Expert witness. Collection and interpretation of digital evidence. Analysis of the causes of failure, delay and overspend in technology enabled projects.
Who in the PO signed off on the decision to execute the recusal application against Fraser J in 2019? It must have been at the very Top of PO or GOV and was effectively pressing the nuke button in your dying breath, wasting £m’s of tax payer cash and adding that the legal costs.
@TomWitherow
@TomWitherow
Post Office had my Expert
Report in 2003 telling them the system was faulty and they could not rely on the evidence from it in its Cleavleys case
@nickwallis
@Karlfl
if any current or past sPM’s need help considering or dealing with resistance to claims (such as ‘losses do not relate to horizon’ etc) then I’m happy to assist them at zero cost. I will retain independence, not hired gun but might be of benefit.
SPM’s might not only have been exposed to shortfalls caused by bugs, errors and defects in Horizon but also bugs, errors and defects in Post Office’s 3rd party ‘clients’ who processed sPM transaction data and fed it into horizon back end.
#PostOfficeScandal
from todays hearing the timing of the 2010 discovered receipts and payment mismatch bug and the preparation for the
@SeemaMisra7
trial. The actions of PO “expert witness”, legal team and decisions makers surely must be considered for conspiring to pervert?
Lancashire IT expert says Post Office 'ignored warnings of software faults 20 years ago'. Jason Coyne said the 'bugs and errors were there' and they pressed ahead blaming the sub-postmasters
I’m speaking today
@TechShowLondon
with
@nickwallis
. One of the key event messages is do no harm. Over breakfast I had the opportunity to rewatch one of the inquiry submission from dec 2022 from
@edwardhenry1
the harm that the Horizon systems, supporting processes and corp
In the week it was revealed that the Post Office had spent twice as much on lawyers than on compensation, here are my submissions from December 2022 during the Compensation Hearing PM (08 Dec 2022) - Post Office Horizon IT Inquiry via
@YouTube
Off counter’ transactions (Camelot, Paystation etc etc ) that come in to sPM accounts via transaction acknowledgment (TA) are the next minefield, I reported it in the GLO but did not have full evidence. It now appears that Oths looked at this and told PO of the risks.
@PaulMar72224296
@stugoo17
Network banking, lottery, fx, ATM, phone top ups and any other 3rd party PO sales were reliant on non horizon data but that non horizon data would later interface with horizon into the back end interfaces (typically overnight, but some weekly) and that could cause adjustments to
@darrenpjones
Diligently doing job is surely part of what you do for your salary? Assisting the inquiry is a duty. Why did anyone think that 100% compliance with a task should attract a bonus? These are experienced high salary adults not dogs or children.
Rishi Sunak tells
#bbclaurak
the Post Office miscarriages of justice were “something that happened a VERY long time ago- in the 90s”
Meanwhile, the Post Office have admitted that between 1999 and 2015, more than 700 managers were accused of fraud due to flawed computer evidence.
After speaking at
@TechShowLondon
, I had the fantastic opportunity to engage with several Chief Technology Officers from big name global companies. It's evident that the red flags observed in the Post Office regarding Horizon are also prevalent in many other tech-enabled firms,
Admin: “when we have restored the back up, the data is three years old”
Me: “can I see your daily backup logs?”
Admin: “we don’t have logs, but I thought we would have seen an error if it was not working”
@Janetsk20073533
@stugoo17
@RonRwarming
@forensicgod
@PostOffice
@fujitsu_uk
Thanks Janet, your words mean a lot to me. I was just this morning watching your appearance on talk tv and it moved me. Whilst my professional opinions and investigations are never influenced by human impacts, I feel driven that the true must be discovered.
@RichardMoorhead
@ArchNichola
I still to this day don’t know how PO manage to get away with not answering some key Expert’s questions in GLO put to them under CPR35.14. The full RFI doc was over 100 pages but looking back on what was not answered, its now becoming clear why.
@Jusmasel2015
I think I recall a PO witness to inquiry saying that there was no NDA in your case. Perhaps the
@PostOffInquiry
should ask that witness to correct their mistake.
Just to be 100% clear, because people keep asking on my Twitter messages. I signed an agreement not to talk about my personal involvement with the Horizon case and I will not be breaking my word.
@VarchasPatel
I’m not close enough to the counter process, but risk is: £10 transaction entered off counter and £10 received into till. off counter provider has bug/error/defect in its own system and reports to PO that it was £20 transaction. SPM gets rolled up TA with £20 and forced it accept
@BrianARogers62
@CastletonLee
I’ve designed and managed ediscovery exercises across many jurisdictions since 2011 to present. I’ve never seen such a selection and review process that had not been approved by the person signing off the disclosure statement (I.e POL) I can’t see external legal taking this risk
@FloraClairePage
@teem50
@stugoo17
@RichardMoorhead
@brianwhelton
@Jusmasel2015
risk with deleting a message store and rebuilding from another node is that you don’t have any way to validate the integrity of the node being used as source. We know node hard drives where suffering significant sector failure therefore source could be missing tx’s
@Bingbong0055
@joe_armitage
But to be fair, those questions are to illicit dialogue with the visitor and judge risk based on the response - content and delivery. It’s not just for a chat.
