paved the way that automation was seen as a viable 14 for the bigger estate. At the time computerisation, it 15 was on PCs, but PCs were a bit of a misnomer. They 16 weren't personal computers, not everybody had one as we 17 do now, and it was cutting edge technology for the time. 18 Q. Thank you, Mr Booth. I'm very grateful for the detail 19 of your answers. I wonder if you could slow down ever 20 so slightly in your response, because we have someone 21 transcribing what you are saying, and I anticipate that 22 the pace may be presenting some challenges. But it's no 23 criticism. 24 You later joined the Post Office Counters private 25 finance team during the procurement of what became known 4 1 as the Horizon System; is that right? 2 A. That's correct. 3 Q. From that point, I believe you worked on Horizon 4 continuously until June 2003; is that correct? 5 A. Yes. 6 Q. When you transferred to an external companies named, is 7 it Xansa? 8 A. Xansa, yes. 9 Q. Whilst employed by Xansa, you worked on a variety of 10 Post Office products including Horizon; is that right? 11 A. Less so on Horizon. I finished the project I was 12 involved with and then moved on to a project called 13 Paystation, and then one Automated Enrolment and 14 Identity, which was biometrics program both again for 15 the Post Office. 16 Q. I believe you left Xansa in October 2006 to rejoin the 17 Post Office; is that correct? 18 A. Yes, I'd been TUPE'd into Xansa and I resigned from 19 Xansa and joined Post Office as an employee. 20 Q. I think you worked at that stage on a separate project 21 but which was related which interfaced with Horizon; is 22 that right? 23 A. Yes. 24 Q. You later came to work on Horizon again in 2014 25 following your transfer to Atos; is that right? 5 1 A. Yes. 2 Q. I think you were mostly focused at that stage on counter 3 hardware; is that fair? 4 A. That's correct, yes. 5 Q. Finally you remain employed by Post Office Limited as 6 a solutions architect today; is that right? 7 A. Yes. 8 Q. And your most recent project, I think, was in the area 9 of Post Office compliance with payment card industry 10 standards; is that right? 11 A. That's correct. 12 Q. It follows, I think, from that brief summary that you 13 first worked on Horizon during the procurement phase? 14 A. That's right. 15 Q. Do you recall the stage at which the procurement had 16 reached at the point at which you joining the programme? 17 A. I believe it was when the stage was down to three 18 tenders, three potential suppliers, and it was -- I was 19 brought in to help the technical evaluation of those 20 three suppliers. 21 Q. You've described joining Post Office Counters Limited 22 private finance team. Can you describe the nature and 23 composition of that team as you recall. 24 A. In general terms, my understanding was the private 25 finance initiative, PFI, was a shared risk reward 6 1 contract. The eventual service provider would have been 2 providing a service for both Benefits Agency and Post 3 Office Counters, automating the Post Office Counters and 4 the Benefit Agency as a major partner in providing 5 electronic payment for their services. 6 Q. Like me, Mr Booth, I think you are quite softly spoken. 7 Just for the benefit of the chair, I wonder if you would 8 mind doing your very best to speak a bit more loudly; 9 thank you. 10 There is reference in some of the documents we've 11 obtained to joining the programme several weeks into the 12 demonstration phase. Does that sound familiar to you in 13 terms of timings? 14 A. It does. I was brought in to bolster the technical 15 expertise within the team. 16 Q. That's as a junior member of the technical evaluation 17 team as you described. 18 A. Yes. 19 Q. Do you recall to whom you reported at that time? 20 A. I believe I reported into Jeremy Folkes. 21 Q. We know from the documents obtained by the Inquiry that 22 you participated in what was known as the Post Office 23 Counter Limited infrastructure demonstration strand; is 24 that correct? 25 A. Yes. 7 1 Q. Can you describe in your own words what the purpose of 2 that strand was, please. 3 A. It was a two-way exchange, I think spread over about six 4 to eight weeks, where we would engage with the service 5 providers on a one-to-one basis. It was, some of the 6 documents you recently provided, based on a Tuesday, 7 Wednesday and Thursday, with ICL Pathway being the 8 Wednesday service provider meeting. It was there for us 9 to gain an understanding of their proposed solution and 10 to try and shape anything that we thought would give 11 them problems. Where they had a misunderstanding, they 12 could ask for clarification questions, and we could also 13 give them guidance. 14 We'd invite them, or suggest that they may wish to 15 look at certain areas. At the time the Post Office head 16 office was up in Old Street, and some of the service 17 providers had seen the Old Street Post Office which was 18 a multi-position, what we call a fortress. So it had 19 glass partitions in front. But we did point out that 20 the Post Office was a very diverse, and still is a very 21 diverse retailer with multiple different types of 22 branch, and we encouraged them to visit their local 23 branch and, if they are out for a drive on a Saturday, 24 "If you see a post office sign, stop, go in and look at 25 it, get a feel for it", because a Spar, a corner shop, 8 1 and a Trafalgar Square multi-counter branch are very, 2 very different environments. 3 Q. What distinguished the Post Office counter structure 4 strand from the other strands, the other demonstrator 5 strands that were operating at that stage? 6 A. The infrastructure strand was less defined from 7 a business perspective. It's like you turned a light 8 switch and just expect the lights to come on. You don't 9 necessarily think about how the light has to come on. 10 You don't think about the wiring, the power station the 11 distribution network. The infrastructure was about 12 getting all those pieces in place so the things the Post 13 Office were concentrating on, such as the EPOS system, 14 such as the things that the users would touch and feel, 15 they would all be supported by the POCL infrastructure. 16 So we would make sure and try and assure ourselves 17 that the communications to the branches were sufficient, 18 that the data centres were resilient, that the service 19 provider understood that in an estate the size of the 20 Post Office, if you think it can go wrong, it would go 21 wrong, and you needed to be defensive and you need to be 22 resilient because, kindly, anyone can program something 23 that's going to work in a perfect world but we're not in 24 a perfect world, and it was trying to make sure the 25 service providers understood the reality of the 9 1 environment they were working in. 2 Q. As part of your work on the demonstrator stream you 3 attended a series of meetings with the three service 4 providers -- 5 A. Yes. 6 Q. -- that you have explained. One of those was Pathway. 7 Do you recall any of those meetings that you attended 8 with Pathway, the consortium? 9 A. Not in specifics, apart from a couple of sort of key 10 moments, but in general there was a different flavour 11 between the three first service providers. 12 Q. Can you give a flavour of what your overall impression 13 of Pathway was from your participation in those 14 demonstrator meetings? 15 A. I think they were more defensive of their solution and 16 didn't want to listen to the complexity. They had more 17 of a fixed world view about: this is the solution we're 18 proposing; it will work. 19 The other providers were more structured and more 20 amenable to listening and to understanding why we were 21 trying to say, "Have you thought about", because 22 ultimately the service provider solution was their 23 solution. We were not designing it, we were not going 24 to be responsible for it; it was the service provider's 25 call about how they did things. All we could do is try 10 1 and highlight was that walking over glass in bare feet 2 wouldn't be a good idea; "Maybe you should get some flip 3 flops. Have you thought about it", and trying to 4 highlight those kind of things to them. 5 We did have one meeting where the owner chief -- 6 I think probably the owner of Escher who were providing 7 a key component came in. He was much more technically 8 aware of the system, it being was his underlying 9 software that was being used. His view was much more 10 that technology could solve it if you threw more 11 technology at it. The ICL Pathway people were more 12 aware of the business implications, building a solution 13 to a price. 14 Q. You have referred just now to a meeting attended by 15 a representative of Escher. We have a number of written 16 reports which were produced into the various meetings 17 which you attended with representatives of the 18 consortium. Before we go to that specific report, do 19 you recall whether you personally contributed to the 20 information and findings contained in the written 21 reports which have recently been provided to you? 22 A. Yes. So the format of the meeting would be on the day 23 we would have -- we would notify the service provider 24 the preceding week about the topics for the next week, 25 thus giving them time to prepare material at everything 11 1 else they needed. 2 We would attend the meeting, and that evening the 3 notes I'd taken, notes that Jeremy who I was working 4 with had taken, we'd collate. That would be over 5 a dial-up modem exchange of emails. It wasn't connected 6 as it is now; we didn't have Teams or things. Then on 7 Friday those would be finalised into the form that was 8 provided to me last week. 9 Q. Thank you. I wonder if we could just pull up one of 10 those reports for now. It's WITN05970107. This is 11 a written report of the infrastructure meeting held on 12 8 November 1995. We can see under the heading 13 Attendees, as you say, this one was attended by you and 14 Jeremy Folkes on behalf of the Benefits Agency Post 15 Office Counter programme, and in the right-hand column 16 we see a number of representatives of the supplier 17 identified, some I believe from Pathway, such as Martin 18 Johnston; is that right? 19 A. Yes. 20 Q. As well as An Post and finally Mike Murphy from Escher? 21 A. That's correct. 22 Q. This is a record of the meeting to which you've just 23 referred a short time ago; is that right? 24 A. Yes. 25 Q. The purpose of this meeting we can see under the heading 12 1 there was to focus on the technical aspects of Riposte; 2 do you recall that? 3 A. Yes. 4 Q. There's one specific entry against your name which 5 I hope you might be able to assist us in clarifying. If 6 we can go to the bottom, please, of page 1, the final 7 bullet point, there's a heading Compatibility with TCDs. 8 What are TCDs? 9 A. Fortunately that's one of the things I can remember. 10 TCD is a telecash dispenser. These were post offices 11 moving away from the fortress, so didn't have glass, but 12 have an open-plan desk like the one I'm sitting at today 13 with a computer and, because benefits could be several 14 hundred pounds, it would not be safe to have hundreds of 15 pounds sitting in an open drawer beside you. So 16 a telecash dispenser effectively is a steel safe box 17 that was connected to the computer, and you could get it 18 to dispense cash and it could also accept cash, so 19 effectively a secure drop box and ATM-ish to dispense 20 notes so that the money was held secure in an open form. 21 Q. We can see that entry read: 22 "No requirement at present." 23 Does that reflect, in effect, the absence of 24 a detailed requirement from the sponsors for -- 25 A. That was because the use of TCDs was where Post Office 13 1 were moving to open plan. That was very much an 2 experiment to see how the format would work. It would 3 need more space. It had other constraints about 4 accepting mails because, if you give me a lot of parcels 5 and I'm sitting here, where do I put all the mail? If 6 I have to get up and put it in a secure place, which 7 I need to because obviously we don't want another 8 customer taking your package, that means that I need to 9 have secure storage around me. 10 For that reason the open-plan concept was tried, 11 it had some problems, and it did not at that time look 12 like it was going to go forward. Therefore, there was 13 no requirement for it. 14 If we needed to move to an open-plan format, we 15 would have introduced it under exchange control. 16 Q. We can see the final sentence reads: 17 "Bob to brief JM prior to next week on requirement 18 implications such as cash holding replenishment and 19 ownership within the office." 20 Who was JM? 21 A. John Meagher. 22 Q. Thank you. What did you understand the nature of his 23 involvement to be at this stage in the process? 24 A. At that stage, I believe he was the programme or 25 project -- I don't know quite the name given but, 14 1 effectively, he was one up from Jeremy. So I've been 2 fortunate to have umbrella managers that have allowed me 3 to get on with the job and I haven't been involved too 4 much with the politics infrastructure set up above me. 5 So I'm a bit hazy on that but ... 6 Q. So far as you are aware, the sort of reporting line was 7 you to Jeremy Folkes and Jeremy Folkes to John Meagher; 8 is that correct? 9 A. That's correct. 10 Q. We can see from the report that Mike Murphy joined the 11 meeting late to discuss the role of the EPOS -- sorry, 12 the Riposte product, and that's at page 2, please. If 13 we can scroll down, please. 14 Point number 3, it appears from the report of this 15 meeting Mr Murphy expressed some fairly critical views 16 about Pathway's understanding of their own proposed 17 solution. Is that a fair characterisation? 18 A. My recollection of Mike was that he was a fairly assured 19 person, as you expect an owner of a company to be, very 20 wed to his product to Riposte and how it should be used, 21 with firm views about how it should be being used, and 22 I don't think that at the meeting we got the impression 23 that the ICL Pathway and Escher way were necessarily 24 aligned. 25 Q. We can see that, please, if we scroll down to page 5. 15 1 There's a second bullet point it reads: 2 "When queried about sizing model Pathway had 3 agreed to produce paper. When this was mentioned later 4 in day with Escher present, the Mike Murphy response to 5 Pathway co-members was 'How can you do that, Pathway 6 haven't got a clue how it works.'" 7 We then see the comment: 8 "Lack of demonstrable thought processes." 9 Did that reflect your views? 10 A. It did. That would be reflecting the disjoint of 11 philosophies between the two companies that we saw. 12 Q. We see at the fourth bullet point a comment to the 13 effect that there was lack of cohesion between the 14 people at the meeting, which I understand to mean 15 between the various representatives of the consortium; 16 so Riposte and Pathway: 17 As a result of which: 18 "[there] must best doubt over ability to manage 19 project if this interface to their customer is so weak." 20 Were you concerned at this stage about Pathway's 21 ability to manage the project? 22 A. I think this reflects a concern and a benefit. The 23 concern was that you should have -- if you're presenting 24 to the customer, you would have a pre-meeting, you would 25 agree the company line and you'd toe it. You'd make 16 1 a decision whether you agreed with it or not, that is 2 the decision, that is what you are going to tell the 3 customer -- in a bid phase especially. 4 The benefit was seeing some of these divisions 5 actually exposed more about the solution than we'd 6 otherwise be able to obtain, because it wasn't so 7 polished. We actually -- "What do you mean by that" 8 kind of question, and get a little bit under the skin, 9 which we had been denied at the time. 10 Q. A further issue identified there at the 5th bullet point 11 was a general problem in relation to documentation; do 12 you recall that? 13 A. It was very difficult to get documents out of ICL 14 Pathway. It was also one of the -- if I look back on 15 the other strand, I think that their production of 16 documents was better. I don't have notes from their 17 meetings to correlate -- corroborate that, but I do 18 believe that the level of engagement was more 19 professional at a technical level with Cardlink and IBM 20 than it was with Pathway. It was much more ad hoc and 21 not always convinced that they knew what they were 22 saying. 23 Q. To what extent were the concerns articulated in this 24 meeting about Pathway's ability to deliver the solution 25 resolved effectively by the time the contract was 17 1 awarded? 2 A. This was very much about a discovery. This wasn't 3 trying to ascertain their delivery as such. This was 4 very much how they are going to deliver the solution; 5 what is the solution they are going to deliver. The 6 disjointed nature was the concern, but we weren't 7 focused, or I at least was not focused on the actual 8 delivery of it, and whether they had the correct 9 governance and procedures in place. Does that answer 10 the question? 11 Q. I think up to a point. It may be that we will come to 12 the assessment phase a little bit later. But, so far as 13 these demonstrator meetings were concerned, you attended 14 a the further meeting, I believe on 22 November, so 15 several weeks later. We have a report of that meeting 16 at WITN05970141. 17 So the same attendees on behalf of Benefits Agency 18 and Post Office Counters. We have some new names under 19 the supplier heading. Martin Bennett, do you recall his 20 role? 21 A. Martin, I think, was a member of the management team 22 within Fujitsu. As it says here, he was the risk 23 manager, and at the time risks were one of the very few 24 leads we had to get information out of Pathway. 25 Q. We can see that the purpose of this meeting was to focus 18 1 on system management, Riposte papers and TMS sizing and 2 scalability. Dealing with the first of those, what was 3 meant by system management, please? 4 A. Both within a data centre and a distributed estate, you 5 have computers as we have in this room. System 6 management is about: how do you update those computers; 7 how do you keep them current? So, if we need to put 8 a new version of software or update the operating 9 system, update the anti-virus, how do we do that? 10 So systems management is about how you manage your 11 system, how you push out updates, and how you discover 12 what is on a computer so that you know what your estate 13 consists of. It also applies to your data centre 14 elements as well. 15 Q. Would that extend, for example, to dealing with faults 16 and defects that might be detected during the course of 17 live operation, for example? 18 A. Answer to that in two parts: yes and no. It wouldn't 19 actually be the resolution and necessarily the 20 identification of such faults, but it would be the means 21 by which you could gather evidence to investigate 22 a fault, and it would be the means by which you 23 distributed a fix to remedy a fault. 24 Q. Thank you. The reference to TMS sizing and scalability, 25 can you explain that, please. 19 1 A. TMS, I believe, stands for transaction management 2 system. It was a central component within the ICL 3 Pathway solution and, where you have at the time around 4 40,000 counters talking into a data centre, even today 5 that's a large number. Back then it was a very large 6 number. The Riposte product we had seen had been used 7 in An Post, which is a much smaller Irish Post Office 8 than the UK Post Office, and therefore we were saying, 9 "Well, how will it work? Have you got enough horsepower 10 to drive the system? Will it be performant? Will you 11 come across problems where a day's job takes 25 hours", 12 and, you know, you just can behind and never catch up. 13 So this was looking at how big TMS would be and, 14 if it had problems, how would you scale it up, how would 15 you make it bigger so that it coped with additional 16 load, because one of the other things you can look at in 17 a system is you can start a system small and, as you add 18 counters, you can grow it out. So we were trying to 19 understand what ICL Pathway's approach was to making 20 sure their central system was up to the job. 21 Q. Thank you. We can see, if we please scroll down to 22 page 5 -- could we just scroll a little bit further 23 down, please. Sorry a little bit further, please. 24 Thank you. So the final bullet point there above 25 section 4, it reads: 20 1 "Updated document. Pulling teeth on performance 2 and scalability issues that are going on behind the 3 scenes." 4 Does this reflect your ongoing concerns at this 5 stage about the success of your efforts to extract 6 information from Pathway about its solution? 7 A. There was an impression that they were aware of the need 8 to make sure that it was scalable, but they were not 9 forthcoming in any evidence that they were actually -- 10 what they were doing to address the concerns, and that's 11 why we then start using the risk lever to elicit, "What 12 are you actually doing about things", rather than having 13 a verbal statement in a meeting. 14 Q. Returning to the question of the assessment phase, we 15 know that the demonstrator stream of the procurement 16 process which we've just discussed was followed by 17 what's known as an evaluation or an assessment phase -- 18 I think the terminology's used interchangeably -- in 19 which the three shortlisted service providers were 20 scored according to a number of factors, some of which 21 related to financial and contractual aspects of their 22 offering, and others relating to the quality of the 23 technical solutions. Is that your recollection? 24 A. My understanding was there were several streams -- 25 I don't know how many -- of which technical was just 21 1 one. 2 Q. What was the nature of your involvement in the 3 assessment phase of the procurement process? 4 A. I participated in the scoring of the suppliers. So the 5 way that it was done for my strand at least was that the 6 ITT2 -- I can't remember -- SRR, that's statement of -- 7 there was an ITT2. I can't remember the proper name for 8 it. 9 Q. The Invitation to Tender? 10 A. Yes, but there was a follow-up to that. There was 11 a revised one from the dialogue that had been had with 12 the service providers, which was one they actually were 13 contracting against. So the initial one effectively had 14 been refined and then, as part of this second one -- 15 this was going through the evaluation phase -- there was 16 set criteria saying: how are they going to demonstrate 17 X, Y and Z, with measures against them such it was 18 a qualifiable and repeatable process. So it wasn't 19 based on feel, it was something which if questioned we 20 could justify and say, "We gave that a 2 because over 21 here it says they are doing this and that. We gave that 22 one a 5 because they are doing this and that, and they 23 are doing this and this." So we could have relative 24 scoring of the providers. 