Cameron government knew Post Office ditched Horizon IT investigation

David Cameron’s government knew the Post Office had ditched a secret investigation that might have helped wrongly accused postmasters prove their innocence, the BBC can reveal.

The 2016 investigation trawled 17 years of records to find out how often, and why, cash accounts on the Horizon IT system had been tampered with remotely.

Ministers were told an investigation was happening.

But after postmasters began legal action, it was suddenly stopped.

The secret investigation adds to evidence that the Post Office knew Horizon’s creator, Fujitsu, could remotely fiddle with sub-postmaster’s cash accounts – even as it argued in court, two years later, that it was impossible.

The revelations have prompted an accusation that the Post Office may have broken the law – and the government did nothing to prevent it. Paul Marshall, a barrister who represented some sub-postmasters, said: “On the face of it, it discloses a conspiracy by the Post Office to pervert the course of justice.”

Senopathy Narenthiran, known as Naren, a convicted sub-postmaster from Ramsgate in Kent who joined the legal action, wiped away a tear as he learned about the information that might have helped his case.

“By knowing all this, why do we waste all our time in the prison and separate from our family? I don’t know,” he told the BBC. “I’m 69 years old – too old to go through all these things.”

The secret investigation was uncovered through a BBC analysis of confidential government documents, obtained under the Freedom of Information Act, from a time in 2015 and 2016 when the Post Office was under growing pressure to get to the bottom of sub-postmasters’ claims of injustice.

Hundreds of sub-postmasters had been prosecuted and jailed for cash shortfalls which were in fact caused by the Horizon IT system. They had long suspected that remote tinkering may have contributed to the problem.

The documents show how the secret 2016 investigation – looking into Fujitsu’s use of remote access from 1999 onwards – had come out of a review by former top Treasury lawyer Jonathan Swift QC. The Swift review had been ordered by the government, with approval from then-business secretary Sajid Javid.

It would conclude that it had found “real issues” for the Post Office.

Mr Swift had found a briefing for the Post Office board from an earlier review in 2014, carried out by auditors from Deloitte and codenamed Project Zebra, detailing how Fujitsu could change branch accounts.

Having seen that evidence, the Swift review said the Post Office must carry out a further investigation into how often and why this capability was used.

Deloitte returned in February 2016 to begin the trawl of all Horizon transactions since its launch 17 years earlier.

Ministers, including Mr Javid, were told this new work was under way to “address suggestions that branch accounts might have been remotely altered without complainants’ knowledge”.

But in June 2016, when sub-postmasters launched their legal action, the government was told through Post Office minister Baroness Neville-Rolfe that the investigation had been scrapped on “very strong advice” from the senior barrister representing them.

There is no evidence in the documents that then-prime minister David Cameron knew about the investigation or that it had been ditched.

It meant that over two years, the Post Office had spent millions of pounds on three separate reviews into remote access – Project Zebra, the Swift review and the 2016 Deloitte investigation – while publicly claiming it was impossible.

But all three were buried by the Post Office. Neither the Swift review nor Project Zebra were disclosed to sub-postmasters, depriving them of vital information that could have helped them in court; and the Deloitte investigation was halted before it could deliver its findings.

Project Zebra, the first of the three reviews, was described as a “desktop review”. The Post Office board had hoped it would give “comfort about the Horizon system” to them and others outside the business who had concerns about it.

The consultants examined Horizon documents and talked to employees at Fujitsu and the Post Office to check how the system was functioning and whether it was achieving its objectives.

Unredacted documents obtained by the BBC show that in April 2014, members of a sub-committee of the Post Office board discussed Deloitte’s Project Zebra work.

The sub-committee included chief executive Paula Vennells, general counsel Chris Aujard and Richard Callard, a senior civil servant at the government body which owned the Post Office.

The next month, Deloitte submitted its full report and in June it wrote a briefing for the Post Office board, which outlined two separate ways Fujitsu could alter branch accounts. Extracts from the board briefing are quoted verbatim by the Swift review but the briefing itself has not been released.

It said the auditors had learned that authorised Fujitsu staff with the right database access privileges could use fake digital signatures or keys to delete, create or amend data on customer purchases that had been electronically signed by sub-postmasters. Fujitsu staff could then “re-sign it with a fake key”.

