> People were sent to jail on the basis of a single number spat out from a black box called Horizon.

Something also has to be done about the unjust consequences of plea bargaining. Many were convicted on the basis that they admitted to crimes that they did not commit.

I think we also have to get rid of Magistrate's courts and private prosecutions. It's ridiculous that these still exist in a modern state that operates under the presumption of the rule of law.

Plea bargains are heavily restricted in the UK and many of these cases were heard in Crown courts. I agree about getting rid of private prosecutions though.

The postmasters' lawyers have to be put in front of the Inquiry for this utter deriliction of duty.

Many of them have done. Most have either said I don't remember or I was only following orders from above. A few might make the concession that they were misled.

One exception would be one barrister who it seemed to be to express genuine regret. Even he said he was in denial for a long time and only came to the realisation recently.

> I was only following orders from above

Nuremberg has entered the chat.

The UK is modern in a sense of course but it's really archaic when it comes to jurisdiction.

I don't understand why someone didn't push for an itemized breakdown as a double-entry ledger. This would have covered the shifts in money and where they came from and is one of the most basic accounting tools.

The Horizon system failed to keep accurate records. It was a kind of distributed database, with individual users entering data on their terminals and occasionally connecting (potentially via dialup, iirc) to a central system to sync their records. But it was implemented badly, and records could and did get lost or modified. Records could be edited at any time by any of several parties, including the postmasters, but then when they were synced those edits could be silently lost. The resulting ledger does not and can not accurately reflect reality, thus the lost money and the convictions.

Assuming that an itemized breakdown was requested, this is a possible answer why it can't be provided. How can a prosecution continue following such answer is a different question.

The prosecution would happily provide the itemized transactions, because the missing transactions are exactly what they are prosecuting. They know there were N pieces of mail that day, but payment was recorded only for N − 2 or whatever.

The lies and coverup from the Postal service and Fujitsu were to there to hide the flaws in the system from the courts and the defendants. Even the prosecutors have said that they were completely in the dark. It’s only now that the independent reports are out that everyone knows the details.

Unless you know about the bugs in the system, the itemized transaction list makes it look exactly like the cashiers were pocketing cash and not actually ringing up the sales. It’s a classic scam that any competent retail manager or owner knows to guard against. The only difference is that these cashiers nominally own the stores they run. If they pocketed the cash from the sale of a candy bar then there would be no crime; the cash was theirs to begin with. But since they are also working for a third party (the post office), the possibility of theft is a real one.

If the money was eventually handed over to the PO, would it not be reflected in a ledger?

I feel like I am repeating myself.

You would assume so, but the whole problem was that the Horizon computer system would lose transactions. It might lose the transaction where the customer paid by credit/debit, and the post office received the money directly. Or it might lose the transaction that recorded the check the postmaster sent to the post office to reconcile accounts. Again, the Horizon system never had a reliable record of what transactions had actually happened. Once there were discrepancies, it was always easy for it to look like the postmaster had made a mistake or committed theft.

I didn't realize that Horizon was used to record "the check the postmaster sent to the post office to reconcile accounts".

Yea, it was their entire bookkeeping system. Obviously nobody else has ever had so complex a bookkeeping situation as The Post Office, so they had to get it custom built. I bet Fujitsu made a mint.

> Records could be edited at any time by any of several parties, …

I took an “Accounting for managers” course back in the nineties which included double entry book-keeping - we were taught to never erase a mistake but create additional entries to correct any error. You’d think something like Horizon would adhere to agreed standards of record keeping and have a signed and immutable event log at the very least.

Yep. I’m not an accountant or even a manager, but even I know that. Apparently the Post Office testified many times that the transaction record _was_ immutable, even though Fujitsu knew that records could be edited or even lost at any time. And it appears that their own customer service employees would edit transactions all the time, to correct perceived mistakes. And it would appear that this might even make the problem worse, as the Horizon system could fail to correctly merge those changes down the line. It could silently revert the edits or silently drop entire transactions as if they had never happened.

Creeping around the matter of when can code be trusted. To my knowledge the UK doesn't have the strictest methods to qualify code as "correct in the eyes of the law". Anyone know more on this?

As I understand it, the problem is one of hyperbolic doubt.

Imagine if you were on trial where the evidence against you came from, say, a computerised breathalyser.

You might argue that the code has bugs. Then that the configuration was wrong. Then that the hardware design was faulty. Then that the individual components were broken. Then that the data was altered in transmission. Then that a hacker got in. Then that a cosmic ray corrupted the data. And so on.

The defendant has no proof that the evidence is faulty, and the producers of the evidence can demonstrate (to some degree) that their hardware & software are correct.

At some point, the court has to accept the evidence presented to it. In the UK, at the moment, the assumption is that a computer is operating correctly unless shown otherwise.

The BCS (I'm a member) goes in to a little detail about why they think this presumption should change https://www.bcs.org/articles-opinion-and-research/computer-i...

It feels like that might be a fair point in other context but as one of your sibling posts says: this is just double entry book keeping.