25 Q. Do you recall how Pathway performed during the 22 1 assessment stage relative to the other two service 2 providers? 3 A. I'm sorry, I don't know. 4 Q. Moving on to another topic, if I can, please, you 5 remained working on the BA Post Office Counter Limited 6 programme upon award of the contract to ICL Pathway; is 7 that correct? 8 A. Yes, it is. 9 Q. Who was responsible for your line management during that 10 phase of the programme? 11 A. I can't recall if John Meagher was around then. 12 Probably he still was, but at that time it may have been 13 a guy called Colin Standring. There were several 14 project managers and also, over the course of that 15 period, several consultancies that came in with various 16 sort of the management structures. I'm afraid I can't 17 recall on that timeline. 18 Q. In your statement you have identified two principal 19 aspects to your role during the design and development 20 phase of the programme. The first you've described as 21 refining the sponsor's requirements; is that right? 22 A. Yes, it is. 23 Q. We know that a process of defining those requirements 24 took place during the procurement phase. What did this 25 process of refinement entail? 23 1 A. It was one of clarification and almost compromise. If 2 you have a requirement to do something, you may have 3 phrased it in a way that leads to a certain solution, 4 but there may be an alternate solution that has the same 5 outcome and, if that is easier for the service provider 6 to provide and the outcome is the same, you can adjust 7 your requirement wording such that the outcome is the 8 same even though it's arrived at by a slightly different 9 method. 10 So it was a win-win for us. We would have 11 a service provider that had something that fitted their 12 solution better, but we would still have the outcome 13 that we required fulfilled. 14 Q. Earlier in your evidence, when we were discussing your 15 involvement in the ECCO+ automation project, you 16 described that that project involved a great deal of 17 input from those working at the counter, as I understand 18 it. How did that contrast with the approach adopted 19 here in relation to the Horizon IT System? 20 A. The Post Office people that were interfacing with ICL 21 Pathway, several of those were ex-counter. So the 22 experience, the real-world experience was there. They 23 were generally from the directly managed branches, but 24 ultimately the Post Office had the same accounting 25 requirements across all its branches. 24 1 So the expertise was available to ICL Pathway. 2 How they used it changed. There was a rapid-application 3 approach at one stage where colleagues in my office 4 would effectively disappear for the day and sit down 5 with ICL Pathway to try and come up with mutually 6 beneficial outcomes, which met both the business 7 requirements and fitted in with the ICL Pathway 8 solution. 9 Q. In terms of the rapid-application technique to which you 10 have just referred, to which component of the Horizon 11 product did that initiative relate? 12 A. I believe it was primarily EPOS but that was, as I say, 13 though we shared an office, it was very much a separate 14 strand within the office. 15 Q. That is to say, the development of EPOS was a separate 16 strand? 17 A. Yes. 18 Q. What was the focus? What was the particular focus of 19 your strand, please? 20 A. It was still on the infrastructure primarily, then 21 moving on to how it would interface with the Benefits 22 Agency, who were developing their own back-end systems, 23 so it was how system to system would work. The counter 24 behaviour was effectively a given. You have a given 25 token, it has to go off and be verified, and you pay 25 1 money. That's sort of relatively straightforward and 2 constrained. 3 It's getting those transactions into the data 4 centre and then interfacing off to the Benefits Agency 5 where they were, I think, trying to consolidate 17 6 systems into one, to give a single-payment view, and it 7 was looking at how that interface would work with the 8 Benefits Agency. 9 Q. I described requirements refinement as one aspect of the 10 role you have identified in your witness statement. The 11 second aspect of your role that you've described is as 12 implementation to deploy -- these are your words -- 13 deploy the first generation of Horizon. What do you 14 mean by the term "implementation"? 15 A. It was how -- we had Fujitsu -- ICL Pathway at the time 16 responsible for the in-branch installation, the 17 training, and we had other teams that were looking after 18 that, and it was looking at how the roll-out and the 19 POCL infrastructure would support that roll-out, how 20 we'd get computers into the branch, and making sure 21 that, though a separate team was looking at the 22 training, was looking at the branch fit-outs, et cetera, 23 that the technology sitting behind that would function. 24 Q. During the design and development phase, you have 25 explained you worked both on the front end and the back 26 1 end of the system; is that correct? 2 A. Yes. 3 Q. I wonder if we could, please, just briefly bring up your 4 statement as we can see quite a helpful description of 5 that at paragraph 28. 6 So in terms of front-end design, you explain that 7 you were mostly involved with the magnetic card 8 acceptance and client interface for the Post Office Card 9 Account. I think we also know that as the benefits 10 payment card; is that correct? 11 A. Yes, it is. 12 Q. A little further down in relation to back end interfaces 13 you say: 14 "I also worked on back-end interfaces to the 15 clients to deliver transactions to them and get 16 authorisation verdicts from them, and fed into the 17 reconciliation of the counter view and the client view. 18 The back office was responsible for invoicing ... 19 settlement and ... and remmuneration ..." 20 So far as the back-end interface of Post Office 21 Counters was concerned, this was known as transaction 22 information processing; is that correct? 23 A. Yes. 24 Q. Please can you describe in a little further detail the 25 work that you carried out in relation to TIP, please. 27 1 A. When a transaction is undertaken at a branch counter, 2 it's captured and fed back to the data centre. There 3 was then a harvesting process that would collect that 4 day's transactions and send them off to the TIP process 5 for distribution on to the automated payment client at 6 that time. That may have been actually using HAPS, the 7 host automated payment system. 8 I'm not quite sure of the split because now things 9 have kind of merged, so I'm a bit hazy on that, I'm 10 afraid. 11 But the work was basically to try and make sure 12 that what came in went out. So, if I did ten 13 transactions at the front end, we deliver ten 14 transactions at the back end. 15 Q. So essentially ensuring that what was carried out at the 16 front end could be reconciled with the back end? 17 A. Yes. 18 Q. You have explained in your statement that, in order to 19 carry out the functions you have described, that is to 20 say requirements, refinement and overseeing 21 implementation, you worked from the Fujitsu site in 22 Feltham; is that correct? 23 A. That's correct, yes. 24 Q. Were any conditions or limitations placed on your right 25 of access to or your ability to share information which 28 1 you obtained during your time working there? 2 A. Feltham, I think the best way to describe it, was 3 divided into sort of four areas. There was the common 4 area which was the canteen, et cetera, which facilities 5 you could access. There were -- there was then, as you 6 came in, on the right-hand side, there was the BA POCL 7 office to which we had access, but Fujitsu staff did 8 not, and the rest of the building was Fujitsu staff 9 only. So we did not have access to the rest of the 10 building and, if we wanted to go and see somebody, we'd 11 have to phone them and they'd meet us at the door and 12 buzz us through and escort us out. 13 There were different arrangements, I believe, set 14 up for the testers, that they had what was known as 15 Chinese walls set up, such that we had Post Office staff 16 doing testing, but they did it on the basis that what 17 they found out there was not necessarily shared. Now 18 that's my recollection which may be incorrect. 19 Q. What did you understand the rationale for that to be? 20 A. It was so that Pathway had access -- because testers 21 again had Post Office Counters experience so that 22 Pathway would have access to that experience. They 23 would be able to get input about what was wrong with the 24 system quicker and in a non-contractual manner, such 25 that they wouldn't be afraid of hiding -- of exposing 29 1 shortcomings. So it was a much more open way of 2 working. 3 Q. But your understanding is that any information which 4 they gleaned about the system during the testing phase 5 they were not entitled to share with their employer? 6 A. That's my recollection. As I say, it may be an error 7 but that's how I remember it. 8 Q. You have described in your statement attending regular 9 face-to-face meetings with staff employed by ICL 10 Pathway, I think primarily to discuss and review 11 technical documentation; is that correct? 12 A. Not just technical documents because, being at the site, 13 I was also used as what was called a document champion. 14 So my name would appear on lots of documents on which 15 I'm not subject-matter expert. But having a physical 16 presence would mean that I would be effectively be the 17 face of the Post Office for that document and engage 18 with ICL Pathway on it. So I would review the document, 19 not necessarily from a specialist point of view, but 20 then seek specialist input. 21 Q. How would you characterise the behaviour and conduct of 22 ICL Pathway staff during these meetings? 23 A. I think professional would be the best term, not 24 necessarily overly collaborative. I would suggest that 25 throughout the process they were more commercially 30 1 aware. But again you must realise they weren't a 2 charity, they weren't going to do this for nothing. But 3 everything was costed and considered. It wasn't like 4 some of the other suppliers I have worked with, which is 5 more collaborative and more interested in getting the 6 right solution. 7 Q. Were you concerned that ICL Pathway were not 8 particularly interested in getting the right solution? 9 A. Their world view was that their solution was the right 10 one, and it was difficult to move them from that world 11 view. 12 Q. One of the challenges you have identified in your 13 statement relates to ICL Pathway's refusal to grant 14 access to its low-level designs and code; is that right? 15 A. That is correct. 16 Q. What effect did this have on your ability to assure the 17 quality of the product that was being produced and the 18 effective implementation of Post Office Counters' 19 requirements? 20 A. It hindered it greatly. We could get -- we could only 21 assure high-level documents which were shared. They 22 were not always initially of the best quality. That did 23 improve. I think that depending on where you look in 24 the continuum of time, at the early stage it was very 25 difficult. The threat of the risk registered for the 31 1 evaluation pre-tender did elicit documents from them and 2 things, as I understood why, were less hampered about 3 sharing information. It did get better. So we did get 4 high level but we never actually got under the cover. 5 Q. What, if any, efforts did you make to obtain documents 6 or to glean information informally through your working 7 on site and your access to ICL Pathway staff? 8 A. There were corridor conversations. There was, at 9 a working level, a better relationship than when 10 "management was present", whether that be physically 11 present or with a management hat on. So the people 12 generally were there trying to help and trying to 13 assist. They were constrained by the ways of working 14 that I believe was probably imposed from top down. 15 Q. What were you able to glean in your more informal 16 interactions with ICL Pathway staff about issues that 17 they were experiencing in development? 18 A. I think we were aware they had issues but the depth of 19 the issue was never revealed. I mean, there was nothing 20 that said that there was anything fundamentally wrong, 21 and it was always being looked upon as, in my 22 understanding at the time, probably still is, that in 23 any development project you're going to have issues, 24 you're not going to get it right first time, you'll be 25 correcting it and improving it continuously. I don't 32 1 think we understood how far behind where we were 2 expecting them to be they were. 3 Q. When you say you had an awareness of issues, are you 4 able to be more specific as to what they related? 5 A. It was just in passing; there was nothing in particular 6 that I can recall, I'm afraid. 7 Q. I wonder if we could please turn to page 39 of your 8 statement, paragraph 134. I'd just like to clarify, if 9 I may, a comment there. This paragraph reads -- do you 10 have that before you, paragraph 134: 11 "It is worth noting that ICL Pathway did draw 12 boundaries that were not to be crossed in terms of 13 access to lower level designs and correlation of 14 unit/system tests to design to confirm all paths had 15 been considered and tested." 16 We've addressed the first part already, so the 17 question of your access to low-level designs. Can you 18 explain, please, what you mean in the second part of 19 that sentence to the correlation of tests to designs, 20 please. 21 A. In a software life-cycle, you will generally have 22 designers setting out the shape and direction of where 23 they want the coding to go. You'll then have the 24 programmers taking that design and working down to 25 a lower level and actually implementing it, and then 33 1 doing unit testing to say what they've implemented meets 2 the design and, generally, previously on previous 3 projects, you get how many tests were run, how many 4 tests passed first time, and from that you can get 5 a judge of not just the quality of the code but how 6 close to the design it is, and you then expect 7 a quality-assurance function to come in and to 8 check-step it, to make sure that Bob's view of -- that 9 he's coded what's been asked and it's 95 per cent of the 10 test passed first time is correct, and you get that 11 quality assurance, and you would then be able to say, 12 "Oh, Bob isn't as good at coding as Fred is, so we need 13 to do some mentoring", and be able to look at those 14 areas, or it may actually highlight that designs are not 15 clear enough and the programmers need more guidance. 16 It may highlight a lack of testing environment, or 17 a lack of supporting test material to adequately test 18 the units and, as things from units move up and get 19 integrated with other units, it may well be that you 20 find that all the wheels are perfectly round, but they 21 are the wrong size for the car, and that then highlights 22 a different problem. We didn't get any of these 23 metrics, so we couldn't see how well the software 24 life-cycle was being adhered to and how good or bad it 25 was. 34 1 Q. What did you consider to be the reason for why you 2 couldn't obtain that level of insight? 3 A. I think there were probably two factors. The first 4 factor was, "It's contractual. Go away. This is the 5 boundary, you shall not cross it." Actually it's 6 probably -- the next words were, "Why are you 7 interested? We're the professionals here. Leave us and 8 let us get on with it. Every time you ask us 9 a question, you are diverting us from actually doing the 10 work. So, if we keep answering your questions, we'll 11 never get anything done", and that was played out quite 12 a lot. 13 I think that, from some of the things that I've 14 gleaned more recently, they probably didn't have that 15 material to hand. 16 Q. A further problem which you have identified in your 17 statement relates to Post Office Counters' visibility of 18 the nature and extent of defects that were being 19 identified in the system during the testing process; is 20 that right? 21 A. Yes. 22 Q. If we could just scroll up, please, to paragraph 132 you 23 said there: 24 "It should also be noted that ICL Pathway 25 development was behind closed doors, and only 35 1 outstanding defects that were present would be declared 2 to Post Office Counters Limited when its User Testing 3 began." 4 Can you explain that in a little more detail, 5 please. 6 A. It kind of follows on from what I was saying that, if it 7 took them ten goes to get a bit of code right to add up 8 two numbers, we wouldn't see that. We'd only see that 9 the numbers were adding up correctly now. 10 When user testing began, that was our testers in 11 Post Office uniforms, so where they could share the 12 information they found, actually testing the system and 13 testing it from the user perspective. 14 I think I mention elsewhere that that means that 15 we couldn't test some of the technical break points, and 16 failure conditions in particular, which require 17 programmer intervention. So by that, if I send 18 a message and I don't get a response, I need to do 19 something. From a user perspective, I can pull that 20 wire to stop that message, but I don't know if I've 21 pulled out that wire before it's been sent, so has it 22 reached the end and I haven't got the reply, or did the 23 request never get there, because, if the request never 24 got there, the person I'm talking to doesn't know about 25 it, so they've done nothing. 36 1 If I've asked -- let's say I've asked you for £100 2 and you have got that request and you set back "yes", if 3 I don't get back your "yes", well, I won't pay that 4 £100, but you will have affected the account by £100. 5 So those kind of technical tests and failure conditions 6 would need Fujitsu intervention to force them, because 7 the user couldn't actually repeatedly do these kind of 8 tests, they couldn't force the failure conditions in 9 a repeatable manner, and they couldn't force all of the 10 failure conditions you would expect a unit test to do, 11 because a system talking back to us may have 50 or 60 12 return codes that it can return which have different 13 behaviours at the counter depending on what they say. 14 We would need a system, an emulator, to give those 15 return codes back, and we would be dependent upon 16 Pathway to write that emulator, provide that emulation 17 so the behaviour at the front end could be confirmed as 18 correct. 19 Q. If I understood you correctly, the technical tests and 20 failure conditions you have described, these are 21 processes that would be implemented by ICL Pathway prior 22 to the user acceptance testing; is that correct? 23 A. That's correct, yes. 24 Q. What exactly was the principal purpose of the user 25 acceptance testing, please? 37 1 A. The user acceptance testing was effectively what an end 2 user would typically experience. So can they sell 3 a stamp? Does it appear with the right price? Does 4 it -- do all the stamps in the basket add up? Do they 5 go to the right place in the cash account? When I'm 6 doing an online transaction, when I'm presented with 7 a magnetic card, does it recognise that, yes, we support 8 that card, it is a Herts County Council card, that 9 should have Herts County Council on the receipt. It 10 should allow you to pay up to £1,000. Are all those 11 elements correct and working? 12 So really it's very much the end-user experience, 13 with some failures, and where emulators and simulators 14 are available, with not always a proved verdict coming 15 back from a request -- I'm asking you for £100 but I 16 don't have it, you will send back a decline. So certain 17 behaviours, you can emulate, but it wouldn't give all of 18 the failure conditions. It wouldn't allow us to check 19 that the defensive programming that needs to be in place 20 in any system was in place. 21 Q. It's right, is it not, user acceptance testing didn't 22 represent the end of the testing process so far as 23 Horizon was concerned? There was further testing of the 24 system that we know as model office and end-to-end 25 testing. 38 1 A. So model office testing is actually -- the model office 2 is actually several offices. They are real offices, 3 they are live offices, they're not test offices. They 4 are there to prove that tested software has been 5 promoted into the live environment correctly and it 6 works correctly when it's in that live environment. 7 If we look at things as we did later with banking 8 we can test against the simulator and we can test that 9 a £50 withdrawal will work or won't work. But, when we 10 can then connect it up to the real bank and we get back 11 a balance enquiry, that is making sure that the systems 12 work end to end, but the model office is a real branch, 13 it does real transactions, it affects real accounts. It 14 is not there to test. So before it goes into model 15 office we have high confidence that it will work 16 properly. 17 Q. Did you have that confidence in the system prior to its 18 entry into model office and end to end? 19 A. We're between a rock and a hard place, I think. We had 20 exhausted the testing evidence we could get from 21 Pathway. We had done user-acceptance testing which 22 proved that generally it would work correctly. We had 23 no highs. So for acceptance we would have three 24 categories of fault. 25 We have a high fault. That's catastrophic, you 39 1 can't go live with it. Fundamental flaw, no way it's 2 going out the door. 3 You would have medium-severity faults. These are 4 ones that are significant but would have an acceptable 5 work around. It may mean you have to do something in 6 addition, do something differently, follow a procedure 7 to make sure that things work, but generally the 8 work-around would be acceptable. There would not be 9 more than, I think, ten of these because ultimately 10 a work-around is not natural behaviour, and we couldn't 11 rely on people doing work-arounds. We couldn't rely on 12 system work-around because they weren't always human 13 ones. 14 Then we would have low ones where we may not have 15 receipts lined up correctly. So the text may be a bit 16 wobbly -- cosmetic effectively. Again you wouldn't want 17 too many of those because, at the end of the day, it's 18 a professional system. It's customer and facing real 19 people and, if you have got typing errors and spelling 20 errors in a product, you would start to wonder if what 21 was underneath it was right. 