Deloitte said Fujitsu staff had also been able to correct errors using an emergency process known as a “balancing transaction”, which can “create transactions directly in branch ledgers”.

It noted the process “does not require positive acceptance or approval by the sub-postmaster”.

Yet the findings of Project Zebra were never disclosed to investigating accountants Second Sight who, since 2012, had been publicly tasked by the Post Office with looking in to sub-postmasters’ claims.

The Post Office continued to claim for a further five years that it was impossible for remote tinkering by Fujitsu to alter cash balances in Post Office branch accounts.

In 2015, it lied to BBC executives as it sought to prevent the broadcast of the first Panorama expose of the scandal, briefing them that there was “simply no evidence” that remote tinkering by Fujitsu could have caused branch losses.

The documents that have now been analysed by the BBC reveal that following the Panorama broadcast, Post Office minister Baroness Neville-Rolfe wrote to the incoming chairman, Tim Parker, asking him to give the concerns about possible miscarriages of justice his “earliest attention” and take any necessary action. Business Secretary Sajid Javid approved the letter.

Mr Parker said he would undertake a review of the Horizon system and “various claims that sub-postmasters had been wrongly prosecuted as a result of faults in the system”, according to a briefing sent to Mr Javid on 20 November 2015, which was heavily redacted in the released documents.

Mr Parker appointed Jonathan Swift QC and barrister Christopher Knight. They were so concerned about the implications of the Project Zebra documents, they said it was “incumbent” on the Post Office to find out how often these two means of altering branch accounts had been used, “in the light of the consistent impression given that they don’t exist at all”.

The Swift review, dated 8 February 2016, noted that the Post Office “had always known” about the balancing transaction capability.

It also said the Post Office may be obliged by law to show the documents to postmasters who were seeking to overturn their convictions.

In response to a recommendation in the Swift review, Deloitte was asked within days to return to the Post Office to carry out a full independent review of Horizon, following up on its work on Project Zebra.

The mammoth and expensive task was to trawl back through all the transactions since Horizon began operating – work which was anticipated to take three months.

In a letter of 4 March 2016, Post Office chair Tim Parker wrote to Baroness Neville-Rolfe about the Swift review’s findings and recommendations. That included informing her about Deloitte’s follow-up work.

He said it would “address suggestions that branch accounts might have been remotely altered without complainants’ knowledge” and review “security controls governing access to the digitally sealed electronic audit store of branch accounts”.

He added that he had “commissioned independent persons to undertake the necessary work”, and in a later briefing informed the minister that this was Deloitte.

The letter did not explicitly mention Project Zebra or Deloitte’s earlier findings about how branch accounts could be remotely altered.

In April, the Post Office notified the government that the sub-postmasters had begun their group legal action against it. Baroness Neville-Rolfe and Mr Javid were sent a briefing, updating them on the investigation’s progress and discussing how the legal action would affect it.

The briefing, sent before a meeting with Mr Parker, was heavily redacted when it was released under a Freedom of Information Act request. But it said Mr Parker was on track to complete the follow-up work by the end of May and would update Baroness Neville-Rolfe on its progress.

However, the documents seen by the BBC reveal that in June, Deloitte’s three-month investigation was suddenly stopped just before it could be completed.

On 21 June 2016, Tim Parker told Baroness Neville-Rolfe he had taken the decision on the advice of an unnamed senior barrister for the Post Office.

He told her the detailed work being carried out by Deloitte was “complex, costly and time consuming” but that good progress had been made. “I had hoped that by now I would be in a position to draw my investigation to a close,” Mr Parker wrote.

“However, given the High Court proceedings to which I refer above, Post Office Limited has received very strong advice from Leading Counsel that the work being undertaken under the aegis of my review should come to an immediate end… I have therefore instructed that the work being undertaken pursuant to my review should now be stopped.”

In response to the BBC’s questions, Mr Parker said he had “sought and acted upon the legal advice he was given”, but said it would not be appropriate to comment further while the public inquiry into the Horizon scandal was ongoing.

Baroness Neville-Rolfe told the BBC she had said publicly that she had instructed the Post Office chairman to commission an independent review, but declined to comment further while the inquiry was ongoing. Mr Javid also declined to comment because of the public inquiry.