Print out the transactions with their timestamps and it feels this should have been very clearly a computer error given the duplicates etc.

I recall seeing in released emails about the Callendar Square bug that it's debatable as to whether what the system was doing was properly double entry. In that case, my interpretation of the emails was that there were transactions that were nominally recorded as multiple double-entry transactions, but involved, eg, a transfer from account A to a hidden outstanding account X, and a transfer from account from X to account B. Then the account X wasn't actually tracked anywhere or even expected to balance on any individual system: it appears that when multiple counters at the location were involved, the transactions weren't necessarily synchronized between them. In that case, if you have three £1k transfers from A to X (two of which are duplicates), and one £1k transfer from X to B, then it will look like £2k disappeared unless you check the balance of X.

To me, that sounds like an accounting system made by people who fundamentally didn't understand the point of double-entry accounting, because a double-entry accounting system that uses hidden or untracked accounts entirely removes that point and is just equivalent to a single-entry accounting system. Presumably, if all those transactions were properly stored and then combined, a full double-entry ledger could be reconstructed, but it appears the system itself couldn't do that in at least some cases.

Of course, there also seems to be the suggestion that part of the Post Office's argument to subpostmasters was that even if the problems were obvious, like clear duplicate transactions, they were still liable per the contract.

Agree that the courts are somewhat to blame.

But really, to me, the full blame should be on the Post Office, and those involved.

Trying to conceal problems? Purposefully ignoring bugs? Not listening to, well, everyone. Lying to the courts?

People need to be in jail, and starting at the top.

I'm not going to absolve Fujitsu, but I have worked government contracts in Canada. They constantly change, morph requirements, not for any real reasons other than "Oh you build this entire thing? We didn't think of X, let's add that".

Meanwhile, X basically means an entire rewrite.

I've even had situations where "Let's add X" happens, then after done, "Aw, never mind, remove that".

It's a different world.

I'm not sure that both of these can be true at once:

> Agree that the courts are somewhat to blame.

> But really, to me, the full blame should be on the Post Office, and those involved.

Anyway.

> They constantly change, morph requirements

All software systems are like that. Even if they weren't, the moment a new law comes in you'd need to change them anyway. If the engineering process and build can't withstand change, that's a problem.

It seems clear that the Post Office and Fujitsu were complicit in the coverup, and the justice system utterly failed the defendants. All three are so poorly behaved, I hope some change will be triggered. Sadly, I think the way of the world is all organisations regress to the mean, and lots of them are allowed to let their mean get pretty low.

I consider “the full blame should be on the Post Office, and those involved.” a dangerous position. A systems must hold even if individuals fail or behave in malicious ways, and focusing strongly on individual culpability tends to overshadow the failures of the system. It’s very easy to go on from there to “If those individuals had just acted properly, none of this would have happened.”

I don’t mean to diminish the culpability of all those involved in the coverup, but the system needs fixing more than they need punishment. Fixing the system has a chance of preventing future harm, punishment does not, at least not to the same extend.

What on earth are you talking about? The system was working, until a few individuals actively sabotaged it for personal gain.

This wasn't cogs in a machine that went awry, this was intentional malicious behavior.

Handwaving about "fixing a system" is begging th question. No system made by humans can resist malice of those humans.

The system was obviously very much not working. Some of the individuals that caused this acted on negligence, some careless ass-covering, some probably maliciously for their own gain.

But there are a few key points that made it essentially impossible for the accused postmasters to defend themselves against the allegations, among them as a key point the presumption that computer records are correct and must be challenged by the defendant, not proven by prosecution. And to challenge these, you’d need to have the internal records that you can’t access as defendant - no surprise that many of the accused entered a plea deal, knowing that they’d never stand a chance in a trial.

Then, the Post office boasting powers to investigate and bring cases, while not being held to the same standards as the Crown Prosecution, meaning no independent review, no challenge.

This basically made all efforts to defend hopeless, and you can see the results. The cases did turn on the outstanding work of a few heroic individuals and a stroke of luck - if not for those, this all would have gone away quietly, with the postmaster convicted, broken, silenced.

A system that allows for that is broken, and the same thing will happen again, unless the shortfalls are addressed, because careless, negligent and even somewhat malicious individuals are plenty, and heroic people defending are rare.

I can recommend reading this, which sheds some light on the legal details that made the scandal possible at this scale. https://emptycity.substack.com/p/how-the-legal-system-made-i...

> No system made by humans can resist malice of those humans.

Some systems have a better chance of resisting a few malicious actors within than others.

There's no reason not to do both: punish the people who broke the law and also think how in the future we might prevent such a disaster happening again (or expose it sooner, or minimize the damage it can do)

> They constantly change, morph requirements,

I saw this directly in California too. State employee bureaucrats changing the spec and deliverables, even on tight deadline or high priority results.

It seems nuts to me that the Post Office was allowed to prosecute their own cases rather than pass what information they had to the police who could conduct an independent investigation.