22 So those would be the categorisations, and model 23 office would be: it has no highs, it has -- and it may 24 have some mediums, and they would then try and execute 25 the scenario to cause that failure and then implement 40 1 the work-around, confirm that it works in the real world 2 because, again, we've done it in a testing environment, 3 we need to make sure that it translates to the real 4 world, to the live world. From that the end-to-endness 5 would happen because that model office real-life branch 6 has gone from its counter, through the live data centre 7 to the live account, live client, and we've got an 8 end-to-end balance, and we can check that the invoice we 9 give to that client at the end of the day matches what 10 we've done at the counter, so it gives us our end to 11 end. 12 Q. What you described just now as an acceptance process, 13 I don't understand you to be referring to acceptance of 14 the system as a whole. Is it right that what you're 15 referring to here is the acceptance of a particular 16 release or a component? 17 A. Yes. 18 Q. Prior to its entry into model office and end-to-end 19 testing; is that correct? 20 A. Yes. 21 Q. Now, when you say at paragraph 132 that ICL Pathway's 22 development was behind closed doors, I don't understand 23 you to mean that you had no awareness of technical 24 issues; is that right? 25 A. We only knew what we were told. We did not see, as I, 41 1 say, the unit tests. We didn't see how many attempts 2 they'd taken to get through a test. The development was 3 effectively done elsewhere, and we didn't see that 4 development. We saw the outcome of that development. 5 Q. You did see some quite serious issues arising during 6 model office and end-to-end testing; is that right? 7 A. I can't recall whether they were seen in model office or 8 whether we had -- I think you are now referring to 9 acceptance instance? 10 Q. No, forgive me. I'm referring to the model office and 11 end-to-end testing of in particular the EPOS component 12 in late 1998. So we're looking at the sort of period of 13 November to December 1998. 14 A. I can't recall any specifics, I'm afraid, sorry. 15 Q. I wonder please if we could bring up the document 16 WITN05970122, please. I believe you've been shown 17 a copy of this report; is that correct? 18 A. I've been shown many documents. That may well have been 19 one of them, yes. 20 Q. This report is entitled Contingency Options for the 21 Non-availability of EPOS feed to TIP. We established 22 a little earlier that you had some involvement in TIP, 23 the transaction information processing, in the design 24 and development phase, and you are recorded here as one 25 of the authors of this report. It's dated 42 1 12 January 1999, version 1.0. Do you have any 2 recollection of this report? 3 A. Not at the time of writing, no. 4 Q. If we could scroll down, please, to the second page, 5 under the main heading of Background, this is 6 paragraph 2, if we go a little further, paragraph 2.1.2 7 it reads: 8 "During the Model Office and end-to-end test 9 phases with the ICL Pathway Horizon solution, 10 significant problems have been experienced in using the 11 data stream provided by ICL Pathway. It is believed 12 that ICL Pathway may not be able to fix these problems 13 within the necessary timescales to enable the full data 14 feed to TIP to be proven without causing a severe impact 15 on the New Release 2 timescales." 16 Does that assist your recollection at all? 17 A. I'm afraid it doesn't, no. 18 Q. As the author of this report, this must have been an 19 issue of which you were aware at the time; would you 20 accept that? 21 A. Yes. 22 Q. If we go a little further, please, to paragraph 2.2.1, 23 which may be over the page. Yes, thank you. This 24 provides a summary of the errors that were being 25 experienced. They included an inability to make files 43 1 available to TIP, there being no balanced cash accounts 2 in the first phases of testing; the fact that files 3 contained wrongly dated transactions; incorrect versions 4 of reference data; spurious outlets not known to RDP or 5 TIP. 6 Can you explain what RDP means? 7 A. I believe that would have been the personal reference 8 data system. So that would be providing information 9 saying, "We've got these branches and this is the 10 address to put on the receipt", et cetera. 11 Q. And also: 12 "Files containing transactions that cannot be 13 performed according to the submitted reference data and 14 business rules causing TIP to abnormally end (abend) 15 processing." 16 What's meant by "abend", please? 17 A. Abend is just the shorthand for abnormal end. 18 Q. "Final file resubmission taking several days and then 19 being rejected as the handcrafted fixes invalidate the 20 file integrity totals." 21 So a number of fairly serious concerns; would you 22 agree -- 23 A. Yes. 24 Q. -- about the accuracy of the accounting data being 25 harvested and transferred to TIP? 44 1 A. Yes. 2 Q. At paragraph 2.2.2 we can see reference to the problems 3 being experienced appearing to occur across the board, 4 and not being confined to one or two specific areas. 5 It's noted that this means that it's not just a single 6 area where there's a deficiency that's in need of 7 attention but several. In terms of the source of the 8 problems, you appear to have concluded at 9 paragraph 2.2.3 that the problems were wholly within the 10 ICL Pathway domain at that stage. Again do you have in 11 recollection at all -- 12 A. No, I'm effectively reading this for the first time, if 13 you know what I mean. I have no recollection of actual 14 events at the time. 15 Q. Presumably what you're saying in effect is you simply 16 don't recall any of these matters? 17 A. No, I don't, I'm afraid. 18 Q. Does that explain why they don't feature at all in your 19 63-page witness statement? 20 A. Yes. 21 Q. Sir, that might be a convenient time for us to take 22 a short break this morning? 23 SIR WYN WILLIAMS: Yes, that's fine. What time shall we 24 recommence. 25 MS HODGE: Shall we resume at 11.15? 45 1 SIR WYN WILLIAMS: Yes, thank you. 2 (11.05 am) 3 (A short break) 4 (11.15 am) 5 MS HODGE: Good morning, sir, can you see and hear me? 6 SIR WYN WILLIAMS: Yes, I can thank you. 7 MS HODGE: Thank you very much. Mr Booth, I would like to 8 ask you some questions now about your knowledge of ICL 9 Pathway's access controls and privileges. It appears 10 that one aspect of the project in which you became 11 involved prior to its roll-out related to issues of 12 fraud and security; is that correct? 13 A. It is. 14 Q. We see that you feature on the distribution list of 15 a number of ICL Pathway documents relating to access 16 control and security management. I think you are 17 described as a member of the Horizon Fraud and Security 18 Group? 19 A. I don't recall being part of that group. 20 Q. Can you describe what the function of that group was, 21 please. 22 A. I don't actually know what that group was, I'm afraid. 23 Q. If we could just bring up FUJ00001493, please. This of 24 course is an ICL Pathway document, so it may be that 25 some sort of the misunderstanding has arisen, but it 46 1 relates to what's described as the NR2 access control 2 and user administration processes and procedures, and we 3 can see it's dated 30 June 1999. This is version 2.0. 4 If we scroll down, please, to Distribution, your name 5 features under the heading Horizon Fraud and Security 6 Group. 7 Is that a group of which you were aware? 8 A. Not necessarily that title. There were people dealing 9 with fraud and security, in particular. I was not part 10 of the inner circle of that, if you like. Again, given 11 my location at Feltham and general knowledge, I've been 12 a participant in some of those documents, but 13 I wasn't -- I wouldn't have been the lead subject matter 14 expert on that. 15 Q. When you say there were people involved in those issues, 16 are you referring to people sort of the back in Post 17 Office Counters, or are you referring specifically to 18 employees that Feltham site that you had? 19 A. No, it wouldn't have been at the Feltham site. It would 20 have been both Post Office and -- at the time would this 21 have also been when BA were still around? 22 Q. I think this is June 1999. So by that time they would 23 have withdrawn from the project. 24 A. It would probably have still had their input from the 25 start, because the board risk management system was very 47 1 much a BA-driven item because that was primarily looking 2 at reducing fraud of the benefit books, and that was 3 a BA initiative with Post Office participation, and 4 I assume that this would then carry over from that 5 group. 6 Q. We see you referenced again, please, in POL00043742. 7 This is a document entitled Security Management 8 Procedures, co again an ICL Pathway document dated 9 17 September 99, version 1.2, and again under 10 Distribution we see the Horizon library is identified 11 but specifically for your attention. 12 Is it likely that you were invited to review these 13 documents as part of your role as the single point of 14 contact or document review, the document champion that 15 you have described. 16 A. Yes. Basically I had my names on lots of documents 17 I reviewed, as I said earlier, not necessarily as the 18 subject matter expert, but as the conduit both to and 19 from them. 20 Q. In doing that, would I be right to understand that you 21 would have liaised with those in Post Office Counters 22 who were responsible for fraud and security issues? 23 A. Yes. 24 Q. And who were the experts in that field? 25 A. Yes. 48 1 Q. Do you happen to recall who they were at this time? 2 A. I knew you were going to ask that one. I'm afraid I 3 don't. 4 Q. Presumably, if you had the task of reviewing these 5 documents relating to access controls and security 6 management, you had some understanding of the purpose of 7 these controls; would that be fair? 8 A. I will have had from two perspectives. One would have 9 been my understanding of the rest of the system and, 10 therefore, was it at odds or was it trying to either 11 expose or gloss over something that I was aware of 12 elsewhere. As part of my mindset, if you like, 13 reviewing the document and searching for the 14 inconsistencies within a document is what I would also 15 have been doing from that perspective, but as an 16 educated layman about these subjects rather than as the 17 expert on these subjects. 18 Q. What did you understand about the controls placed on the 19 ability of ICL Pathway staff to access or to amend 20 transaction data recorded on Horizon? 21 A. I was unclear about how they would amend but, having 22 been around IT systems, ultimately the systems 23 administrator can always go in and, no matter what 24 controls you've got, if they have a high enough level of 25 privilege, you can do whatever you like. So -- not 49 1 whatever you like, but you can always get into a system. 2 It's then around the integrity of the data and the 3 tooling, to make sure that any changes are audited. 4 I can't remember if this document -- or it was common 5 understanding was that changes would be four eyed i.e. 6 you would have two pairs of eyes on it, so that one 7 person was doing the change, another person would look 8 at the change to make sure they only change what they 9 said they were going to change and there was a record of 10 that. 11 Q. From what you have just said, it seems to be that your 12 experience from working in programming and other 13 automation systems was that this type of remote access 14 to transaction data was quite common -- is that right -- 15 it was a necessary component of a system of this type? 16 A. There would be two types of access. There would be the 17 read-only for investigation, which would be more common, 18 because that would enable you to find any underlying 19 issues, and it would also allow you to do enquiries 20 which were not -- you could run a report that wasn't 21 otherwise there for you. So, if you wanted to know how 22 many branches had an odd number of counters, there 23 wouldn't be a report for that but, if you had access to 24 the data, you could go in and find it. 25 Where amendments are made to data, generally that 50 1 would be done via an auditable tool, rather than just 2 going and over-typing data, which I think may have 3 occurred later, from some of the -- especially just 4 before the break, some of the handcrafted fixes and 5 files we saw, generally I'd have expected tooling to 6 have done that rather than a manual process. 7 Q. The mere fact that ICL Pathway could do this was 8 something that you were aware of at the time, was it? 9 A. It's something that's endemic in any system. 10 Q. You consider that knowledge of that was something that 11 was widely held within Post Office Counters at the time? 12 A. Yes. Well, there may have been a naiveté amongst the 13 non-technical people, but anyone who has a technical 14 background will know that, if you have sufficient 15 privilege, you can go in and look at the data, and you 16 can amend the data. 17 The integrity of the data and the integrity of the 18 database that you need to put around it to protect that, 19 and controls you need to put on such that you know that 20 this user with those privileges has logged on at that 21 time, you'd know where they were in the system and, 22 having an audit of what they've done, that was the 23 controls that you'd put on top of it. 24 Q. What did you understand about the extent of these 25 privileges that ICL Pathway staff had in relation to 51 1 their ability to access and amend the data? Did you 2 have much knowledge at all of the extent? 3 A. No. I mean, the expectation would be that it would be 4 very limited in terms of the number of people that could 5 do that, and they would, as I say, be overseen whenever 6 they did do any amendment. 7 Q. During your time working in Feltham, did you ever 8 discuss with ICL Pathway staff the extent to which these 9 privileged rights were exercised? 10 A. Not to -- I think that the setup at that time -- Pathway 11 would have had staff in Ireland doing such work. So it 12 would have had -- they had data centres in Belfast, and 13 their support service centre, I think, at the time was 14 based in Belfast. I may be wrong on that. 15 Q. Thank you. I'd like to move on now, please, to a new 16 topic, this being the acceptance of the Horizon IT 17 System that took place in the summer and autumn of 1999. 18 What do you recall about your involvement in the 19 acceptance of Horizon? 20 A. With the documentation and things, I was involved in 21 acceptance incidents that were brought to our attention 22 and managing out of the system. So a defect would be 23 raised, it would be qualified as: is it a defect or as 24 Pathway would like to say, is it a feature? So is it 25 a true defect that needs remedy, or is it just 52 1 misinterpretation? Then what is the material impact of 2 that? 3 I go back to my high, medium, low type criteria. 4 Is it a service stopper, is it service impacting, or is 5 it just an annoyance? 6 From that they would then be tracked down with the 7 intent of clearing as many as possible, obviously before 8 going live because you don't want a system with known 9 defects in it. 10 Q. One of the incidents which you raise was known as 11 Acceptance Incident number 372. This related to systems 12 management. What do you recall, if anything, about that 13 incident? 14 A. Again from some of the documents, I believe that that 15 was around concerns that, at the volume, Pathway were 16 not necessarily able to distribute software in 17 a reliable manner or a timely manner anyway. 18 Q. One of the high severity AIs which you were involved 19 in -- forgive me, acceptance incidents we abbreviate to 20 AI -- was Acceptance Incident number 298 relating to 21 system stability. Do you recall that? 22 A. Yes, I have some recollection of that from material 23 especially some of the other material that's arisen. 24 Q. What were the nature of your concerns in relation to 25 that incident? 53 1 A. There was some sympathy that the system would lock up 2 and freeze. PCs of the day were less reliable than they 3 are now, and there was at the time -- "blue screen of 4 death" was an industry phrase because of Microsoft's 5 frequency of locking up and freezing. 6 From some of the material, it's obvious that we 7 were suffering similar kind of behaviours, and 8 occasionally we'd have an hour glass come up where the 9 system was busy and effectively would hang, meaning that 10 the users couldn't use the system. This went on for 11 several months. 12 Pathway were in denial at some stage of the extent 13 and the impact of the problem. The issue you have is, 14 if your machine is effectively hung, the only way you 15 can unhang it is to turn it off and turn it on again 16 and, when you do that, you run the risk of corruption. 17 You also then have an unknown account rate because 18 Pathway would not put in something that would say, "This 19 machine has just started up", and collect those metrics 20 automatically, which would have been something we would 21 have asked for and would have been a reasonable thing to 22 say how often is this happening in the estate. They 23 would much rather turn to Post Office and say, "Can you 24 phone round your branches and ask them how often they 25 are rebooting." So there was, in my view, a simpler 54 1 technical measure that could have given us a very 2 accurate picture, but Pathway would prefer us to do 3 a manual, more -- less accurate, more onerous 4 phone-round to find out what was happening. 5 The eventual solution -- in the same way that 6 Microsoft even today suggest you don't leave your 7 machine turned on and hibernating, but you turn it off 8 regularly -- was to instigate nightly reboots such that 9 the machine would reboot itself each night on the belief 10 that the problem was due to running out of resources. 11 So that I keep on -- I don't know what the root cause 12 was but, say I keep on opening a file, so I have a file 13 open, and I have consumed one opening. If I don't 14 release that opening, if I open it again, I've consumed 15 2, I've consumed 3, I've consumed 4. I can only consume 16 so many before I run out of them, and then I would hang. 17 If you restart your machine each day, you always 18 start at 1 and, by the end of the 23 hours and 59 19 minutes, hopefully, you haven't got to the big number 20 where you would have hung. So by restarting it 21 regularly, it means -- you still have the problem, but 22 you don't have the consequence of that problem. 23 Q. Was that a solution implemented by ICL Pathway, that is 24 to say, were the systems automatically rebooted? 25 A. Yes. 55 1 Q. It didn't require the subpostmaster or the clerk to do 2 that? 3 A. No. 4 Q. One of the medium severity acceptance incidents of which 5 you had oversight was AI211. This related to a receipts 6 and payments mismatch. Do you have any recollection of 7 that? 8 A. Not familiar with that one as much. 9 Q. I think records on that are relatively limited, but if 10 we could bring up, please, POL00028360. This is what 11 appears to be effectively an action log prepared 12 recording the output of a meeting on 11 August 1999, 13 where we see the various acceptance incidents recorded 14 there, severities as defined by Pathway and Post Office 15 Counters, and then the final column some remarks. 16 Please could we scroll down to page 9. 17 So we see here AI211 receipts not equalling 18 payments, and there's a reference to a memo from you. 19 I don't think we've been able to obtain a copy of that, 20 but it would tend to suggest that you had some 21 involvement in this AI. Would you agree with that? 22 A. I would agree with that, yes. 23 Q. There's reference there to the implementation of 24 a rectification plan, and the results having been shown 25 to work, but there being some remaining incidents due to 56 1 reference data. I'm looking here at the third column, 2 as I'm sure you are aware, and one incident being 3 reported due to kit swap-out reintroducing pre-LT2 which 4 would be a reference to live trial 2, would it? SW -- 5 A. Software. 6 Q. There's a point to say that action is with Pathway to 7 investigate, and there be a possibility that 8 a combination of builds have not been tested properly. 9 Does any of that assist your recollection of this 10 particular AI? 11 A. Not -- I can interpret what it says now, but I wouldn't 12 say at the time. 13 Q. Please could you do so to the best of your ability. 14 A. I would suggest that the medium to low was contested, 15 and I had reason to say that it shouldn't be moved down 16 to a low, that it should be maintained at a medium 17 severity incident. But without that memo, I'm afraid 18 can't substantiate that. 19 On terms of the reasoning, it would suggest that 20 the software that was put on the counter was not the 21 correct build because it was a swap-out and therefore 22 a bug that had thought to have been cleared was 23 reintroduced because it was on old software. That's my 24 reading of what's in front of me. 25 Q. Was that a problem of which you were aware, namely the 57 1 risk of reintroducing bugs that had previously been 2 fixed? 3 A. If you're bringing kit off of the engineer's van that 4 is -- it will not be current necessarily. So, if today 5 I fix this computer and I fix this one, fine. I now put 6 that on my van and I have an update, this one's turned 7 on and it will get updated, the one on the van won't. 8 When it gets installed, it needs to be brought up to the 9 current build before being used. Looking at this, it 10 would appear that that didn't happen and, therefore, an 11 older version that the engineer installed was actually 12 used in live with these consequences. That's my reading 13 of what's in front of me. 14 Q. Thank you. 15 Finally before we move on to another topic, 16 although you were not directly responsible for the 17 incident, you were aware, were you not, that an incident 18 had been raised relating to the accounting integrity of 19 the Horizon System under AI376? 20 A. Yes, I would have been aware of -- because the 21 Acceptance Incident form went through all of the 22 incidents, I would have been party to that, yes. 23 Q. Bearing in mind your earlier involvement with 24 transaction information processing and the problems that 25 had been identified in January of 1999, was that an 58 1 Acceptance Incident in which you had any involvement or 2 took any particular interest? 3 A. Sorry, I can't comment on that. 4 Q. Did you have any concerns at the time about that 5 particular AI and its impact upon Post Office Counters 6 and its accounting integrity? 7 A. All AIs were of concern. As we lovingly called it, the 8 route to green. So to get them to be a green light you 9 could go ahead with was to rectify them. So having an 10 Acceptance Incident was bad, but it did mean that the 11 fault had been found and, if you find something that's 12 wrong, you can fix it. 13 So the volume of AIs was disappointing, but what 14 was important was, before going live, the volume that 15 were left outstanding and the type that was left 16 outstanding before going live -- 17 Q. Sorry. Thank you. One of the final topics I would like 18 to deal with, please, relates to what you knew at the 19 time about the role of investigations and prosecutions 20 in Post Office Counters. Now, one of the low severity 21 AIs for which you were responsible was AI370. Do you 22 recall that AI? 23 A. I don't. Do you have a ... 