In his High Court judgment at the end of the sub-postmasters’ legal action in 2019, judge Sir Peter Fraser found the Post Office’s defence claim – that Fujitsu could not insert transactions in branch accounts – was “simply untrue”. He said the Post Office had “expressly denied” that remote access was possible “and that denial is now shown to be wrong”.

The barrister who represented a number of wrongly prosecuted sub-postmasters, Mr Marshall, told the BBC it looked as though the Post Office had conspired to pervert the course of justice.

“The important feature of all of this is that in 2014, it appears that the Post Office board was alive to the true position – that remote access by Fujitsu was possible,” he said.

“And yet the Post Office board was responsible for maintaining and advancing the Post Office’s defence to the sub-postmasters’ claim in 2019 – that it was impossible. That was false – and, it would appear, known to be so.”

Paula Vennells, the former chief executive of the Post Office, did not respond to the BBC’s requests for comment. Chris Aujard, then Post Office general counsel, and Richard Callard, the civil servant who represented the government on the board, declined to comment while the public inquiry was ongoing.

UK Government Investments (UKGI), the government body which owns the Post Office, addressed what the board knew about these successive reviews and investigations in an opening statement in 2022 to the ongoing public inquiry into the Horizon scandal.

It said there was no indication in the minutes of the Post Office board meeting in June 2014 that the board had received the Project Zebra briefing. UKGI said Mr Callard “does not recall ever receiving such a briefing”.

The statement said the board had not asked for a copy of Deloitte’s full report at the time of Project Zebra. UKGI said the board had been given an executive summary by the Post Office general counsel Chris Aujard, which was “focused on Deloitte’s approach to the review but importantly did not set out its findings”.

It said the board had also never received the 2016 Swift report, nor been briefed in detail on its findings. The statement said Tim Parker did not send Swift’s full report to the Post Office Board and that his letter of 4 March 2016 to Baroness Neville-Rolfe did not make clear how serious the Swift review’s findings were.

The revelations uncovered by the BBC also raise serious questions for the public inquiry by Sir Wyn Williams, as to whether it is adequately scrutinising what the government knew about the Post Office’s internal investigations.

In UKGI’s 2022 statement to the inquiry, there was no reference to Tim Parker’s letter to Baroness Neville-Rolfe of 21 June 2016, notifying her he was calling off Deloitte’s investigation.

In 2018, two years after completing his review, Sir Jonathan Swift, formerly First Treasury Counsel – the top civil lawyer at Her Majesty’s Treasury – was appointed to be a High Court judge. He received a knighthood in the same year.

However, in the list of upcoming witnesses at the Williams inquiry, his name is absent.

June 2014: Deloitte submits a briefing for the Post Office board on Project Zebra, outlining how Fujitsu can alter branch accounts or change records of transactions remotely.

10 September 2015: Business Secretary Sajid Javid approves a letter from Post Office minister Baroness Neville-Rolfe to Post Office chair Tim Parker, urging him to take “any necessary action” about Horizon, after a Panorama whistleblower reveals how Fujitsu can remotely alter postmaster’s accounts.

20 November 2015: Mr Javid is briefed that Mr Parker is undertaking a review into the Post Office IT system to look into claims that sub-postmasters have been wrongly prosecuted as a result of faults in the system.

8 February 2016: The resulting report by Jonathan Swift QC and barrister Christopher Knight recommends a full independent investigation into how often and why Fujitsu altered accounts and records “throughout the lifetime” of Horizon.

4 March 2016: Mr Parker tells Baroness Neville-Rolfe and Mr Javid he has commissioned “independent persons” to address “suggestions that branch accounts might have been remotely altered without complainants’ knowledge”.

21 June 2016: In a letter, Mr Parker tells Baroness Neville-Rolfe that in the light of the sub-postmasters’ group legal action, on “very strong advice from leading counsel”, the investigation by Deloitte has been immediately stopped. It never completes its work.

Are you affected by the issues raised in this story? Share your experiences by emailing haveyoursay@bbc.co.uk.

Please include a contact number if you are willing to speak to a BBC journalist. You can also get in touch in the following ways:

If you are reading this page and can’t see the form you will need to visit the mobile version of the BBC website to submit your question or comment or you can email us at HaveYourSay@bbc.co.uk. Please include your name, age and location with any submission.