@Jusmasel2015
The other poss of losses (or gains) with ATM’s is the the ATM’s reported the cash position to the bank and the bank reported to POL we know that this back end interface could suffer bugs/errs/defects and POL by default took bank position as truth. lottery was same.
@RichardMoorhead
The term ‘near dupes’ was mentioned by the PO in house Counsel. Assessing based on ‘near dupes’ can be very risky when it comes to email and families, and you need to test and retest the near dupe thresholds. The only safe dedupe is based on forensic match (called MD5 matching)
@PeterHoward9090
@mkiceburnmarko
@RichardMoorhead
Relativity will handle the review of family documents, they are displayed like a family tree but it appears that a decision was taken (don't know by who or when) that you do not need to review other documents in the family if they do not contain the target word
@JohnRConstable
@Karlfl
Hi
@JohnRConstable
. Great insight, thank you. In the early 2000’s did you get any visibility of the poor quality hard drives on the horizon terminals? The docs that I was later seeing in Bates suggested a high rate of disk sector failure in the early days. Also would be
@brianwhelton
@Steel_Con
Although I’m shocked by that original LinkedIn text, I attended a number of meetings during the GLO where WBD where there representing PO and resisting my requests to examine evidence, so not surprised at the sentiment.
@Karlfl
@Karlfl
- how many other systems are producing data used in criminal prosecutions? These will likely have similar bugs/errors and defects but go unchallenged
@RichardMoorhead
You can safely say if two documents have matching MD5’s they are forensically identical so only need to read one. With ‘near dupe’ they only x% the same (and therefore are different) the difference could conceivably be an extra attached document or a couple of different words.
@james_christie
@alikelman
In cases involving complex digital evidence, only defendants with significant financial resources can afford a proper defense on their own. This is because Legal Aid funding falls short of covering the extensive time investment required for such cases, at rates not acceptable to
@Jusmasel2015
@PostOffInquiry
Yes, could be gains or loss for the SPM. the bugs/error/defects often lost an actual transaction or one part of the transaction was duplicated. But also consider the network banking customers who paid cash over the counter via Horizon, did it always make it to their bank account?
@RichardMoorhead
@PeterHoward9090
@mkiceburnmarko
Might be, but typically if I was in KPMG's position (and I have in many other unrelated and non-PO matters) then I would not make that de-dupe/near-dupe decision without first ensuring the client understood the impact & getting it signed off. I dont know the facts here.
In the latest PO letter re: latest disclosure failures, it was said that GLO disclosure also from mimecast, so will have suffered from the similar impact. I.e data will have been missing.
@PaulMar72224296
Very thoughtful report Paul. Through Horizons operational life there were many different bugs, errors and defects that resulted in a receipts and payment mismatch, not just one bug. The Experts Joint statement 2 and 3 (Horizon issues) set these out in a table.
WhatsApp messages are not only stored on the user iPhone, if you have control over the phone number (I.e from having the sim or getting the network to give you a new sim in that telephone number) you can retrieve the old WhatsApp messages and media of that user without the phone
@stugoo17
Faced with two different figures of a transaction, one from Post Office client and the other from sPMs horizon till roll, it appear PO most often took the clients value and issued a TC to sPM to pay the difference.
@james_christie
@Jusmasel2015
@CastletonLee
And an experienced technical expert, with sufficient budget and determined use of CPR35.14 to gain access to evidence. None of which are practically available on legally aided matters.
@chrish9070
@stugoo17
@mkiceburnmarko
In 2004 I examined some Helpdesk call logs from 2001/2002 (spm/po/fj) at the time I said, sounds like terminal hardware as many operating system crash dumps/panic logs being collected. I requested the logs via parties but the case went away (at least from me) Inquiry is aware.
@chrish9070
@darrenpjones
@FT
@CommonsBTC
How low must your expectation be of your executive board if you need to incentivise hundreds of thousands of pounds of essentially tax payer money just to get them to deliver your own documents to the inquiry on time? …they largely failed…but the bonus were paid anyway.
@chrish9070
@CWUPostmaster
Agreed but if the bug was with lottery terminal the prize win might not be shown at end of day report. All PO have in audit data is the TA amount from Camelot which might match their faulty lottery terminal. Only Theoretical risk, I accept. But multiple by all 3rd party systems
@Jusmasel2015
No, I’ve had a quick read of all my served GLO expert reports and joint statements, I don’t believe it appears. KEL (know errors) LKiang2837P references “counter freezing when PM selects Transaction Correction”. But that’s from 2005
@chrish9070
@stugoo17
@mkiceburnmarko
Not familiar. Two are disk subsystem faults (physical). The file allocation table says the file is on the disk but when the sector is visited it’s not there or different size than record in FAT (or equivalent). One is virtual memory which should not make it out in the wild!