24 Q. Yes, by all means. Please could we show POL00028508. 25 This is an email from Min Burdett. Did you have any 59 1 direct dealings with Min? 2 A. Min was one of the managers around in Post Office, 3 probably based in the London office. Yes, I had some 4 dealings but not day-to-day. 5 Q. This email is addressed to, we can see, Keith Baines and 6 Chris French. You are not on the face of it copied into 7 this email, but it contains an attachment which relates 8 to what is described as "the new acceptance process". 9 So this is in late January 2000 after the system has 10 been formally accepted by Post Office Counters and the 11 roll-out has started and indeed recommenced. 12 If we can scroll down, please, to page 6, if we 13 perhaps go back to the second page just so you can see 14 the title of the document, sorry, this is a document 15 called Concluding Pathway Acceptance version 0.1. It 16 contains a table with a number of acceptance incidents 17 that were outstanding as at 28 January 2000, it would 18 appear. We can see that, please, at page 6. 19 This is a list of the medium severity acceptance 20 incidents. We can see that you're still named in 21 relation to AI372, the system management, an incident to 22 which we referred earlier. There was another 23 outstanding medium severity 314 relating to the 24 provision of documentation and, at page 8, please, about 25 halfway down the page, can you see an entry AI370 the 60 1 title of which is Witness Statement? 2 A. I can, yes. 3 Q. Under the heading Post Office Counters Limited ATM? 4 A. Yes. 5 Q. Do you know what ATM stands for? 6 A. I assume Acceptance Test Manager. 7 Q. You are named there. 8 A. Yes. 9 Q. Now, before we move on from this document, if we may 10 please just go back to page 5, this relates to the 11 procedure for closing outstanding acceptance incidents, 12 and provides: 13 "The ATM's role in closure of AIs will continue as 14 now. When the ATM is satisfied that the closure 15 criteria have been met, he or she should email his or 16 her line manager explaining the reasons for and 17 recommending closure. The ATM should consult with 18 appropriate business representatives who typically 19 [would] have been involved during the lifetime of the 20 AI." 21 If we go on, please, just a little further down 22 under the heading Handover of Closure Baton Recipient, 23 at 3.9, it provides: 24 "For a number of the AIs, there will be ongoing 25 monitoring to ensure that the AI solution does not 61 1 regress. The ATM [the Acceptance Test Manager] will be 2 responsible properly briefing the baton recipient ..." 3 Then there's a note in parenthesis: 4 "More guidance on this [is needed] to be included 5 here when the issue has been discussed with BSM" -- 6 would that be business service management? 7 A. Yes. 8 Q. "Typically", it says, "as shown in appendix 1 the baton 9 will be passed to BSM. In the past this has not always 10 been done, and a review of all currently closed AIs will 11 take place short to identify any missing batons." 12 So just pausing there briefly before we return to 13 AI370, does that broadly reflect your understanding of 14 how these incidents were closed? That is to say the 15 process by which responsibility for an incident was 16 transferred? 17 A. I can't recall this detail, but it's an obvious 18 transition into business as usual, by saying that the 19 program looks to be winding down at this stage and we're 20 handing things over to the normal business service 21 managers for monitoring, and anything that is not 22 closed, for them to then manage to closure. 23 Q. Thank you. We can see some reference to AI370 in a 24 document that bears the reference WITN05970134, please. 25 This document is entitled Review of Horizon Cash Account 62 1 System Stage 2. I don't believe you were the author of 2 this review or rather the report into this review. 3 A. No. 4 Q. But it does helpfully provide some information about 5 AI 370. If we could go, please, to page 3, we see 6 reference to An outstanding acceptance incident 370 7 graded as low. Can you see -- forgive -- me in the box? 8 A. Yes. 9 Q. This report, I believe, is dated July 1999. So it's at 10 or around the time where these acceptance incidents were 11 first raised and being addressed. It says: 12 "[This incident] exists against the POCL 13 requirement, on the assertion by Post Office Counters 14 Limited that Pathway should" -- it says "product" but 15 presumably it should have read "produce"? 16 A. Yes. 17 Q. -- "a witness statement to support prosecution. This AI 18 revolves around the interpretation of 'ensure that all 19 relevant information is evidentially admissible'. 20 POCL's view is that to be admissible it will need to be 21 supported by witness statements, et cetera; Pathway have 22 stated that they will 'provide PACE statements as 23 necessary to support a fraud prosecution', but that 'the 24 work required to produce draft witness statements' is 25 not within the scope of the requirement and will be done 63 1 once POCL raise a Change Request." 2 So does that assist you at all in relation to this 3 particular AI? 4 A. I can read that, and my interpretation is that basically 5 Fujitsu was saying, yes, they will do it, but they want 6 paying for it each time it's requested. So it is not 7 part of the service that is included, but it would be 8 done under change control, i.e. the Post Office would 9 say, "We require a witness statement from you", and 10 they'd say, "Cost you £5,000, work order, change 11 request, please raise." Post Office would then raise 12 that and Pathway would then produce the witness 13 statement. That is my interpretation of what's there. 14 Q. So this effectively was a request being raised of 15 Pathway in the summer of 1999; that's correct, isn't it? 16 That is to say, the provision of a witness statement of 17 this type? 18 A. No, I'm reading that they're saying that the provision 19 of witness statements does not fall within the paid-for 20 service. Each witness statement that's required would 21 require separate payment. 22 Q. Forgive me, for this to arise as an Acceptance Incident 23 presumably -- 24 A. That would have been the disagreement, that Post Office 25 would have thought it was within the costed service, and 64 1 Pathway were saying, "No, it's an add-on", and I think 2 that, from reading this, would have been the element of 3 discussion about why it's an Acceptance Incident, 4 because Post Office were not getting from the service 5 what they thought was included. 6 Q. Indeed, but presumably having had oversight of this 7 Acceptance Incident, it was on your radar at the time 8 that Post Office Counters were expecting to obtain 9 evidence of this nature from Pathway in order to support 10 the prosecution or -- well, the investigation into and 11 potentially eventual prosecution of subpostmasters or 12 managers or clerks suspected of fraud. Is that a fair 13 inference to draw? 14 A. I had very little to no involvement in witness 15 statements per se. So it could easily have been 16 providing a witness statement to say that the person was 17 not guilty of a fraud -- 18 Q. Forgive me, I'm not suggesting you would have had 19 a detailed understanding of what a statement contained 20 or indeed whether -- 21 A. No, understanding that they provision for something 22 that's evidentially admissible, yes. 23 Q. You were aware of that at the time? 24 A. Yes, in terms of that context, but probably only to this 25 level. 65 1 Q. And that certainly part of the Post Office's 2 investigation and audit function was to enable these 3 prosecutions to be brought? 4 A. Yes. 5 Q. Now, it appears from this document that the part of the 6 Post Office with responsibility for this aspect was 7 known as the Security and Investigations Executive; is 8 that correct, do you know? 9 A. The only acronym I knew of them was POID, Post Office 10 Investigation Department. So the acronym, I'm not 11 familiar, but it makes sense. 12 Q. What, if any, liaison did you have with them? 13 A. I don't think I had any. It would have gone through the 14 security forum. 15 Q. Sorry, forgive me? 16 A. The security forum that we mentioned earlier, the fraud 17 risk management people were working, if you like, on the 18 human factors, the fraud risks, et cetera, and it would 19 have been that forum that would have taken such 20 considerations forward. 21 Q. Obviously, as the Acceptance Test Manager, you had 22 personal responsibility for the resolution of this 23 Acceptance Incident; that's correct, isn't it? 24 A. It is. 25 Q. In that role would you have liaised -- would you have 66 1 been liaising directly with either -- 2 A. I can't say who I was liaising with. But again, looking 3 at this, it wasn't a technical defect. This is about 4 a commercial arrangement. So, providing Post Office 5 were willing to pay, the service they were expecting 6 that would be included would be fulfilled, and that's 7 why it would be a low Acceptance Incident. There was 8 no -- from what I'm reading here, there was no 9 contention about production of witness statement. It 10 was purely about whether there was going to be an 11 additional charge from Pathway for that. 12 Q. I think, Mr Booth, what I'm trying to get to the bottom 13 of, if I perhaps make this a bit clearer, you were 14 obviously aware at the time of an Acceptance Incident 15 relating to data integrity society number 376, and you 16 were aware at the time of an Acceptance Incident 17 relating to the provision of witness evidence which was 18 number 370. 19 To your knowledge, were those in the fraud and 20 security group kept abreast of the variety of acceptance 21 incidents that were being dealt with, so those relating 22 to data integrity as well as, for example, those 23 relating to witness statements or those aspects more 24 directly concerned? 25 A. I don't know what other people were aware of, I'm 67 1 afraid, sorry. I wouldn't know how these matters were 2 propagated and who the audience and recipients were. 3 Q. Did you yourself communicate any of the concerns which 4 you previously articulated about accounting integrity to 5 those with whom you were liaising on AI 370, for 6 example? 7 A. Yes, anyone that -- if we are talking about a specific 8 AI, the audience for that would be fully aware of it. 9 So I'm afraid I don't quite understand the question. 10 Q. Sorry, forgive me. We established you were aware of AI 11 376 and the issues relating to data integrity. They 12 reflected concerns that you had previously articulated 13 in January 1999 in the report to which we referred. 14 A. Yes. 15 Q. We can see you also having oversight of an Acceptance 16 Incident relating to the provision of witness evidence 17 to support a prosecution. What I'd like to know is 18 whether you recall taking any steps to bring to the 19 attention of those who were dealing with prosecutions 20 the issues of which you were aware relating to data 21 integrity. 22 A. I would not have done that, no. 23 Q. You wouldn't have done that? 24 A. I don't think I would have, no. 25 Q. Why is that? 68 1 A. Because the Acceptance Incidents, the only involvement 2 in terms of the witness statement was the a commercial 3 one. It wasn't the provision or the underlying data 4 and, therefore, that wouldn't have been relevant to the 5 actual Acceptance Incident. 6 The security forum or, if you like, the people who 7 were X from the fraud risk management, would have had 8 other ways into the service, I believe, and other 9 liaison points. The focus was very much on each 10 individual Acceptance Incident and not widening it out. 11 It was trying to close it down rather than trying to 12 cascade it out and make it bigger. Does that make 13 sense? 14 Q. Yes, I think so. In relation to closure of AI 370, we 15 saw in the earlier plan for closure that one of the 16 avenues for closure was into the business service 17 management. Is it likely that AI 370 would be one of 18 the Acceptance Incidents that were resolved in that way? 19 A. It would have -- I think, in this instance I would have 20 guessed the natural home would have been more under the 21 commercial forum, because against commercial question 22 marks and technical deficiency. So it would have found 23 its way -- a baton passed to someone who I don't know. 24 Q. Thank you. Finally, Mr Booth, I would like to ask you 25 about a document that's been provided to the Inquiry by 69 1 Mr Folkes who was your manager at the time. It's 2 entitled the Horizon Brain Dump. I think you've been 3 provided with a copy of that document; is that correct? 4 A. I have, yes. 5 Q. That bears WITN05970123, please. 6 Have you had an opportunity to read this document? 7 A. I have. 8 Q. Do you recall whether or not you were shown a copy of 9 the document at the time it was produced? 10 A. I don't, but I suspect very much that I was because of 11 the relationship I had with Mr Folkes. 12 Q. There's a reference to you, Mr Booth, at page 23 of that 13 document. I wonder if we could bring that up, please. 14 Thank you. Under the heading C6.7 System Management, it 15 reads: 16 "ICL Pathway's ability to detect and manage 17 certain failures in the system is as yet somewhat 18 unproven; although we have assurances from Pathway on 19 a number of issues, evidence that failures would indeed 20 be detected and responded to (rather than just logged 21 and ignored). Will only come from live running. 22 "There are a number of scenario discovered through 23 the technical assurance work which gives examples of 24 possibly failures", which we can see listed there. 25 Then in brackets that bottom: 70 1 "Bob Booth is our expert in this area and has 2 access to the previous technical assurance work." 3 Does it follow from this that you were expected in 4 effect to carry forward the system management aspect 5 of -- 6 A. I think the intent here was the document was giving 7 pointers to the reader about, if you want more 8 information or if you have a concern where to go for 9 this, because the background of an involvement I had 10 previously, I would have been a primary contact. So the 11 document highlights that, if you want to know some of 12 the background, then drag out an incident at the time, 13 then I'd have been a good point of contact to explain 14 the background to it, what we'd done to resolve it, and 15 where we felt it was going at the time. 16 Q. Notwithstanding the formal resolution of AI 372 which 17 related to system management, did you share the concern 18 that Pathway's ability to detect and manage certain 19 failures remained unproven? 20 A. I think so, yes. It was more to action what they found. 21 The information sometimes was there but they were not 22 proactively looking for it. So, if you knew what you 23 were looking for, afterwards you could go and find it, 24 but they were not necessarily looking for defects that 25 were apparent. 71 1 Q. Why do you say that they weren't proactively looking for 2 it? 3 A. Because the majority of the defects, I believe, came 4 from the result of Post Office saying, "Something's not 5 working", rather than Pathway saying, "We've got a 6 problem here." 7 Q. Are you referring here to problems identified during the 8 live operation and trial and the acceptance process, or 9 are you referring more generally? 10 A. More generally. I mean, that was the start obviously, 11 when things would have been more under a microscope. 12 But as more and more users -- because you need to 13 realise that, if you test a system with a team of sort 14 of the 5/10 testers, you get 5 or 10 man-days. You put 15 it out to 300 branches as a live trial and there's three 16 people, you are getting a thousand man-days a day. So 17 the scale of exposure a system gets when you start 18 putting it out into the real world is far, far greater 19 than you get in a test environment. 20 We would get feedback from users, such as the 21 hanging, which were not really experienced because we 22 probably didn't do enough duration and leaving the 23 machine on long enough before a patch would occur to 24 a machine such that it would reboot and clear things. 25 But, when it was being used in the field, these were 72 1 being experienced. So again slight difference between 2 live and test. 3 Q. If I've understood you correctly, you remained concerned 4 even after acceptance and roll-out that ICL Pathway were 5 not doing enough to identify and detect faults in the 6 stem. Is that a fair summary -- 7 A. I think as the end customer, you always want your IT 8 supplier to be doing more. So yes, it is. Whether it 9 was really reasonable or unreasonable, I think that's 10 a hard call. I don't think that Pathway -- I think 11 Pathway could definitely have done more. How much more 12 is questionable before it becomes an onerous task with 13 very little return. 14 Q. Did you articulate your ongoing concerns to others 15 within Post Office Counters Limited? 16 A. I think that everyone was aware that the amount of 17 information we were getting out and the amount of 18 benefit of raising those things was a lost cause. It 19 was very much the contractual boundaries were set, and 20 that's the rules that ICL Pathway were playing to. 21 Q. Thank you, Mr Booth. I have no further questions for 22 you but there will be some questions, I believe, from 23 the representatives of other core participants. 24 SIR WYN WILLIAMS: All right. Who is first up? 25 MR JACOBS: Sir, I think it's me, Mr Jacobs. 73 1 Questioned by MR JACOBS 2 Q. Mr Booth, I ask questions on behalf of 153 3 subpostmasters who were dismissed, prosecuted, sued and 4 lost their reputations as a result of the actions of 5 Post Office. 6 In your evidence today you have made it clear that 7 as a result of the contractual boundaries between 8 Pathway and Post Office and as a result of Pathway's 9 attitude -- and you have said that Pathway said, "Why 10 are you asking questions? This is taking up too much 11 time. We're the professionals here", and you said that 12 the Post Office were hindered by a lack of access to 13 technical details from Pathway. Is that a correct 14 summary of your -- 15 A. That's correct, yes. 16 Q. -- evidence? What my clients want me to ask on their 17 behalf is: do you accept, looking back and from what you 18 knew at the time, that the Post Office didn't have 19 anywhere near enough visibility and knowledge of the 20 system to dismiss, pursue and prosecute my clients for 21 these alleged shortfalls that arose? 22 A. I don't know any of the circumstances of the 23 prosecution. So I'm afraid I can't comment on that. 24 Q. But your evidence is, I think it's right to say, that 25 Post Office didn't have sufficient, from your 74 1 perspective, knowledge and visibility of the system that 2 Pathway had developed. 3 A. The degree of technical exposure was not enough to give 4 the level of assurance before putting the system live 5 that I would have liked. The method by which we gained 6 confidence was by putting it live, and we would rely 7 upon ICL Pathway for technical statements and for 8 technical information. We would not be -- or would not 9 be able to speak authoritatively ourselves about it. 10 Even though we would have a good shape at a high level, 11 we would not be able to know at a low level the detail, 12 and that would be within the ICL Pathway domain only. 13 Q. Your evidence is you didn't know the low-level details 14 in relation to the system. 15 A. Correct. 16 Q. Do you consider then with the benefit of the hindsight 17 that the postmasters ought to have been given the 18 benefit of the data by Post Office before being pursued? 19 A. Again I don't know any of the details of individual 20 cases, and can only say that anything that should 21 have -- anybody who's being prosecuted should have the 22 same access as the prosecutor, that any evidence that 23 was available should have been made available, be that 24 from the Post Office or be that from the IT supplier who 25 does have access to it. 75 1 Q. In light of what you know and what you told the Inquiry, 2 how do you feel about the way the subpostmasters were 3 treated? 4 A. From a personal view appoint even just having to give 5 a witness statement, it's traumatic. So on a human 6 level, it's traumatic. I have seen some of the 7 statements. It is not good news. It's just not good 8 news. 9 MR JACOBS: Thank you. I don't have anything else. 10 SIR WYN WILLIAMS: Anyone else? 11 Questioned by MS PAGE 12 Q. Ms Page, on behalf again of a group of the 13 subpostmasters, and I've got two areas that I'd like to 14 ask you about, please, Mr Booth. The first relates to 15 your witness statement and paragraph 30. I don't think 16 we need to call it up. I will read it out and go from 17 there. 18 You said, when the Benefits Agency withdrew from 19 Horizon, there was no substantive change in your role of 20 being a point of contact for Fujitsu and reviewing the 21 Fujitsu documents. But then you said: 22 "The main difference was that I felt that my views 23 were given more weight as any concerns I raised would be 24 moderated by Post Office as opposed to Benefits Agency 25 where the single Benefits Agency product outweighed the 76 1 needs of all the POL products." 2 So, in other words, what you were saying was that, 3 before the Benefits Agency dropped out, their single 4 need this is need to have benefits paid through the 5 Horizon System, was absolutely pre-eminent. 6 A. It had undue weight, in my opinion. The Post Office had 7 180/190 products. Benefits Agency was one of them. The 8 Benefits Agency made it very clear in their day-to-day 9 workings beside us as colleagues that they viewed us, 10 the Post Office, as the junior partner and that it was 11 only because the Benefits Agency was there that the 12 automation was occurring. 13 Where effort was to be expended, the pressures 14 from the two contracting authorities, one who had one 15 product, one who had 180, it wasn't 180 to 1, it was 16 more sort of 1 to 1. 17 Q. The other way round? 18 A. The Benefits Agency was one of the prime contractors; 19 therefore, their interest had to be served. 20 Q. So when they dropped out and Pathway still had to 21 develop a system that would manage your 180 products or 22 thereabouts, they were suddenly doing so on a highly 23 contracted timescale, weren't they? 24 A. I can't recall but probably, yes. 25 Q. May '99 was when Benefits Agency dropped out and you 77 1 were rolling out that year going into the following 2 year. 3 A. They would have been working on it before that. It was 4 just not necessarily concentrating on it exclusively. 