What happened
It was reported that for more than a decade the Post Office, the company that runs Britain’s postal counters, prosecuted the people who run its branches for money that had gone missing from their accounts. The missing money was recorded by an accounting system called Horizon, built and maintained by the technology company Fujitsu. Branch operators, known as subpostmasters, are personally responsible for shortfalls in their accounts, so when Horizon showed a shortfall they were told to pay it back. Between 1999 and 2015 the Post Office brought criminal cases against more than 700 of them for theft, fraud and false accounting on the strength of what Horizon reported. Many were convicted, some were sent to prison, others handed back money they said they had never taken, and many were ruined.
It was reported that the shortfalls were not real. In the 2019 High Court case Bates v Post Office, the judge found that Horizon contained bugs, errors and defects that could show a shortfall a branch had not caused, and that its records could be altered remotely without the branch operator knowing. In 2024 Parliament passed the Post Office (Horizon System Offences) Act, which quashed the convictions together. The public inquiry into the scandal, chaired by Sir Wyn Williams, published the first volume of its final report in July 2025. It found that at least thirteen people who had been accused may have taken their own lives, that fifty-nine others told the inquiry they had thought about it, and that as many as ten thousand people were affected, a group far wider than those prosecuted. Sir Wyn wrote that senior employees of the Post Office knew, or at the very least should have known, that the older version of Horizon was capable of error, and that the Post Office maintained the fiction that its data was always accurate.
What an auditable version would have shown
The case against each subpostmaster rested on one thing: that the figure Horizon reported was true. And no one on the outside could check whether it was. An auditable version keeps a signed record of every entry and every change, including changes made remotely, sealed so that nothing can be altered after the fact without it showing. If Horizon had kept records like that, the question at the heart of every trial, whether a shortfall was real money gone missing or a fault in the software, could have been answered from the record. Instead it was something the Post Office could assert and a court would accept.
Where the gap was
A number produced by a computer was treated as proof that money had been stolen, and the people it accused could neither see how it was produced nor show it was wrong. A ConductRecord keeps a signed, hash-chained account of what a system did, each entry sealed to the ones before it, so a later change is visible and a remote alteration cannot be made in silence. With a record of that kind a shortfall becomes a claim that can be tested: traced back through the entries, checked against what the branch actually did, and shown to be genuine or a bug. Horizon produced the figures, the records could be altered remotely, and for years no one on the outside could tell a theft from a defect.
What governance should have looked like
Where a computer’s record is used to accuse someone of a crime, the record has to be tamper-evident and open to independent checking, so the person accused, and the court, can see whether it is reliable before anyone relies on it. The High Court found that Horizon was not reliable and that its records could be altered remotely, and the inquiry found that the Post Office treated the data as accurate while its own people knew it could be wrong. A signed record does not decide whether someone is guilty. It makes the reliability of the evidence a question that can be answered, rather than an assumption that took twenty years and a public inquiry to undo.
If you or someone you know is struggling, support is available in Australia from Lifeline on 13 11 14, and in an emergency you can call 000.
Failure Pattern: a computer system’s figures were used to accuse people of crimes and treated as proof, while the system was known to produce errors and could be altered without the accused person being able to see it or check it.
Governance Principle: where a computer’s record is used to accuse a person, that record must be tamper-evident and independently checkable, so its reliability can be tested before anyone is required to answer for it.
The reference implementation of ConductRecord, with its signing and hash-chaining, is open source. It lives at github.com/saffronandindia/headlights-oss, Apache 2.0 licensed and free to install. The repository is public now.
Sources
- Post Office Horizon IT Inquiry (official inquiry site and final report)
- Post Office Inquiry: Horizon scandal drove 13 people to suicide, report finds (ITV News)
- Post Office Horizon scandal explained: everything you need to know (Computer Weekly)