@chrish9070
@nashoban_info
@stugoo17
@mkiceburnmarko
FJ could ‘push’ a request to reboot from head office. Either ‘do it overnight’ or ‘do it now’. In addition the horizon terminal looked for new updates (bug fixes/adjustments/log collect etc) when it booted but this required good coms and might in itself require multiple reboots.
@CastletonLee
in Relativity, the system used by PO to host the review. Each item (doc/attachment etc) has its own activity log, so an admin could determine when/if any doc (or one of its dupes) was displayed to a reviewer and what the reviewer marked the document with. Would be helpful to see
@brianwhelton
@Jusmasel2015
@Wipro
@fujitsu_uk
And why was the report not disclosed in bates trial? I would struggle to see it’s not relevant or privileged. It was a category of document that was requested from PO.
@pope2023
@mkiceburnmarko
@BrianARogers62
@CastletonLee
Too risky, you would need knowledge of specific internal key words, document types then what systems would you say need to be searched? Possible, but across multiple docs owners something would be missed and the argument would be “you never said we needed to search x”
@chrish9070
@CWUPostmaster
if Camelot sys had a bug and did not record a £10 prize you paid out, they could not tell PO your correct balance…your TA would be wrong and your branch account then shortfall. How would sPM check as lottery terminal likely does not have the correct record of the £10 payout.
@pope2023
@mkiceburnmarko
@BrianARogers62
@CastletonLee
Easy with knowledge of the systems but needs contemp in-house knowledge of what such docs might be called (or what language is contained within). Agree all perfectly manageable. KPMG are doing it from the inside, not externally stating how it need to be done.
@teem50
@sjmurdoch
@brianwhelton
@stugoo17
@RichardMoorhead
@Jusmasel2015
Operating system was NT 3.5.1 then 4 in the early days. Bad block/disk sectors were problematic with the initial write so often nothing to sync p2p. Although you should have been to detect the missing transactionID but that become part of the later back end checks.
@chrish9070
@nashoban_info
@stugoo17
@mkiceburnmarko
So either would have been available a controlled power cycle (issue shutdown to all processes, allow timeout etc) or kill straight away. It’s just like the ‘init’ functionality in *nux. It’s likely they went for controlled else they are creating the position for additional issues
@mkiceburnmarko
@ReadOnly67976
@stugoo17
@chrish9070
If pre-2010 (horizon,legacy) then yes. If transactions did not need online check then messages (transactions) written locally and replicated across terminals in branch to provide some fault tolerance until periodically polling took place.
@ncseymour
@CastletonLee
@scepticalists
@DanNeidle
@TheLoblaw
There always needed to be a support function to provide a) remote access and b) insert journaling entries to correct faults (all systems are fallible) That said, both functions needed to be securely controlled, verbosely audited and publicly accepted.
@KateJon41196503
@stugoo17
@Jusmasel2015
It’s defo a risk…if you have the TA’s then where did PO get that information from to issue you with a TA? It has to be PO’s client (pay station) who provided it to PO and have just passed it on to you. So something that need investigation.
@chrish9070
@stugoo17
@mkiceburnmarko
2014, so horizon X less dependant on HDD for longer term transaction (if comms working then only transaction in progress stored locally then pushed) . Lkely why they focused on fixing telecoms.
@PeterHoward9090
@Justlur97399145
@CastletonLee
@RichardMoorhead
@BrianARogers62
The best start is to speak to the document owners to understand the types, formats, locations where stored, then build a keyword list and series of search patterns (OCR+Boolean) that would locate candidate documents to be presented to intelligence reviewers in their families.
@Jusmasel2015
Whilst the report PO ref may be the owned by the bank. PO must have an internal report where they are considering if the theft had any impact on sPM’sand this will be PO’s and should be disclosed
@Jusmasel2015
@nickwallis
@Karlfl
The known error logs (KELs and Peaks) when provided to me were all separate documents (many thousands of text files) disclosed over an extended period, It would not surprise me to find that these were each considered prior to me seeing them.
@ReadOnly67976
@stugoo17
@mkiceburnmarko
@chrish9070
No short answer to this. But In different ways on horizon to horizon-X (pre-post 2010). My first and supplemental report as well as the joint expert statement (think there were 6) May assist. I recall doing a failure mode diagram as a anne to one report but can’t remember which.
@TimMeggs
So true, I’ve look at enterprise systems where there is no knowledge left within the organisation of how the data flows.
Management petrified if they ever need to just reboot any part of the system.
No one knows disaster recovery plans.
Backup confidence simply built on
@CWUPostmaster
When cash is paid out to winning lottery winners, say £10 i) does the £10 come out of sPM’s cash drawer or is there a separate Camelot cash drawer? ii) is the sPM effectively negative until the TA arrives? iii) is the TA a rolled up total of all Camelot? iv) frequency of ta?
@RosieBrock71780
@chrish9070
I think the decision was so significant in terms of impact that all would have wanted ‘coverage’ for the very top. Must/should have been considerable SWOT analysis, senior presentations budget allocation, PR prep etc etc