5 They would have been having resources working on the 6 Benefits Agency product as well as the Post Office 7 products. 8 Q. Can I just ask, please, for Mr Cipione's report to be 9 pulled up. This is the second area that I want to look 10 at, please, and it's EXPG0000001, and if we go to 11 page 118, please. 12 If we scroll down to 7.1.5, I'll just read a few 13 paragraphs out, please, and it starts: 14 "In November 1999, at least one full month and 15 possibly two full months after acceptance was granted, 16 ICL Pathway reported that 'POCL have come round to the 17 understanding that dead with residual AI 376 concerns in 18 the short to medium term will rely on processes and 19 tools but no new software features as such." 20 "In January 2000 ICL Pathway states, 'If pressed 21 POCL would agree that AIs 342, 372, 376, 378, 218, 391 22 are closed/incapable of further update. Their 23 acceptance manager is leaving the project at the end of 24 February.' Further, in the same report it states, 'The 25 outturn on AI 376 was 0.06 cash account discrepancies, 78 1 exactly an order of magnitude better than the target. 2 Under this activity, John P made significant 3 contributions to the third supplemental agreement, 4 specified the committed CS repair facility, aligned the 5 operating agreement on reconciliation to support the 6 contract, sorted out the necessary PinICLs to clear. 7 "In February 2000, ICL Pathway declared that the 8 POCL acceptance manager had left the project and 9 transferred the residual actions to 'business as 10 usual'." 11 Then this is Mr Cipione's comment on that: 12 "It is unclear to me what exactly took place to 13 close AI 376. The reading of these entries leaves much 14 room for interpretation." 15 So those paragraphs you wouldn't have seen, of 16 course, the ICL Pathway reports but that's their take on 17 what's going on to close AI 376. Mr Cipione says, in 18 conclusion, it's entirely unclear to him what actually 19 happened to close AI 376 and, indeed, when he looks at 20 those management reports from Pathway, what we see is 21 terminology that is rather concerning, is it not? If 22 pressed, POCL would agree that certain IA's are closed. 23 POCL have come round to the understanding that they are 24 not going to get any new software features. 25 Was POCL really under the cosh here from Pathway? 79 1 Were you just accepting their desire to get things 2 rolled out? 3 A. No, no, no, I don't have first-hand knowledge of this 4 but I disagree with the tone. I'd say it was very much 5 internal ICL positioning rather than necessarily the 6 facts on the ground. 7 Q. What about this sort of suggestion that it's not at all 8 clear how AI 376 was concluded? Can you tell us how it 9 was concluded? 10 A. I can't comment on that. I don't know. 11 MS PAGE: Thank you. 12 MS HODGE: Thank you, sir. Unless you have any questions 13 for the witness, that concludes the evidence of 14 Mr Booth. 15 SIR WYN WILLIAMS: No, I don't have any questions. 16 Thank you, Mr Booth, for making a detailed witness 17 statement and for coming to the Inquiry to give 18 evidence. I'm grateful. 19 A. Thank you, sir. 20 SIR WYN WILLIAMS: Where do we go from here Ms Hodge? 21 MS HODGE: Our next witness is Mr Meagher, I believe -- 22 forgive me, "Mar" is the correct pronunciation. 23 I understand he arrived only a short time ago and may 24 wish to have a brief consultation with Counsel to the 25 Inquiry. 80 1 SIR WYN WILLIAMS: I mean, I think the only issue is whether 2 we take our lunch break now. 3 MS HODGE: If you would be content to, we certainly would be 4 happy to rise early and return early. We're in your 5 hands. 6 SIR WYN WILLIAMS: All right. So it's now ten past, or 7 thereabouts at least, 12. If we started again at, say, 8 1.20, would that give time for everybody to have lunch 9 and for Mr Meagher to have a chat with whomsoever he's 10 going to speak? 11 MS HODGE: I'm sure that will be sufficient. Thank you. 12 SIR WYN WILLIAMS: All right. We will start again at 1.20. 13 (12.10 pm) 14 (Luncheon Adjournment) 15 (1.20 pm) 16 SIR WYN WILLIAMS: I can't hear you, if that's what you 17 asked me, Mr Stevens. 18 MR STEVENS: Mr Stevens. It is, yes. 19 SIR WYN WILLIAMS: I can hear you now. 20 NEW SPEAKER: Mr Stevens. If I may call Mr Meagher. 21 JOHN DOMINIC MEAGHER (affirmed) 22 Questioned by MR STEVENS 23 Q. As you know, my name is Sam Stevens and I ask questions 24 on behalf of the Inquiry. Please could I ask you to 25 state your full name. 81 1 A. John Dominic Meagher. 2 Q. Thank you for giving evidence to the Inquiry today. 3 There should have been a bundle of documents in front of 4 you. The start of which should be a witness statement 5 dated 13 September 2022. 6 A. Yes. 7 Q. Firstly, can I just ask you please to turn to page 18. 8 A. Yes. 9 Q. You should see your signature there. Is that your 10 signature? 11 A. That's mine, yes. 12 Q. Now, I understand if you now turn -- sorry, if I could 13 ask you to turn to page 5, paragraph 10 -- 14 A. Yes. 15 Q. -- you in your statement speak about the Logistics 16 Feeder Service, and I understand you want to clarify 17 what you say in that paragraph. 18 A. Indeed. When I was first asked a question, I had more 19 or less forgotten about the logistics feeder system 20 which came in very much at the end, and I went -- 21 mentioned some things about the reference data system. 22 So there is confusion in that statement based on that. 23 So the logistics feeder system, I was asked about late 24 stage changes to that system, and the answer is that 25 I don't know. I can't remember what the reason for 82 1 those changes were, but the logistics feeder system had 2 been put together in a much more formalised way than 3 reference data and was in no way compatible. It was a 4 relatively straightforward system that had been well 5 documented and, from my recollection, worked fairly 6 well. 7 Q. So are you distinguishing two systems, on the one hand 8 reference data system and, on the other hand, the 9 logistics feeder system? 10 A. Correct. 11 Q. And you have no criticism of the logistics feeder 12 system? 13 A. Correct. 14 Q. Thank you. With that clarification, are the contents of 15 your statement true to the best of your knowledge and 16 belief? 17 A. They are. 18 Q. That statement now stands as evidence in the Inquiry. 19 I am going to ask you some questions about it but not 20 all aspects of it. I'd like to start with your 21 background. 22 You joined the Post Office in 1990 following 23 a career in the oil and gas industry? 24 A. Correct. 25 Q. Did you have experience of managing large IT projects 83 1 before you moved to the Post Office? 2 A. Yes, I did. I've been involved in a number of -- when 3 I was in the oil industry, we'd been moving into the use 4 of computer systems both in terms of planning, project 5 management, and also the support services offshore. I'd 6 also worked on the development of the FirstDirect Bank 7 and on the privatisation of the central electricity 8 generating board, which essentially was an IT project, 9 because all of their previous systems had to be split up 10 for the individual component companies that were created 11 during that de-merger. 12 Q. You applied to join the Horizon project in 1994 -- 13 A. Roughly. 14 Q. -- around then, and you assisted with the procurement 15 exercise that led to ICL Pathway being selected? 16 A. Yes, I first of all worked on the evaluation of the five 17 potential suppliers, and then into the demonstrator 18 phase where we finally chose ICL Pathway. 19 Q. I want to move ahead a bit in the timeline, actually, 20 and speak about you being the head of Horizon product 21 assurance. 22 A. Yes. 23 Q. In your witness statement you say that you started that 24 role not long after the contract with ICL Pathway was 25 signed. 84 1 A. Correct. 2 Q. In your own words, what did you see your role to be as 3 head of, sorry, Horizon product assurance? 4 A. I saw the role as one whereby we would ensure that the 5 emerging solution was compliant with the requirements 6 and we would assist ICL Pathway to that end. 7 Q. When you say the requirements, do you mean the 8 requirements that were drafted as part of the PFI 9 tendering process? 10 A. Yes, the contracted requirements. 11 Q. You weren't involved in drafting those requirements? 12 A. I didn't draft any requirements. I didn't have specific 13 business knowledge. I'd worked on a couple of projects 14 in the Post Office. So I was aware of the roughly what 15 they did but I was not someone who could have drafted 16 a requirement. 17 Q. Once they had been drafted, though, did you read those 18 requirements? 19 A. Oh, yes, yes, I read them all. 20 Q. So you could carry out your role, yes. You refer in 21 your statement to a technical assurance team led by 22 Jeremy Folkes? 23 A. Yes. 24 Q. Did Mr Folkes report to you? 25 A. Well, at various stages we had sort of different 85 1 reporting lines. They were never massively structured. 2 I know that during the demonstrator phase he was 3 responsible for the technical, the POCL technical team, 4 and I was responsible for the POCL applications team. 5 Subsequently, I remember it more as working together 6 rather than there being a strict reporting line but it's 7 possible. 8 Q. Just so we're clear, how would you distinguish your 9 roles? You say him on the technical side and you with 10 the application side. 11 A. Well, on the application side we focused on the 12 applications, EPOS automated payments, OVSC, et cetera, 13 whereas the technical people looked that nuts and bolts, 14 the network, the boxes and the plumbing. 15 Q. Who did you report up to in your role? 16 A. Well, I remember -- I mean, initially I think I reported 17 to Andrew Stott who was in charge of the PDA up until 18 the award. He was from the Benefits Agency. Then Peter 19 Crahan headed up the PDA he was also from the Benefits 20 Agency and then at some stage I reported to Dave Miller 21 who was from the Post Office. 22 Q. So you reported you say to Dave Miller. Did you ever 23 have a direct report to Stuart Sweetman? 24 A. No. 25 Q. In paragraph 12 of your statement you discussed the 86 1 Initial Go Live pilot in 1996. 2 A. Yes. 3 Q. You say that this: 4 "... distracted from the primary objective and 5 wasted valuable time and resources." 6 Do you consider this to have had a long-term 7 impact on the programme, this diversion of resources? 8 A. Well, there was a lot of resource allocated to this, and 9 to my recollection very, very little of what was put in 10 place there was subsequently used as part of the 11 operational system. It had to my mind it had a PR 12 objective. It could very well have been successful in 13 that area, but I thought it took away attention and 14 resources from the thrust of developing the main 15 solution. You know, whether it had a detrimental effect 16 overall in the timescales, I couldn't say. It 17 definitely didn't have a positive one. 18 Q. You refer in your statement as well at paragraph 13 to 19 a PinICL assessment team? 20 A. Yes. 21 Q. Which you say: 22 "The purpose of the PinICL Impact Assessment Team 23 was to judge if it was possible (i.e. was the business 24 impact acceptable?) for fixes to known faults to be 25 either deferred or temporarily managed through 87 1 a 'work-around'." 2 A. Yes. 3 Q. For how long did that team exist? 4 A. Well, the process existed right through. Exactly who 5 managed it on the ongoing basis, I don't know. But, 6 I mean, there's always such a process involved. I mean, 7 it's beneficial for the developer if they don't have to 8 fix every little problem regardless of its business 9 impact. So that was put in place. I can't remember 10 when but I know -- you'll see references to it right 11 through to the start of roll-out. 12 Q. Were you involved with that team? The material you were 13 assessing, were you actually seeing PinICLs themselves 14 being handed to you? 15 A. Yes, yes, I didn't personally, but people who worked for 16 me and other people reviewed PinICLs, and that was the 17 assessment they made based on the PinICL, whether the 18 impact was such that needed to have a software fix, or 19 whether it could be handled in a work around. 20 Q. Were the PinICLs provided to Post Office or did anyone 21 from Post Office have any access to the actual PinICL 22 system itself? 23 A. I'm honestly not sure. We were -- whether we were 24 presented with printed PinICLs or whether we had access 25 to the system I'm not sure. I don't remember having 88 1 direct access to the PinICL system. I think we were 2 consulted on PinICLs as they emerged. 3 Q. You mentioned it in your oral evidence and in your 4 statement, this managing through workarounds. Was there 5 a wider ethos in the programme to try to manage faults 6 through workarounds rather than directly through fixes? 7 A. No. No, I mean, it's a common practice. I mean, you 8 know, if there's -- I don't know -- a misspelling on 9 a script or something, the developer will say, "Look, 10 can we defer that to later, because we need to get on 11 with more important things." 12 Q. I'd like to now actually bring up a paragraph from your 13 statement. The reference is WITN04150100 and it's 14 page 10, paragraph 19. 15 I think four lines up it starts saying: 16 "Early in the project the assurance team attempted 17 to gain access to Pathway's application design documents 18 to (a) provide POCL confidence that the development was 19 proceeding in accordance with the requirements and (b) 20 to assist Pathway with early identification of any 21 misunderstanding or errors they were making in their 22 interpretations. Pathway did not co-operate with this 23 request and due to the PFI nature of the contract we 24 were unable to insist." 25 How did you feel this lack of visibility of design 89 1 documentation impacted on the assurance process? 2 A. It undermined it. 3 Q. In what way? 4 A. It meant that we had less evidence upon which to perform 5 our job. 6 Q. At the time, what did you think was the reason for the 7 lack of transparency? 8 A. Well, we had understood that -- and I've got no evidence 9 necessarily for this but this was our understanding -- 10 we'd been invited by Terry Austin to participate in what 11 he called joint working, because of pressure of 12 timescales. 13 We had a large team down in Feltham, about a dozen 14 people, some of which were involved in the Benefits 15 Agency application, some of which were involved in the 16 POCL applications, providing clarifications to Pathway. 17 We had a number of workshops with Pathway on the 18 clarification of the applications, but we had nothing 19 upon which to judge their interpretation of what was 20 being said at these workshops. 21 What was your question again? 22 Q. The question was, at the time, what did you think was 23 the reason for the lack of transparency? 24 A. Well, I believe they didn't have it. They didn't 25 have -- we suspected that there was no written design. 90 1 Q. We're very much in the context of the PFI contract at 2 this time. Do you think that the Post Office did all it 3 could to obtain such documentation? 4 A. Well, I don't know. I mean, I escalated this repeatedly 5 within the PDA. You'll see references to it through '98 6 and '99. In the end, or toward the back end, there's an 7 action on me to draft a letter for Dave Miller to give 8 to Stuart Sweetman, but of course by that time it's too 9 late. You know, I don't know to what extent the Post 10 Office pressed Pathway hard. I witnessed more pressure 11 from the Benefits Agency on Pathway than I did from the 12 Post Office. 13 Q. The Inquiry has heard evidence in the last few weeks 14 that ICL Pathway created something called an EPOS 15 task-force. 16 A. Mmm. 17 Q. Have you been -- have you heard about that in the 18 hearings so far? 19 A. Yes. 20 Q. That task-force was implemented to resolve, identify 21 defects in the application the EPOS application between 22 August and September 1998 which -- 23 A. '98? 24 Q. Yes '98 -- which were being raised faster than they 25 could be cleared. The task-force was unable to fix all 91 1 those defects at that point, and it reported significant 2 concerns about the quality of the EPOS application code. 3 A. Yes. 4 Q. Were you aware that ICL Pathway had created such a group 5 in '98? 6 A. No. 7 Q. When was the first time you became aware of that? 8 A. When I heard it on -- from this forum from one of the 9 witnesses; I can't remember which one. 10 Q. The Inquiry has also heard evidence that employees 11 within ICL Pathway made recommendations to rewrite or 12 redesign the EPOS application in '98 and '99. Were you 13 aware of those internal recommendations? 14 A. No. 15 Q. If you had been aware either of the task-force or of the 16 recommendations to rewrite the EPOS application, would 17 that have changed your approach either to assurance or 18 acceptance? 19 A. Well, I probably would have raised a high-level 20 Acceptance Incident and it would have, I believe, given 21 us more evidence upon which to press the further for 22 a change of approach within Pathway to EPOS. 23 Q. Could I ask for a document to be brought up, please. 24 The reference is POL00028370. Could we turn to page 9. 25 Thank you. Please could we focus on -- sorry, one page 92 1 up, I think. Sorry, could we have page 9 please. There 2 we are. Thank you. 3 So this is a Programme Risk Status report. You 4 see from the top right it's dated 8 March 1999 and the 5 first risk there says owner and your name. The 6 description says: 7 "Due to lack of adequate visibility of the ICL 8 Pathway design, and the lack of support from the 9 contract to leverage the visibility, we have been unable 10 to gain a high level of assurance in the adequacy or 11 suitability of the service to support the POCL business. 12 POCL therefore risks the implementation of a service in 13 Live Trial and beyond, which will have negative 14 operational impacts, resulting either in a level of 15 service degradation or delay to the start of National 16 Roll-Out." 17 These are the concerns we've just been discussing. 18 It's apparent in your view that continued in March 1999? 19 A. Yes. 20 Q. You state in your witness statement -- and we've 21 discussed it -- that the lack of transparency was blamed 22 on the PFI nature of the contracts. Did anything change 23 once the contractual relationship shifted from PFI to 24 a more traditional basis? 25 A. Nothing in this respect. 93 1 Q. Do you know if -- you may have already sought to answer 2 this earlier but just so I'm clear I've put the question 3 to you -- do you know if the Post Office took steps to 4 address the lack of transparency when changing from the 5 PFI basis to the codified agreement in the summer of 6 1999? 7 A. I've no understanding of anything having happened. 8 Q. Please could we turn the page on this document. I want 9 to now look at the 0069 row. That says: 10 "Type B procedures in place for live trial, in 11 particular Cash Account, are insufficiently robust to 12 support consistency between RDP, Pathway and TIP. 13 "Risk that cash accounts will not balance, 14 rejections wills occur on the Pathway and TIP interfaces 15 and problems will occur on POCL back office systems." 16 Do you recall what type B procedures were? 17 A. I'm afraid I don't. 18 Q. In summary, does this show that the Post Office were 19 aware of a real risk that Horizon would fail to balance 20 satisfactorily in February 1999? 21 A. All the indications were that that was going to happen. 22 Q. How well known was that amongst the people working on 23 the project at the time? 24 A. Everyone knew that. 25 Q. Can you assist us in interpreting the Action in 94 1 Mitigation column. Firstly it says: 2 "Ensure procedures are tested 'end to end' after 3 completion of the E2E and MO ..." 4 That's end to end and model office testing? 5 A. Yes. 6 Q. What was that first mitigation plan; can you recall? 7 A. Well, frequently the path into some of these test 8 phases, particularly model office, is often through the 9 procedures, because the model office test phase was 10 designed not -- it wasn't simply a technical test, it 11 was designed to test the system, but also the 12 interaction between the system and the user and the 13 procedures that the user had, okay? 14 So -- which is what I suspect the type B may be, 15 an earlier stage of approval of those procedures. 16 I think that's what's being referred to here. Does that 17 make sense? 18 Q. It does. Thank you very much, yes. 19 That document can be taken down, thank you. 20 Could we bring up back up your witness statement 21 it's WITN04150100, page 16, please. Paragraph 29 four 22 lines down you say -- I should say for context you are 23 referring to a question about external pressure, whether 24 there was any external pressure to cancel, not to cancel 25 the contract, and you say: 95 1 "Indeed, I recall a meeting chaired by Dave Miller 2 some time in 1999, probably in the early part of the 3 Dave's tenure, when he canvassed views at his team 4 meeting on whether we should persist with Horizon or 5 cancel, and I voted to cancel as did my other staff 6 member colleagues: Jeremy Folkes and Jan Topham. 7 I recall there were others but their names now escape 8 me." 9 At that stage what were your reasons for wanting 10 to cancel the project? 11 A. Well, I thought it was what is called a sunk-cost 12 fallacy which is that you continue to pour effort into 13 something that's inevitably failing and, instead of 14 being able to cut your losses, you end up losing 15 everything. I felt we were on a death march, and I 16 didn't see it ending well. I had seen the Benefits 17 Agency exit. I thought there were better ways to do 18 this and definitely not the way we were doing it. 19 Q. I think you used the words you were under a death march. 20 Did you have any confidence in ICL Pathway's ability to 21 improve the situation to a level which would be 22 satisfactory for acceptance at this stage? 23 A. Well, it was going to be difficult. I mean, one assumed 24 that they'd get over the line in some way at some stage. 25 The question was when and at what cost. 96 1 Q. I want to turn to look at where we get to, because we 2 know that the system is eventually accepted and there is 3 a process of acceptance from this stage. So if I could 4 firstly bring up document POL00028367 and page 2, 5 please. This is a record of the fourth meeting of the 6 acceptance board and you are described there as the 7 Horizon acceptance manager chairing it. Could you just 8 describe your role as the Horizon acceptance manager. 9 A. Okay. Well, the role of the Horizon acceptance manager 10 was to first of all negotiate the Horizon process. So 11 to obtain agreement from all of the different parties, 12 to obtain agreement on the acceptance specifications, 13 and then to ensure that that process was operating. 14 So it was a process responsibility rather than 15 being responsible for the content of each of the 16 acceptance specs. 17 Q. Thank you. Could I turn to page 5, please, of this 18 document which should be the Acceptance Board terms of 19 reference. The second bullet point under Purpose, it 20 says: 21 "To submit appropriate Acceptance recommendations 22 to the managing director of POCL for endorsement." 23 Was that your role, to report directly to 24 Mr Sweetman at this stage, or was that someone else's? 25 A. No, that would have been through Dave Miller. 97 1 Q. Thank you. That document can be brought down now. 2 We've heard evidence that ICL Pathway and the Post 3 Office subsequently entered the codified agreement on 4 28 July 1999. Were you involved in the negotiation of 5 any of which contractual terms? 6 A. No. 7 Q. In your statement you refer to disagreements between 8 Pathway and the Post Office over how to classify the 9 severity of acceptance issues, and the inquiry has heard 10 evidence of Acceptance Incidents being classified as 11 high, medium and low. Does that reflect your 12 recollection? 13 A. Yes, indeed. 14 Q. At the time what was your view of what a high severity 15 incident was? 16 A. Well, I think we had a definition for it, and -- 17 Q. If it assists, the definition was defined as a failure 18 to meet essential acceptance criteria. 19 A. Yes. 20 Q. In sort lay terms of how you would interpret that, what 21 would that be? 22 A. Well, I think there was a danger with acceptance that -- 23 number 1, that acceptance could be interpreted as being 24 that the system was, that everything was rosy. You 25 know, you could -- in fact, I think -- I'd have to defer 98 1 to someone on the contract side, but I think, for 2 instance, if we didn't raise Acceptance Incidents during 3 the allocated period, then acceptance was by default. 4 So it was incumbent on us to raise Acceptance Incidents, 5 and the severity was something that was frequently 6 discussed. 7 A high Acceptance Incident would be something that 8 would have an across-the-board impact on customer 9 service, on the integrity of the data, those types of 10 issues. So if the -- in fact, I mean, I can give you no 11 better definition really than, if you refer to the three 12 high Acceptance Incidents that remained to the end, one 13 focused on the ability of the users to understand the 14 system, one focused on the stability of the technical 15 solution, and the other one focused on the integrity of 16 the data. 17 So those three Acceptance Incidents, which in a 18 sense were portmanteau Acceptance Incidents because 19 there were multiple reasons and causes for them, are 20 a good way of defining or understanding what 21 a high-level Acceptance Incident would be. 22 Q. We will come to those in due course. 23 Could I please bring up your witness statement 24 again. It's WITN04150100 and page 13, paragraph 23. 25 One thing you say is: 99 1 "Pathway would invite Post Office to accept that 2 elements of an acceptance spec had passed or had 3 exclusions, i.e. issues that were understood and did not 4 present a significant business impact and could 5 therefore be parked for later attention." 6 When you refer to exclusions here, are you 7 referring to the classification of the severity of the 8 Acceptance Incident? 9 A. Yes. 10 Q. And you go on to say that: 11 "There was always disagreement on this impact 12 assessment because Post Office always had correctly 13 reviewed the business and operation impact ..." 14 Just pausing there, could you just explain the 15 process by which Post Office would arrive at 16 a classification for an Acceptance Incident. 17 A. Well, these incidents would frequently have been 18 pre-allocated a severity by Pathway, a pathway, and then 19 the Post Office would read those, understand them, 20 discuss them, and come up with its own view. 21 Q. Would you be involved in that process? 22 A. Yes. 23 Q. Please could we bring up POL00043699. This is an email 24 from that you sent to Keith Baines on 5 August, and the 25 first paragraph says: 100 1 "Initial results from the exercise of identifying 2 additional acceptance criteria to our existing 3 acceptance incidents indicates that there is an 4 opportunity for additional criteria to be added and 5 therefore potentially additional acceptance incidents to 6 be generated." 7 Do you recall what the exercise you're referring 8 to here is? 9 A. I don't exactly, but I think what I was probably 10 thinking is that there was a risk that we wouldn't see 11 the wood for the trees; in other words, that the 12 acceptance criteria by definition were broken down to 13 a low level of detail and if, you know, one could pass 14 or one could fail. If one failed, it may not be clear 15 how that incident was connected to other features of the 16 system. 17 We were trying to get a better understanding how 18 these incidents were impacting in a broader sense. 19 Q. If we carry on it says: 20 "Taking acceptance incident 211 -- one where we 21 expected additional criteria to be available -- we have 22 now matched the incident to five criteria. Whilst in 23 theory this could therefore result in five incidents, 24 the risk we run if we were to split the incident in this 25 way is that we then reduce the severity of the incidents 101 1 from a Medium to a Low." 2 A. Yes, that's what I was just discussing. 3 Q. So following this exercise, was there any change of 4 strategy as to how the Post Office would raise or 5 categorise Acceptance Incidents? 6 A. Well, the -- we initially did not have access, for 7 instance, to the incidents that were being raised by 8 Pathway from the help desk. We sought and did achieve 9 access to those incidents. So, in reviewing incidents 10 say from the help desk, you can look for patterns. In 11 fact 298 is a good example of that, where you can -- you 12 know, whereas one incident in and of itself may seem 13 inconsequential, if you can see patterns of similar 14 incidents, you may be able to identify a more systemic 15 problem. 16 Q. If you could turn this is page, please, there should be 17 a list of Acceptance Incidents, and it records both 18 Pathway and the Post Office's position before and after 19 what's described as a tranche 2 workshop. There are 20 a number -- the first two is an example -- where Post 21 Office's initial severity rating before the workshop was 22 high/medium, and it becomes a medium after the workshop. 23 Can you recall why it seems Post Office 24 consistently after its workshop ranked the Acceptance 25 Incident in the lowest or the medium severity? 102 1 A. Well, it's possible that we understood it better, and 2 also that Pathway will have brought forward 3 rectification plans or better explanations that the 4 problem could be contained. 5 Q. And did you find these initial tranche workshops to be 6 satisfactory in the sense of did you have a good working 7 relationship with ICL Pathway during them? 8 A. Well, the working relationship was robust amongst most 9 people on the PDA with Pathway. We've been on this 10 a long time. But the workshops were constructive, you 11 know -- full and frank, as the phrase goes, exchange of 12 views. 13 Pathway did treat acceptance very seriously for 14 commercial reasons, and other reasons -- I don't want 15 to -- I don't want to cast aspersions on their motives. 16 They treated acceptance very seriously. There was 17 a lot of effort and immediate effort on Pathway's part 18 to bring forward rectification plans. John Dicks, 19 I think, was very active. We'd known him from the early 20 stage of the project, and he brought forward a lot of 21 rectification plans to show that they understood it, 22 could deal with it. 23 Q. We will come to look at some of those in relation to the 24 three Acceptance Incidents you have described. Before 25 we do that, could I please ask for POL00028357 to be 103 1 brought up and page 16, please. This is an Acceptance 2 Incident form, this one for 298, one of the 3 high-severity incidents we discussed. 4 Do you recall using these forms, the pro forma 5 form? 6 A. I don't recall it but I recognise it. 7 Q. Do you recall who had access to the information within 8 these forms? 9 A. I don't remember anything around the distribution. 10 I mean, I think they were fairly commonly available. 11 Q. This one concerns the screen lock-ups and screen 12 freezes? 13 A. Yes. 14 Q. The dates it says first observed is 1 July 1999. Would 15 you have been made aware of this around that time? 16 A. Yes. 17 Q. Who would you have reported that issue to? 18 A. Dave Miller. 19 Q. Please can we turn to page 57 of the document. This is 20 for 376, which I know the Inquiry has heard evidence on, 21 and I believe you referred to it earlier. It is issue 22 of data integrity. 23 A. Yes. 24 Q. You recall this Acceptance Incidents? 25 A. Oh, yes. 104 1 Q. At the top again it says the date this was observed was 2 19 July 1999. Again would you have been aware of this 3 around that point? 4 A. I would have, yes. 5 Q. Again, would you have reported that to David Miller? 6 A. Yes. I mean, these types of incidents would have been 7 well known by most people on the programme. 8 Q. When this one arose, 376, did you think -- was it 9 immediately obvious that this was a serious concern? 10 A. Absolutely. 11 Q. If you could bring that document down, please, and if 12 you could bring up POL00028332, page 2, please. This, 13 you see, is a Horizon programme management resolution 14 meeting. You are listed to be in attendance. Do you 15 have any recollection of it? It's on 12 August 1999. 16 A. No. 17 Q. Please could we just pull the screen down a little bit. 18 There should be a list of -- there we go, thank you. It 19 shows a list of Acceptance Incidents was discussed, 20 including the ones you referred to, 376, 218 for 21 training, and 298. Please could we turn the page. 22 Sorry could we go to the next page under 376. My 23 apologies. 24 No, sorry, back a page. Sorry, my apologies. And 25 can we go back a page again, sorry. There we are thank 105 1 you very much. That's great, thank you. 2 So under 376, JD is that John Dicks? 3 A. I'm not sure. I can't remember who the attendees were. 4 Q. Can we go back to the attendee list, please, on the 5 second page. 6 A. Yes, that will be John Dicks, yes. 7 Q. Then back on to the following page, please, at the 8 bottom: 9 "Pathway recognise that not all transactions have 10 been harvested and sent to TIP. A provisional fix went 11 in on 2 August and this has worked satisfactorily so far 12 with the effect that all records had been sent. 13 A root-cause analysis has been developed, identifying 8 14 contributory problems, and all but one has been 15 diagnosed and tested in Pathway to date. Pathway cannot 16 guarantee, however, that all problems have been trapped. 17 They will need to see evidence from the fix of the 8 18 known problems, and will continue to monitor the problem 19 for three months to be confident of its resolution. 20 "The provisional fix and the control procedures 21 developed allow Pathway to identify any errors, to patch 22 the file, and to notify TIP in advance. Since 23 implementation there have been no errors to report and 24 hence Pathway contend that the action taken to date and 25 the result they have observed justify the downgrading of 106 1 this incident." 2 If we could go over the page, please -- that's 3 fine, thank you -- the second paragraph down says: 4 "Pathway believe they have made sufficient 5 progress to rate as low. POCL believe they must have 6 the opportunity to verify the fix. 7 "Pathway pointed to the fact that no new errors 8 have occurred since 2 August. POCL believe they cannot 9 downrate until their own observation can be performed 10 given the risk to the accounts. They recognise the 11 corrective action that has been taken, but the potential 12 size of errors that can occur is too serious to risk 13 proceeding without proof, which will not be available 14 until 30 August. Advice from the POCL external auditors 15 was that without clear verification of the success of 16 the solution there would be implications on the 17 qualification of Post Office Limited accounts." 18 So is it a fair summary at this point that Pathway 19 have said, "We've got a resolution or rectification plan 20 and wanted a downgrade", but Post Office were saying, 21 "Well, let's see that proved"? 22 A. Yes. 23 Q. At this stage, what, if any, discussion was there 24 internally in Post Office about what would constitute 25 a successful fix of this? What level of errors would 107 1 represent a successful fix? 2 A. Well, there was agreement, I think, between the two 3 acceptance meetings -- so, on the first acceptance 4 meeting, Pathway did not achieve acceptance. I think 5 that was in August, and then they had a cure period or 6 whatever it was called, and then there was a further 7 meeting in September. 8 Q. Yes, and we'll come to that. Sorry, just to be clear, 9 my question is at this stage in August -- 10 A. I don't think there was a metric suggested. I think it 11 was developed subsequently between the two phases. 12 Q. Could we turn to page 5, please, of this document. This 13 concerns a system stability issue. At the bottom -- 14 sorry, if we can move down, thank you -- it says: 15 "BMc [will be I imagine Bruce McNiven] and RH 16 [Ruth Holleran] emphasised the business impact on staff 17 time and cost, and on customers, of loss of service. 18 This was particularly severe in one or two position 19 offices. Fuller impact details would be ready for 20 Monday. The frequency is significantly greater than on 21 the current POCL legacy systems. 22 "JM [which I think will be you] said that the 23 incident was wider than reboots -- it was the overall 24 loss of service to the customer, and this had to be 25 taken into account in the severity." 108 1 So in broad terms what was the business impact of 2 the screen freezes? 3 A. Well, the outlet, the office, was unable to conduct 4 business, to transact business, number 1, and, secondly, 5 it was by no means clear what impact this was having on 6 the integrity of the data. 7 Q. Why were you concerned as to the integrity of the data 8 because of the screen freezes? 9 A. Well, because we weren't sure what was happening. It 10 was unclear why it was freezing. It could lead to 11 reboots by the users in the middle of a process, and we 12 weren't sure what the implications would be on the data 13 from that. But the main impact was the fact that the 14 outlet was -- you know, it probably took -- I can't 15 remember how long it took to reboot a system, but 16 I don't think it's like rebooting your phone now. It 17 took quite a while. So in the meantime customers are 18 queueing up. 19 Q. We know, as you referred to already, that -- that 20 document can be taken down, thank you -- acceptance 21 wasn't achieved in August, and this led to what has been 22 referred to as the first supplemental agreement between 23 ICL Pathway and Post Office and that proposed a series 24 of acceptance workshops. 25 A. Yes. 109 1 Q. I want to turn to look at those now. Please could 2 I bring up POL00028342. This is an email which you sent 3 to a number of people at Post Office involved in the 4 acceptance workshops, dated 26 August 1999. If I could 5 turn the page, please, it's the note that's attached. 6 This describes acceptance workshop roles. There were 7 three roles: the champion; the business expert; and the 8 technical expert. That's right? 9 A. Yes. 10 Q. The champion is referred to in the third paragraph, and 11 the last sentence says: 12 "Whilst it is Pathway's responsibility to propose 13 a rectification plan, the champion will be required to 14 have defined in advance the success criteria for the 15 incident." 16 Now, would the champion be solely responsible for 17 that, or would they do it in conjunction with others? 18 A. Oh, no, they'd do it in conjunction with others. 19 Q. Who would be involved in that joint decision-making 20 process? 21 A. I think what they would call the business assurance 22 people, people like Ruth Holleran, people who were not 23 part of the PDA per se but were closely aligned to us 24 within what Post Office called the business. 25 Q. It may help actually could we go to the bottom of this 110 1 page, please. So, for example, at 376 the business 2 expert is Graeme Seedall, the technical expert is Calum 3 Craig, and the champion is Ruth Holleran. 4 A. Yes. 5 Q. Ruth Holleran as champion would be, it said, the 6 responsibility to define in advance success criteria. 7 A. Yes, yes. 8 Q. In doing that, would she consult with the business 9 expert and technical expert within, say, assigned to 10 376, or would it be wider to everyone involved in the 11 acceptance process? 12 A. Well, I don't know, to be honest. Ruth would definitely 13 not have come up with something on her own. She would 14 have perhaps proposed some measures and then circulated 15 those and discussed them. She definitely would have 16 discussed them with Graeme Seedall and probably with 17 other people back in Chesterfield, or Dave Smith as 18 well. 19 Q. To what extent would David Miller have been involved in 20 this process? 21 A. I mean, Dave would have been aware of it. I don't think 22 he would have been down into the detail of it. 23 Q. We can take that document down, please. We'll just deal 24 with this last document, sir, if I may before a break. 25 You were at some acceptance workshops on 25 and 111 1 26 August. Can I bring up POL00028476, which is a note 2 of an internal acceptance update meeting or action 3 points from it and, if we could go to point 11, please. 4 I should say this is 27 August. Point 11 says: 5 "Speak to Ruth Holleran about producing 6 a clearance plan for 376 and ensuring fast-track 7 monitoring/reporting process." 8 The Action By is listed, JM, which I assume will 9 be you. Do you recall what this action point was or 10 what it involved? 11 A. Well, I think Ruth for some reason wasn't at that 12 meeting -- I'm not sure why -- and I think we were 13 looking to try and help Pathway to understand what level 14 of acceptance might be possible, or what mitigations 15 might be possible for these incidents, in general. You 16 know, what would be acceptable, and I think the output 17 from this actually was that 0.6 metric. 18 Q. Which we'll come to in a moment. Because of this, were 19 you involved in the discussions? Were you directly 20 involved in the discussions on or the decision-making 21 which led to 0.6 per cent being -- 22 A. No, I wasn't involved in the development of that number. 23 That would have been more of an internal POCL 24 discussion. 25 Q. When you say internal POCL discussion, who do you mean 112 1 specifically? 2 A. I mean Ruth, Dave Smith, possibly others. 3 Q. Why wouldn't you have been. involved with that? 4 A. Well, because I wasn't representing the business in that 5 sense. I was representing the project. 6 MR STEVENS: Sir, thank you. I think that would be a good 7 time to take a break. 8 SIR WYN WILLIAMS: What time shall we start again? 9 MR STEVENS: 25 past, sir? 10 SIR WYN WILLIAMS: Yes, that's fine. 11 (2.15 pm) 12 (A short break). 13 (2.25 pm) 14 MR STEVENS: Sir, can you see and hear me? 15 SIR WYN WILLIAMS: Yes, I can. 16 Q. Can I start by bringing up POL00028471, page 2, please. 17 Thank you. This is an email from Ruth Holleran, known 18 as Ruth Read, to Keith Baines dated 27 August 1999. She 19 says: 20 "Sooner or later (probably sooner having got 218 21 [training Acceptance Incident] out of the way early next 22 week) Pathway will be seeking reclassification of 376 23 and 298 to medium on the strength of a rectification 24 plan. I suggest we need to be thinking ... about the 25 tactics on this before Pathway (certainly) raise this at 113 1 the next workshops. 2 "I am assuming with both 298 and 376, the required 3 rectification to downscale to medium will not be proven, 4 but we will be under extreme pressure to reclassify. 5 Bluntly speaking we will be breaking our proof positive 6 rule if/when do this but I'm not sure we will have any 7 alternative -- or do we?" 8 Let's just take that in stages. Firstly, what 9 does Ruth Holleran mean here when saying "breaking our 10 proof positive rule"? 11 A. Well, I don't know, but I think she possibly means that 12 we would be reclassifying on the basis of a plan as 13 opposed to evidence. 14 Q. And she refers to, "We will be under extreme pressure to 15 reclassify." At the time, where was the pressure coming 16 from, if any, to reclassify Acceptance Incidents? 17 A. Pathway. I don't think there was pressure coming from 18 within POCL. 19 Q. When she says as well: 20 "I'm not sure we will have any alternative -- or 21 do we", was the alternative simply not to accept the 22 product? 23 A. Well, I think what Ruth is seeking is some way through 24 this. I saw another document -- I don't know, maybe in 25 this pack here, I mean, attached here -- from Dave Smith 114 1 who's recommending that we not down-grade in advance of 2 the decision on the basis of plans alone, but that we 3 retain the classification and hold our options open. If 4 the business viewed it as wanting to proceed but retain 5 the classification, then it would do so. 6 So my suspicion is that Ruth is looking for some 7 level of additional flexibility here. 8 Q. I didn't want to interrupt your answer. I think, if we 9 turn to page 1 -- the bottom of page 1 of this document, 10 maybe what you were referring to, is it this, from Keith 11 Baines to Ruth Holleran, second paragraph: 12 "I would be against any artificial 13 reclassification of Incidents from High to Medium"? 14 A. Yes. 15 Q. So in short, I think, summarising what you said before, 16 your evidence is that there was no internal pressure to 17 artificially reclassify? 18 A. None. 19 Q. If we can go to the top of page 1, please, there's an 20 email there from David Smith to Keith Baines on 21 1 September, and it says: 22 "I would hope that the terms included 23 financials -- Pathway indemnifying us for any 24 unexplained balances, would present them with 25 a considerable incentive to get things fixed and/or 115 1 withholding part of the £68m due on Acceptance." 2 Do you know if at this stage there was any 3 consideration being given to requiring ICL Pathway to 4 indemnify Post Office for errors in balancing caused by 5 the system? 6 A. I believe there was discussion; I wasn't party to them. 7 I don't know what the outcome was, but I believe there 8 was discussion on that topic. 9 Q. Now, I think I'm not going to take you to the document. 10 That document can be taken down, thank you, because you 11 already referred to 0.6 per cent error rate in respect 12 of cash account discrepancies, and your evidence before 13 the break was that you weren't involved in that 14 decision-making process. 15 A. Correct. 16 Q. Whilst you may not have been involved in the 17 decision-making process, do you have any knowledge of 18 the reasons that were considered when arriving at that 19 0.6 per cent figure? 20 A. I believe it was a measure of what the Post Office could 21 manage in terms of corrective activity. 22 Q. And that's -- so I'm not sure if you heard the evidence 23 of Stuart Sweetman earlier in the Inquiry. 24 A. I did hear it. I don't recall. 25 Q. One of the things he said was this idea of what is 116 1 a material error rate. 2 A. Oh, yes. 3 Q. Material for the Post Office was different to what would 4 be material for an individual subpostmaster affected by 5 a discrepancy. Would you agree with that? 6 A. Well, I'd agree with that in broad terms, yes, but my 7 understanding always was that when it came to financial 8 errors in transactions that had to be subsequently 9 reconciled with third parties, then there was really no 10 acceptable level of error. So, for instance, in the 11 bill payment business, the APS application, people paid 12 their bills through post offices, and a lot of the 13 people who paid their bills through post offices were 14 people who couldn't afford to pay their bills through 15 direct debit. 16 So these people go in and pay their electricity 17 bill -- they were mainly utility bills but also local 18 housing bills as well. Those transactions, we would be 19 looking for zero errors on those types of transactions. 20 Q. Why do you think there's a difference in approach 21 between the transactions you just referred to and the 22 cash account discrepancies in respect of the error rate? 23 A. Because I think the cash account discrepancy would be 24 corrected -- it's between two people who have an 25 existing relationship -- whereas, if someone on housing 117 1 benefit goes in and pays one of their bills and that 2 transaction's lost, then that person risks having that 3 service turned off. I think there's a greater degree of 4 jeopardy involved with the people who are involved. 5 Q. During this acceptance process, was anyone on the 6 acceptance team within the Post Office considering or 7 representing the interests of individual subpostmasters 8 in respect of balancing? 9 A. Well, I'm not sure balancing was considered a function 10 that was solely for subpostmasters. All post offices 11 had to balance. The whole balancing process was being 12 looked at by many people in the Post Office. 13 Q. Although you weren't involved in the decision-making, 14 what was your view -- well, with hindsight, what's your 15 view, sorry, on the 0.6 per cent error rates? Do you 16 think it's satisfactory or should it have been lower? 17 A. Well, I wouldn't want to offer a view, really, because 18 I don't really understand the implications of those 19 errors. I don't understand the materiality of -- you 20 know, someone has come up with a figure. They will have 21 come up with that figure with more knowledge than 22 I have, or even had then. So I really wouldn't want to 23 comment on it. 24 I mean, I stick by what I said with regard to 25 I think it depends on the types of transactions. 118 1 I think that is significant. 2 Q. The Inquiry has heard evidence that one of the Post 3 Office's requirements was that Pathway could produce 4 data from Horizon that would be used to support 5 prosecutions. Were you aware of that as a contractual 6 requirement at the time? 7 A. I wasn't conscious of it at the time. I've since had 8 a document released to me that quotes that requirement. 9 Q. You said earlier in your evidence that you would have 10 read the requirements -- 11 A. Yes. 12 Q. -- in the contract? 13 A. Absolutely, yes. 14 Q. At the time of acceptance, was anyone in the acceptance 15 team considering the need for Horizon to produce data 16 that could be used in prosecutions when dealing with 17 these Acceptance Incidents? 18 A. I don't know what happened to that requirement. That 19 requirement would have found its way into an acceptance 20 spec, and that spec would have had criteria against it. 21 How that was subsequently satisfied, I don't know. 22 Q. Could we please bring up POL00028465 and if we could go 23 to the second page, please. Thank you. This is 24 a letter from David Miller to Stuart Sweetman on 25 8 September. 119 1 A. Yes. 2 Q. If we could go down a bit further in the page, please, 3 to show the heading System -- that's it, thank you -- 4 System Lock-ups and Screen Freezes Requiring Reboots. 5 So this is an update on Acceptance Incidents incident 6 298, and the second line of that paragraph says: 7 "The problem is being contained but it isn't yet 8 being improved and John Meagher thinks it will take 9 months to get right." 10 Does that fairly reflect your view at the time? 11 A. Yes, it does. 12 Q. Were you confident at that point that the issue would be 13 fixed? 14 A. I was confident that it would be reduced. This is one 15 of these situations where there are multiple reasons, 16 not all of which were understood by Pathway. So I was 17 confident it would be reduced as they understood what 18 was happening, but wouldn't say I was confident it would 19 be removed. 20 Q. What gave you confidence that it would even be reduced? 21 A. Well, because they had identified a couple of reasons 22 for it and were trying to engineer those out of the 23 system. Some of them were behavioural, some of them 24 were to do with the system, some of them were classic 25 Microsoft problems that you could identify, blue 120 1 screens, et cetera. So, you know, the more evidence 2 that Pathway were able to gather, you know, the greater 3 the opportunity they'd have to make corrective action. 4 Q. Please can we turn the page and have the summary section 5 in view. Thank you. It says: 6 "Of our six key players (Keith Baines, Ruth 7 Holleran, John Meagher, Bruce McNiven, David Smith, Andy 8 Radka) the first four would opt (somewhat reluctantly) 9 for conditional acceptance toward the end of September. 10 Andy Radka and David Smith would not accept and seek to 11 use the full period until 15 November to force improved 12 performance from ICL Pathway." 13 Do you agree with that? At that stage were you 14 siding towards conditional acceptance? 15 A. I was, yes. 16 Q. We don't need to turn it up but, in your witness 17 statement at paragraph 26, you say this about 18 acceptance: 19 "As far as I recall, and there was a contractual 20 agreement, Pathway would be awarded acceptance once it 21 had completed the agreed tests and a threshold regarding 22 the number of Acceptance Incidents within severity 23 classifications had not been breached. This was 24 achieved albeit with many acceptance issues remaining 25 which Pathway undertook to resolve." 121 1 At this stage, did you consider that Horizon had 2 satisfied the criteria for acceptance? 3 A. No. 4 Q. Why? 5 A. Well, it hadn't -- there were Acceptance Incidents above 6 the threshold. 7 Q. And the rectification plans in place you weren't 8 sufficiently confident with? 9 A. Well, we needed to see -- some of those rectification 10 plans we didn't fully understand. The process for the 11 data integrity check, we hadn't seen the design, 12 et cetera. I mean, it's ... I forget where you are 13 going on this. 14 Q. If you didn't think that it satisfied the criteria for 15 acceptance, why did you think that conditional 16 acceptance was appropriate? 17 A. Because I thought it was inevitable. I mean, I think 18 the Post Office had already thrown in the towel by 19 increasing the threshold in one of the previous contract 20 negotiations, and that it was going to happen. 21 Q. So you -- 22 A. I didn't think acceptance would stop Horizon going live. 23 Q. One of the reasons you have given is the lowering of the 24 thresholds for acceptance. 25 A. Yes. 122 1 Q. Was there anything else, any other communications within 2 Post Office, which made you think that Horizon was going 3 to go ahead even if it didn't meet the accepted 4 criteria? 5 A. No, no, there was nothing. I wasn't involved really in 6 discussions within the -- in levels above Dave Miller. 7 Q. What did you consider of the robustness of the system at 8 this point? 9 A. I thought it was delicate. 10 Q. Could you expand on "delicate". Well, did you consider 11 it to be robust? 12 A. No, but I wouldn't have considered anything robust at 13 that stage anyway because I think, you know, robustness 14 is something that would have to be proven over a longer 15 period of time, and it was a small number of outlets 16 that were out there, et cetera. I thought robustness is 17 something that would have to be built up. I didn't 18 think it was robust but I wouldn't have -- I wouldn't 19 have -- it would be premature on anything at that stage. 20 Q. When we're speaking here of conditional acceptance, at 21 that point was there an understanding of what those 22 conditions would be? 23 A. Well, there would be the conditions around the 24 rectification plans, the ability to -- plus the ability 25 to stall roll-out. They are the two main features. 123 1 Q. What was your view in the sense of, if conditional 2 acceptance went ahead, did you think it would be more 3 difficult later on to stop the roll-out or to pause it 4 or slow it down? 5 A. No. I didn't, no, no, because I thought that the 6 evidence on the ground, if necessary, would stall the 7 roll-out. If we got to a position of where it wasn't 8 manageable either in terms of the volume of errors or 9 the problems that the users were having, then we would 10 just have to stop regardless of what's in the contract. 11 Q. So we heard earlier your decision to vote to cancel the 12 project earlier in 1999, and now we're at a point of 13 conditional acceptance. You said the reason for 14 conditional acceptance was you thought it was going to 15 happen anyway. 16 A. Mmm. 17 Q. Was there any other reason to explain your change in 18 position? 19 A. Well, I think I need to distinguish in my mind between 20 acceptance and the contractual event of acceptance and 21 the progression of the project, of the roll-out. So 22 I felt that we needed to continue to stress the system, 23 and I thought that the only way that was clear that that 24 was going to happen was some level of conditional 25 acceptance. 124 1 Q. Please can we move down to 3.4 on this letter. Thank 2 you. 3 This is David Miller's tactical advice to Stuart 4 Sweetman, and it says: 5 "It is likely that ICL Pathway may play Peter 6 Copping in for a decision on the 3 high level incidents 7 as of today. If so, there is nothing we can do, and 8 I expect he will give his view within 48 hours anyway. 9 This will give us a clear steer on where he is coming 10 from so we can stop the second guessing his position." 11 Was there any reluctance in the Post Office to 12 refer this incident to Mr Copping at this stage? 13 A. I never remember Mr Copping. I believe he attended some 14 of the acceptance workshops. He kept his own counsel. 15 I've no recollection of him. 16 Q. I want to move on to the topic of reference data, and 17 please could I bring up POL00028564. This is an email 18 from you to a number of people at the Post Office. If 19 we could go further down, please, in the paragraph above 20 the second set of bullet points, it refers to a meeting 21 you had with Steve Muchow, Mike Coombs and John Dicks, 22 and it refers to various issues relating to reference 23 data. 24 Before we consider those, can I ask who at Post 25 Office was responsible for managing reference data in 125 1 relation to Horizon. 2 A. Okay, there was a project, a live project. The 3 individual whose name I remember is Geoff Derby. 4 Q. Geoff Derby. When did that project start, the live 5 project? 6 A. Well, there was always a reference data maintained in 7 the Post Office for some of the earlier projects, 8 et cetera. I mean, reference data -- you know what 9 reference data is by now presumably. 10 Q. Yes, but if you would like to give your explanation of 11 it. 12 A. So there was lots of different types of reference data. 13 I mean, there's reference data that identified the 14 outlets themselves, that was called a FAD code. Each 15 outlet had a code, where -- its location, the manager, 16 et cetera. So there was data around that. Then there 17 was product data in terms of pricing and how that 18 product data mapped to the cash account. 19 Then there was local reference data, and I'm 20 afraid I can't explain how that was managed, but there 21 was -- different regions would sometimes have separate 22 customers in the Post Office, local bus companies and 23 things like that. So there was a degree of regional 24 reference data as well. 25 Now, reference data was continually mis -- not 126 1 given an adequate level of seriousness by Pathway 2 through the whole project, and we were scampering around 3 at the end to try and make it work. But really the 4 whole integration of reference data and EPOS within 5 Pathway should have been the subject of a wholesale 6 business process analysis and it wasn't. 7 I'm not saying -- I know a lot of people have been 8 critical of reference data, a lot of Pathway people have 9 been critical of reference data, and they were right to 10 be. There were errors that came from that data into 11 Pathway as well. 12 Q. Do you recall why it was being raised at this stage 13 which was October 1999? You said you thought it should 14 have been raised before. Why was it being raised at 15 this point? 16 A. Well, it was a serious concern. It was contributing to 17 problems, and also Pathway appeared to have been coming 18 to a realisation that they may not be able to manage the 19 volume or the volume of change that they were receiving 20 from Post Office. 21 Q. So the concerns that they've listed there, is first is: 22 "Pathway are concerned with POCL not maintaining 23 the agreed lead times between receipt of data, 24 (notification of change) and activation of data 25 (implementation of change)." 127 1 What was broadly that concern about and how did it 2 affect Horizon? 3 A. I'm not 100 per cent sure, but I suspect that what 4 Pathway is saying that we had an agreement whereby we 5 would pass reference data changes to them for activation 6 at a time in the future, and we may have been -- the 7 Post Office may have been passing data with a shorter 8 period for activation than had been agreed in the 9 interface spec. 10 Q. From the way you answered that question, do you not 11 independently recall that -- 12 A. I don't. 13 Q. The second one is: 14 "Pathway are waiting for a Reference Data business 15 rules document which is in development by Geoff Derby 16 and would welcome the earliest delivery of the 17 document." 18 Do you have any recollection of that issue? 19 A. I don't, I'm sorry. 20 Q. Then thirdly: 21 "However, the most significant issue for Pathway 22 is that the current design (agreed by all) for the 23 provision of data changes from Post Office to Pathway 24 results in the delivery of large volumes of data which 25 contain no actual change for Pathway." 128 1 A. Yes. 2 Q. You referred to that issue earlier in your answer, about 3 they didn't have the system in place to deal with the 4 volumes of data. 5 A. Well, I think there's two things there. One is that it 6 would appear that Post Office is passing data to Pathway 7 and that Pathway -- which there is no need for Pathway 8 to act upon, and I think there's also an issue where the 9 volume of change, the volume of data is greater than 10 what Pathway anticipated. This should have been agreed, 11 you know, way back. 12 Q. Why wasn't it? 13 A. I don't know why it wasn't, but it wasn't. 14 Q. Who was responsible -- 15 A. Both sides. I mean, Geoff Derby on the reference data 16 project, and whoever his opposite number was in Pathway. 17 Q. Even beforehand, when say '98 early parts of '99, when 18 this is being developed, it should have been Geoff Derby 19 and his counterpart at ICL? 20 A. Yes. This should never be arising at this stage. 21 Q. When this was raised with you, do you recall what your 22 sort of action plan was from thereon? 23 A. We had -- I don't remember, but I know there was an 24 extraordinary amount of activity ongoing. There were -- 25 I think there were joint working teams, joint teams 129 1 working together to try and iron out how we could best 2 sort this out. 3 Q. On that point then, please, could we turn to 4 POL00028552. This is a document entitled Terms of 5 Reference at the top, but the title below says Horizon 6 Reference Data Review, and the author is you. The 7 authority is then Andy Radka who is at Post Office; is 8 that right? 9 A. Yes. 10 Q. And Steve Muchow. So it's a joint review. 11 A. Yes Steve Muchow is from Pathway. 12 Q. Do you recall the process of drafting these terms of 13 reference? 14 A. I don't recall it. 15 Q. Do you remember what your role was in relation to this 16 joint review? 17 A. I was trying to get it set up. 18 Q. Did you have any involvement in the technical aspects of 19 how the reference data was changed or -- 20 A. No, no. 21 Q. Please can we turn to page 4 of this document. The 22 second paragraph says: 23 "Previous discussions between both companies had 24 been hampered by reluctance to provide full visibility 25 of all aspects of their respective technical and 130 1 operational design. It is essential, therefore, for the 2 success of the study that sufficient detailed 3 information is provided to ensure the maximum level of 4 knowledge and inform the development of appropriate 5 solutions. To this end, it is proposed that workshops 6 are supported by the attendance of appropriate members 7 of both the PONU ..." 8 Just stopping there, what does that stand for? 9 A. Something in the Post Office. 10 Q. "... and the Pathway Reference Data and Business Process 11 Design teams and that appropriate documentation, if 12 required, is made available." 13 Would that have been reported to you? In drafting 14 these terms of reference, would that have been reported 15 to you as a problem that had happened, or is that 16 something you had first-hand knowledge of? 17 A. That's something I was aware of. I mean, this goes back 18 to the point mentioned before about the EPOS design. So 19 EPOS was intrinsically connected to reference data. All 20 of the mapping of the cash account, between the cash 21 account and the transactions, was in reference data. 22 So, although we knew what data that we were providing to 23 Pathway, we did not know how it was being used within 24 their system, and that is what we're trying to -- that's 25 what I'm trying to have made available here, that that 131 1 would be exposed. 2 Q. Do you think this issue would have been identified 3 earlier or addressed earlier, if there had been better 4 sharing of design documentation at an earlier stage? 5 A. Absolutely. I mean, there's another document somewhere 6 in the pack where I had approved another attempt at 7 reference data, at a joint reference data review back in 8 '98, and I can't remember what happened to it, but it 9 was drafted by Andy Scott and it was copied to the 10 Horizon management team, to the PDA management team, and 11 copied to Terry Austin. I don't know what happened to 12 that initiative but I believe it didn't happen. We made 13 attempts to try and get this sorted out before. 14 Q. I wanted to go to -- I appreciate you say you weren't 15 involved in the technical aspects of it, but you may be 16 able to assist in interpreting one document. Could 17 I ask, please, to turn to POL00028544. This is the 18 second meeting of a reference data review which clearly 19 relates to this joint review, of which you were the 20 chair. 21 In chairing the meeting, was your role to 22 facilitate? 23 A. Yes. 24 Q. Could we please turn to page 6. If we go down slightly 25 to sub-paragraph 4, there's a note in handwriting on the 132 1 right there. Do you recognise that handwriting? 2 A. No, I don't. It's not mine. 3 Q. Do you have any recollection of this meeting at all? 4 A. I'm afraid I don't. 5 Q. That document can be brought down, please. 6 So you were involved in the review. You left the 7 Post Office in January 2000. Do you have any knowledge 8 of how the review finished or the outcome of the review? 9 A. My recollection is that, following the second acceptance 10 agreement, the Post Office pursued those rectification 11 plans and any other problems that were arising. So 12 I think the role that I'd had reverted into what we 13 would call business as usual or a project team within 14 POCL. I think Min Burdett possibly took over what I had 15 been doing. 16 Q. You weren't there to see the end of the reference data 17 review? 18 A. No, no. I mean, I gave in my notice between Christmas 19 '99 and New Year '00 and I probably -- I don't think 20 I spent a lot of time -- I had outstanding leave, 21 et cetera, so I would have been just involved in handing 22 over. 23 Q. Please could I bring up POL00028553. This is an email 24 to you from Min Burdett who I think you just referred to 25 earlier saying you would be handing over to; is that 133 1 right? 2 A. Yes, I think so. I mean, I've seen documents 3 subsequently that she -- similar areas to where I would 4 have been involved in. 5 Q. Please can we turn to page 3, which is one of the 6 attachments. This is a roll-out decision demand 7 position paper. 8 A. Yes. 9 Q. Do you recall this document at all or what its purpose 10 was? 11 A. I think I remember it from the pack; I don't remember it 12 at the time. 13 Q. It sets at the top: 14 "In anticipation of the criteria due to be met by 15 24 November not having been met by that date, and given 16 POCL's associated concerns, POCL is proposing that the 17 existing monitoring activities should continue and be 18 strengthened, and is also proposing the introduction of 19 some new activities. POCL proposes the following." 20 I want to look under Data Integrity. It says 21 "Objectives". The first one is: 22 "To ensure that the integrity control is capable 23 of detecting all relevant incidents." 24 Do you know to what that's referring? 25 A. Yes. So Pathway had proposed initially and developed 134 1 and introduced a piece of software that would perform 2 a comparison -- I can't remember exactly between what 3 two points -- but it would perform a comparison to 4 provide an early identification of data differences 5 between the cash account and what was being received at 6 TIP. 7 Q. This was to identify the discrepancies basically? 8 A. Yes. 9 Q. Under Activities, the first bullet point says: 10 "The EPOS TIP reconciliation feature must be 11 proven to be capable of detecting all data errors that 12 would be detected by the TIP cash account compare 13 process. For the avoidance of doubt, this includes an 14 explicit check that receipts are equal to payments ..." 15 It goes on to say how that's to be achieved. 16 So in essence is Post Office's position at this 17 point that the reconciliation tool needed to pick up all 18 data errors or all discrepancies? 19 A. That would always be the target. 20 Q. Presumably that was an important point for Post Office. 21 A. Absolutely. 22 Q. The Inquiry has heard evidence about the third 23 supplemental agreement, and that the reconciliation tool 24 was not guaranteed to pick up all cash account 25 discrepancies. Are you aware why that position was 135 1 changed from this position being the reconciliation 2 feature needed to pick up everything? 3 A. Well, I think that's the target. I think this is the 4 target you are reading here. 5 Q. But are you aware as to why that couldn't be achieved? 6 A. I -- I don't quite understand your question. 7 Q. Well, the Post Office's target is there to be 8 a reconciliation feature that is capable of identifying 9 all discrepancies. 10 A. Yes. 11 Q. That wasn't what was agreed in due course. It was 12 accepted that the reconciliation feature could not 13 identify all of the data errors. 14 A. Right. 15 Q. Are you aware as to why the Post Office accepted that 16 position rather than push for its target? 17 A. Well, I wasn't party to the agreement to the 0.6. I can 18 only assume that it was a level of -- a level that they 19 thought they could manage. I don't think the Post 20 Office would ever accept a situation whereby it expected 21 to get errors. It would always be striving to drive 22 those out, to drive those down. But the reality of the 23 situation is that that was going to happen, and the 24 reality that we're coming from is that there was 25 a considerable number of errors. So we must never -- 136 1 there were probably created by multiple causes. So it 2 was never going to be a situation that we would go from 3 whatever level to zero in one bound. 4 Q. Finally, can I please turn to your witness statement 5 again. It's WITN04150100. Can we bring up page 18, 6 please. Thank you. 7 You say here that: 8 "Acceptance was a prescribed contractual event; it 9 served its purpose, but it did not mean that the 10 solution was 'reliable and robust'. From my experience 11 care and serious attention would need to continue to 12 have been applied to the system as it moved through 13 roll-out and beyond. Years later, when I learned that 14 Post Office had prosecuted multiple subpostmasters based 15 on assurances from Fujitsu that no explanation other 16 than fraud was possible, I was shocked. Shocked because 17 among other things Post Office would appear to have 18 completely changed its view of Horizon since the time up 19 to 2000 while I worked on the project." 20 That point, that Post Office would appear to have 21 completely changed its view since you worked on the 22 project, please could you expand on what you considered 23 the general Post Office view of Horizon to be at the 24 point you left the project. 25 A. Well, I thought it was viewed as delicate. That's how 137 1 I viewed it. No-one could have continued in that period 2 after I left and not been involved in multiple, multiple 3 rectification activity. It did not present itself as 4 a stable system. You know, there may have been three 5 high-level Acceptance Incidents but there were multiple, 6 multiple causes for those. 7 Q. So, if someone had said to you in 2000 that the Post 8 Office planned to investigate subpostmasters for fraud 9 and false accounting, based on data produced from 10 Horizon, what would you have said? 11 A. Well, I don't even believe they did base it on data from 12 Horizon. They based it on assurances from Fujitsu staff 13 that no other explanation was possible, which would have 14 shocked me even more. 15 Q. Just finally, when you said Post Office would appear to 16 have completely changed its view, are you referring to 17 specific persons or just generally across the 18 organisation? 19 A. I'm talking about everyone I worked with from Dave 20 Miller down to Ruth Holleran, et cetera, on the 21 Chesterfield site, everyone on the programme, everyone 22 who was involved at a working level. 23 MR STEVENS: I have no further questions. Sir, I believe 24 there are some questions from recognised legal 25 representatives. 138 1 SIR WYN WILLIAMS: Before they ask them, can I just pursue 2 what Mr Stevens has been asking you about. My 3 understanding is that your evidence is that everyone 4 with whom you were engaged on a day-to-day basis working 5 in Horizon may not have used the word "delicate" but 6 essentially had the same view of Horizon as you did at 7 the time you left. Have I understood that correctly? 8 A. That's exactly what I said. 9 SIR WYN WILLIAMS: And that's from Mr Dave Miller down, as I 10 understand it. 11 A. Yes. 12 SIR WYN WILLIAMS: Do you have any information you can give 13 me about any views expressed from Mr Dave Miller 14 upwards? 15 A. I can't. We never really -- I mean, no. 16 SIR WYN WILLIAMS: What I have in mind is that sometimes -- 17 I'm not saying it happened; I'm just asking for your 18 help if you can give it -- Mr Miller and you, or two 19 people like you, might say to each other, "Well, we 20 agree what this system is really like, but I'm afraid 21 I'm having trouble from Mr X or Ms Y above me". Those 22 sort of discussions didn't take place, did they? 23 A. No. I mean, Dave Miller, I believe reported to Stuart 24 Sweetman. I never met Stuart Sweetman. I did meet Paul 25 Rich and Dave Smith and, as you've seen, Dave Smith 139 1 would have been involved, but I don't know -- 2 SIR WYN WILLIAMS: Sorry to interrupt but, from one of the 3 documents we looked at, I think Dave Smith was one of 4 the people who would have voted against going ahead with 5 it at a point in time. 6 A. Indeed. 7 SIR WYN WILLIAMS: Okay. So -- 8 A. I think that was a negotiating position he was 9 expressing there. 10 SIR WYN WILLIAMS: Yes, yes, sure. All right. Anyway 11 I think, so that I don't take the floor too much, you 12 can speak for Mr Miller down, but you can't speak for 13 Mr Miller up? 14 A. Correct. 15 SIR WYN WILLIAMS: Fine, okay. Thank you. Who's first? 16 MR STEIN: I believe it's me on behalf of Howe+Co clients. 17 Questioned by MR STEIN 18 Q. I represent a large number of people who were 19 ex-subpostmasters, mistresses and managers, all them who 20 have suffered at the experience of dealing with Horizon 21 and Post Office. 22 I am going to start just with a bit of procedural 23 side of matters, just so that we can understand your 24 evidence that relates to reducing requirements into 25 acceptance spec. It was a matter you mentioned earlier. 140 1 To do this, I'm going to look, please, at 2 a codified agreement which is FUJ00000071 and, if we 3 could have page 1, please, Frankie. Hopefully on the 4 screen you will see codified agreement first page. 5 When we're looking at this document, we can see 6 from this point of view, from this very first page, that 7 this is the basic agreement between the parties, and I'm 8 going to take you to two separate parts. First of all, 9 requirements at page 249-250, relativity pagination. 10 A. What date is this? 11 Q. This is 1999. Can you enlarge the page, please. If 12 it's possible to enlarge the page so that we can see the 13 bottom requirement, 829. Page 249 again and the bottom 14 part of page 249. You should see there that you have 15 got requirement 829, General Security Prosecution 16 Support. 17 I'm just going to read through this with you, and 18 we'll go over the page as it then goes straight into 19 page 250: 20 "The contractor shall ensure that all relevant 21 information produced by the POCL service infrastructure 22 [then over the page, please and then next part] at the 23 request of POCL shall be evidentially admissible and 24 capable of certification in accordance with the Police 25 and Criminal Evidence Act." 141 1 Then it refers to other legislations in the 2 United Kingdom and equivalent legislation covering 3 Scotland. 4 Then next paragraph: 5 "At the direction of POCL, audit trail and other 6 information necessary to support live investigations and 7 prosecutions shall be retained for the duration of the 8 investigation and prosecution irrespective of the normal 9 retention period of that information." 10 So, when Mr Stevens asked you questions, he asked 11 you about your awareness of the requirement in relation 12 to providing evidence for support in relation to 13 investigations and prosecutions. So this is the 14 received part of the codified agreement. 15 Now, I take you to the next part which will then 16 deal with solutions, as we're working our way through 17 what are the procedural ways these matters are dealt 18 with. That we will find, please, at page 392, just at 19 the bottom of page 392, and then we see the reference 20 number 829 at the very bottom, Pathway Response, and 21 Frankie, if we go over the page to 393, it makes it 22 clear that it refers to the same requirement. So: 23 "Pathway confirms that it will ensure that all 24 relevant information produced at the request of POCL 25 shall be evidentially admissible ..." and so on. 142 1 Then the second paragraph: 2 "Pathway confirms that at the direction of POCL 3 and subject to reasonable regard to the data volumes and 4 storage [solutions] incurred, [then the] audit trail ... 5 will be [maintained] ..." 6 If we go to the bottom of that page, please, 7 Frankie, just to see what we're referring to here, right 8 at the very bottom of the page, we see the bottom 9 left-hand corner, at the page that we're looking at, we 10 see this is a reference to solutions, okay? 11 So we've got a requirement built into the codified 12 agreement. We've then got a solution set out within 13 that codified agreement, and the entire document is 14 914 pages long. So this is a considerable document 15 that's required a fair bit of work, one assumes. 16 Your evidence was that, in relation to acceptances 17 requirements, there would be an acceptance spec, and 18 then there would be criteria drafted against it. That's 19 what you said roughly to my learned friend a little 20 earlier today. 21 So we've got so far within this document to 22 solutions. What's next? So how do you take it from 23 requirement and solution and onwards -- 24 A. Yes, so the requirement tended to say, "You must do 25 this", and the solution didn't normally go further than 143 1 saying, "We will do this", okay? So there are a series 2 of subsequent documents that were produced that expanded 3 the solution out, and the first one would have been what 4 was called the SADD, the service architecture design 5 document. That would have had a bit more detail. Then 6 there would have been a series of subordinate technical 7 documents, and in fact there was a security functional 8 specification. 9 Now I can't remember how this is addressed in the 10 security functional specification, but that would be 11 where that would be developed. Then subsequently the 12 acceptance specification -- sorry, yes, the acceptance 13 specification for security would have a series of 14 criteria, and against each criterion there would be an 15 explanation about how that would be satisfied. 16 So some of it would be satisfied by review of 17 document and some of it would be satisfied by 18 witnessing. 19 Q. Right. Now you have referred to the document you used, 20 the acronym for which is SADD, then you have these 21 technical documents. Do they have an acronym? 22 A. There was a security functional specification. 23 Q. The fact that you are using the words "security 24 functional specification", does that mean it was dealt 25 with by the security department? 144 1 A. By the, pardon? 2 Q. By the Post Office Internal Security Department the 3 security bit that you are referring to, why do you call 4 that "Security"? 5 A. Yes, okay. It was wider, obviously, than this. 6 Q. Yes. 7 A. Obviously when the project first started all the 8 Benefits Agency transactions were there, so one of the 9 main objectives of the Benefits Agency was to reduce 10 encashment fraud. So there was a huge amount of 11 attention given to that and to the security of the data, 12 okay. 13 We had people who represented security a function 14 on the PDA, and they would have been in touch with 15 security experts, both in the Benefits Agency or the DSS 16 wider area and the Post Office security people. 17 Q. So the Benefits Agency's difficulty was one that they 18 had with fraud in which they were losing a lot of money 19 at that time in relation to fraud? 20 A. Yes. 21 Q. And the particular type of fraud they were concerned 22 about was identity fraud, as we understand it. 23 A. Well, they had two types of fraud they were concerned 24 with. One was misrepresentation of circumstances, which 25 was not addressed by this project. 145 1 Q. No. 2 A. And they had what was called encashment fraud, which 3 was -- the intention here was to reduce encashment 4 fraud. 5 Q. The encashment side of it is identity fraud, someone 6 representing themselves as another in order to get money 7 from benefits, yes? 8 A. Mmm. 9 Q. Now, you mentioned security a number of times there. 10 Now, the security department that you are referring to 11 within the Post Office, who was that headed by? 12 A. I don't know. 13 Q. Right. The person that would be drafting the sort of 14 reports that you are talking about, the technical 15 documents in relation to security and this particular 16 requirement, who would that have been? 17 A. Well, okay. So we had a representative of POCL audit on 18 the PDA -- his name was John Bruce -- and we had people 19 who attended to technical security -- that would have 20 been Jeremy Folkes. 21 Q. So it's Mr Bruce and Mr Folkes. I'm going to move on 22 and deal with one other aspect of things before coming 23 back to particular documents. Can we go please to 24 POL00043682. 25 This is a fairly short document, a three-page 146 1 document. You should have had reference to this in the 2 documents that you have been supplied. It's an 3 electronic memo. You can see the date top right-hand 4 corner, indeed set into the middle of the document, it's 5 in August of 1999 and it's to you, Mr Meagher, and then 6 others referred to in the document. This from Min 7 Burdett, and we can see all the names that the people 8 have all got Post Office email references. 9 If we then go down to the second page, please -- 10 thank you very much -- this refers to AI408, HSS Service 11 Level Failure. If we just scroll our way down to 12 Severity Rating to start off with, please, help us 13 a little bit with this. Under Severity Rating we've got 14 Pathway's severity rating is low and then POCL's 15 severity rating which is medium, okay? 16 A. Am I looking at the -- okay, right. I see it. 17 Q. Point 3. 18 A. Yes. 19 Q. So Pathway's severity rating is low, POCL's severity 20 rating is medium, and then let's just read through this 21 couple of paragraphs: 22 "The agreed definition for High severity is: 23 'consistent failure to meet minimum acceptable 24 thresholds (MATs)'. The definition for Medium severity 25 is: 'occasion failure to meet MATs but MATs met on 147 1 average'. POCL's view is that the consideration should 2 be whether this is a High or Medium incident." 3 Then it goes on to say: 4 "Consistent failure has been shown. However, as 5 there has been only one opportunity to measure service 6 levels during the Core Observation Period (COP) it was 7 originally agreed between POCL and Pathway that the 8 Severity of this incident should be Medium as POCL could 9 not show a consistent failure during COP." 10 So far this seems to say that the view of the Post 11 Office was that the severity level was such that it met 12 the original criteria of high severity; agree? 13 A. Yes. 14 Q. But then it seems it was agreed between POCL and Pathway 15 that the severity of this incident should be medium as 16 POCL could not show a consistent failure during the 17 period of observation. 18 A. Yes. 19 Q. From the point of view of the people that we represent, 20 how could Pathway be getting away with it? 21 A. Well, I think what is being said here on the Post Office 22 side is that the sample size is too small to be able to 23 sustain an argument that it's a high severity 24 classification. 25 Q. Yes, I think we can all read this. How could Pathway be 148 1 getting away with this? POCL's view is clear: 2 consistent failure has been shown. This is the 3 contracting party that is buying in the Horizon System 4 thinking oh, sorry, but the consistent failure is shown; 5 this is high severity. How is Pathway allowed to get 6 away with it? 7 A. I don't know how I can answer your question. 8 Q. All right. Let's read on: 9 "Pathway have changed their view to Low ..." 10 Then it refers to workshop 10/8: 11 "... on the basis that the original figures were 12 misreported (but Pathway have not shared these figures 13 with POCL). POCL consider Low unacceptable as the 14 severity rating should be based on Pathway's originally 15 reported service levels." 16 Now, this appears to show within these few 17 paragraphs that the POCL view this as high severity yet 18 Pathway is consistently arguing it's low severity. 19 A. In general Pathway, in practically every case, would 20 ascribe a lower severity than the Post Office did. 21 Q. This is a fairly substantial difference, isn't it? This 22 is POCL believing high severity in relation to help desk 23 requirements and -- 24 A. Yes, yes, I don't disagree with you. 25 Q. And again the rationale appears to be that Pathway have 149 1 not shared the figures, the figures that it's using to 2 try and say that it's in fact low. 3 A. Yes. I think what is being said there is that the 4 evidence has not been shared and is being questioned. 5 Q. Yes. This then is leading us -- in relation to the date 6 of this, this is in the August period of 1999. 7 A. Yes. 8 Q. We're getting very close to roll-out, yes? We're 9 looking at a system that you're saying is delicate. Is 10 this in any way acceptable, what's on the content of 11 this document so close to roll-out? Mr Meagher? 12 A. Sorry? 13 Q. Is it in any way acceptable, so close to roll-out, that 14 there are such huge differences between POCL's view 15 about consistency and severity of incidents versus 16 Pathway's at this time? 17 A. Well, there's always -- I think there was always 18 a difference of view. 19 Q. Is it acceptable, Mr Meagher, so close to roll-out? 20 A. Under what rules? I mean, we're dealing with a contract 21 here, okay? So I don't quite understand what 22 acceptability in your question means. 23 Q. So close to roll-out, in relation to a big system that's 24 going to have a huge impact on the Post Office, do you 25 find yourself, professionally, this level of 150 1 disagreement -- 2 A. No, I mean -- 3 Q. -- let me finish -- is acceptable, Mr Meagher? 4 A. I would distinguish between the difference of opinion 5 and the reality of the system. 6 Q. You have answered questions from Mr Stevens regarding 7 page 18 of your statement. 8 A. Yes. 9 Q. The reference in relation to your statement is at 10 WITN04150100, page 18, please. If you could highlight, 11 please, Frankie -- thank you very much. 12 This is the reference that my learned friend 13 finished on in relation to years later you learned that: 14 "... Post Office had prosecuted multiple 15 subpostmasters based on assurances from Fujitsu that no 16 explanation other than fraud was possible, I was 17 shocked." 18 You have also added to that part of your statement 19 that you regarded the system itself as being delicate. 20 A. Mmm. 21 Q. Yes? Pamela Lock is someone I represent, and she ran 22 the Post Office branch in Swansea from September 1974 23 until July 2000. The Horizon System was installed in 24 January of 2000, Mr Meagher. She was experiencing 25 problems with shortfalls in January of 2000 shortly 151 1 after installation. She was then investigated by 2 auditors from the Post Office in July of 2000. You 3 left, I think, your employment at the Post Office in 4 January of 2000. 5 A. Yes. 6 Q. At the time when you left the Post Office in January of 7 2000, do you believe that anybody should have been 8 investigated and thereafter prosecuted in relation to 9 shortfalls that were being found in a system that was as 10 delicate as you describe? 11 A. I do not. 12 Q. Mr Meagher, when were you first aware of the people that 13 were being prosecuted and civil actions being taken 14 against them by the Post Office, essentially based upon 15 the system, and I know that you have a caveat to that, 16 which is that you say it's based upon what is being said 17 by people from Fujitsu. So whichever way round you look 18 at it, when you were first aware of what was going on by 19 way of prosecutions and civil actions? 20 A. I think when we first started to see it in Computer 21 Weekly. 22 Q. So that takes us to -- well, it's 2010 onwards, and then 23 you're aware of what's going on with Second Sight, were 24 you? Did you hear about that? 25 A. I remember reading -- no, I don't. 152 1 Q. You were aware then at a much later stage, the time 2 we're reaching, 2019, of the civil action at the High 3 Court? 4 A. Yes. 5 Q. After that the Court of Appeal cases where individuals 6 had to take their case to the Court of Appeal and get 7 themselves cleared, as did Ms Lock, the lady I just 8 referred you to, yes. Given your evidence is that the 9 system was in a state of delicacy by the time you left, 10 why didn't you come forward and say something and say, 11 "Look, something's wrong here. Nobody should have been 12 prosecuted based upon this system"? Why didn't you come 13 forward to the litigants or the people being prosecuted 14 that you knew about at that stage? 15 A. Well, I wasn't aware that anyone was being called. 16 Q. Why didn't you come forward and say you could help, 17 Mr Meagher? 18 A. Well, I wasn't aware that I could help. 19 Q. Why didn't you come forward and say, "I knew the system 20 had problems"? 21 A. It was 20 years previously. I mean, the system had been 22 changed on a number of occasions. I didn't think I had 23 anything to offer. 24 MR STEIN: Thank you, sir. 25 MS PAGE: Nothing from me. Thank you. 153 1 MR STEVENS: Sir, I think that's all the questions from the 2 room. 3 SIR WYN WILLIAMS: Well, thank you very much, Mr Meagher, 4 for making your witness statement and for spending 5 a number of hours this afternoon being questioned about 6 these matters. I'm grateful to you. 7 A. Thank you. 8 SIR WYN WILLIAMS: So that concludes today's business and 9 we'll start again at 10.00 tomorrow morning. Is that 10 correct, Mr Stevens? 11 MR STEVENS: That's correct, sir. Thank you. 12 SIR WYN WILLIAMS: All right. Thank you very much. 13 (3.31 pm) 14 (Adjourned until 10.00 am the following day) 15 16 17 18 19 20 21 22 23 24 25 154 1 I N D E X 2 ROBERT BOOTH (affirmed) .......................1 3 Questioned by MS HODGE ........................1 4 Questioned by MR JACOBS ......................74 5 Questioned by MS PAGE ........................76 6 JOHN DOMINIC MEAGHER (affirmed) ..............81 7 Questioned by MR STEVENS ....................81 8 Questioned by MR STEIN ......................140 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 155