Faultory

Case file 73 · Systems & technology

The computer said the cash was missing

Post Office Horizon, 1999 onward: why was the computer believed when it reported missing money?

Subject
Post Office Horizon scandal
Reading
14 min
Evidence
5 exhibits
Reasoning
4 steps
Level
Advanced
Service counter inside a post office branch, with a glass screen and counter fittings.
Photographed 2 April 2021 A Post Office counter in Seaforth, photographed in 2021, shown for setting. It is not a branch named in the case. Photo: Rodhullandemu · CC BY-SA 4.0 · Wikimedia Commons.
Illustrative signature. An illustrative strip-chart sketch of a recorded balance that holds near a steady level, then drops and stays low, as an unexplained shortfall might appear; it is a sketch, not data. Drawn to explain the case, not plotted from source data.

01 · The briefing

Begin with the question.

The Post Office introduced a computer accounting system called Horizon into its branches from about September 1999. Branch managers, known as subpostmasters, were responsible for the cash and stock in their offices. When Horizon showed a shortfall, the Post Office generally treated it as a real loss and asked the subpostmaster to repay it, and some people were prosecuted for theft or false accounting on the strength of Horizon data. The Post Office's position was that the data was wholly reliable. Subpostmasters said the system produced false figures, and complaints began soon after the rollout. Three explanations are worth testing: that subpostmasters were dishonest or careless, that the problems were isolated errors in a few branches, and that the software was reliable enough to treat its output as proof. This investigation separates three questions. Was the system capable of producing false data? Did the operator have grounds to treat its data as correct? And how did the institution respond when a problem was reported? The sources are two judgments from the English courts and the Inquiry's first volume of its final report, which was ordered printed in July 2025. Decide which explanation the record supports, and which parts remain disputed.

Stone gateway and facade of the Royal Courts of Justice in London.
Where it happenedPhotographed 20 April 2019 The main gate of the Royal Courts of Justice in London, shown for context; it does not depict any hearing in the case. Photo: David Castor · CC0 · Wikimedia Commons.

The timeline

  1. The Post Office begins rolling out Horizon to branches. The Inquiry records that some Fujitsu employees had found before the rollout that Legacy Horizon could produce false data.

  2. A bug later named Callendar Square is discovered at a branch. The judgment says it undoubtedly caused discrepancies in the accounts.

  3. The Dalmellington bug is discovered at a branch; a Fujitsu witness accepted that it had probably been present from 2010.

  4. The Post Office decides not to investigate other incidents further and to stand down those tasked with investigating. The judge calls the decision surprising for a reputable institution.

  5. The High Court hands down the Horizon Issues judgment, which finds that bugs could cause apparent shortfalls and had done so on numerous occasions.

  6. The Court of Appeal allows the appeals of 39 of the 42 appellants in Hamilton and others v Post Office and quashes their convictions, saying the Post Office effectively sought to reverse the burden of proof.

  7. The House of Commons orders the Inquiry's Volume 1 to be printed. It says many hundreds of people were convicted, wrongly, of criminal offences.

A researched reconstruction for learning. These reasoning steps simplify a complex record; no score can capture the full history.

02 · The evidence

What does the record show?

Read each exhibit before settling on an explanation. The source links below every exhibit lead to the record behind it.

Exhibit 01

Bugs could cause shortfalls, and they had happened

The Horizon Issues judgment, Bates v Post Office (No 6) [2019] EWHC 3408 (QB), asked whether bugs, errors or defects could create apparent shortfalls in branch accounts. The judge found that they could, and that the evidence showed this had actually happened on numerous occasions, in both Legacy Horizon and Horizon Online. He also said the precise extent of their effect could not be calculated. This establishes that bugs were a real and recurring risk. It does not establish how many individual shortfalls they caused.

Source record s1judiciary.uk

Exhibit 02

Reliability differed by version

The judge's summary answer says Legacy Horizon, used until 2010, was not remotely robust, because of the number, extent and type of its bugs, errors and defects. He found that the robustness of HNG-X, the online version that followed, was questionable and did not justify the confidence the Post Office had stated before February 2017. He found HNG-A, in use from 2017, far more robust than the earlier versions. This establishes that reliability changed over time. It does not establish that any specific shortfall was caused by a specific bug.

Source record s1judiciary.uk

Exhibit 03

A known bug, and a decision to stop looking

The judgment describes two bugs the Post Office accepted existed. Callendar Square was discovered in 2005 at a branch, and the judge said it undoubtedly caused discrepancies in its accounts. The Dalmellington bug was discovered in 2015. In July 2016 the Post Office decided not to investigate further and to stand down those tasked with investigating, which the judge called a surprising decision for a reputable institution. This establishes that the operator chose to stop looking. It does not establish how many other branches were affected, which the judgment leaves open.

Source record s1judiciary.uk

Exhibit 04

Remote access, and the limits of what the record says

The judgment records a former Fujitsu employee, Mr Roll, saying that remote access to branch systems was extensive, was done without postmasters being aware, and that data and transaction information could be changed. The judge said his use of frequently and routine was subjective, and that it was not possible to come to a concluded view on how often this happened, given the years since he left Fujitsu. He did find the occasions were not isolated incidents on his evidence. This establishes that remote changes were described in evidence as more than rare. It does not establish how often they affected a particular branch.

Source record s1judiciary.uk

Exhibit 05

Shortfalls treated as debts, and the burden of proof

In Hamilton and others v Post Office Ltd [2021] EWCA Crim 577, the Court of Appeal accepted that when unexplained shortfalls were challenged, the Post Office treated them as undisputed debts, and that even a subpostmaster who resigned still owed the disputed sum. It said that by representing Horizon as reliable and refusing to countenance any suggestion to the contrary, the Post Office effectively sought to reverse the burden of proof. The court quashed the convictions. The judgment concerns the appeals before it, and does not by itself establish the facts of every other conviction.

Source record s2judiciary.uk

03 · Your reasoning

Follow the strongest explanation.

Choose an interpretation, then compare it with the evidence. You can revise your choice. The goal is understanding, not a perfect score.

Reasoning step 01 of 04

Which explanation best accounts for the shortfalls that the Post Office treated as real losses?

Evidence-based explanation

The judgment answers the Horizon Issues by finding that bugs, errors and defects could create apparent shortfalls and had done so repeatedly, in both Legacy Horizon and Horizon Online. The Court of Appeal adds that the operator treated Horizon data as proof of missing money. The first option assumes accurate recording, and the others conflict with findings across branches and versions. The record does not show how many individual shortfalls were caused by bugs.

Weigh it against

Exhibit 01Bugs could cause shortfalls, and they had happenedExhibit 02Reliability differed by versionExhibit 05Shortfalls treated as debts, and the burden of proof

Reasoning step 02 of 04

What does the evidence on remote access most directly support?

Evidence-based explanation

The judge recorded a witness's account that remote access was extensive and could change transaction information without the postmaster's awareness. He treated words such as frequently and routine as subjective, and said he could not reach a concluded view on how often this happened, while finding the occasions were not isolated. The best-supported reading is a real capability used on more than rare occasions, with frequency unresolved. The other options overstate or deny the evidence.

Weigh it against

Exhibit 04Remote access, and the limits of what the record says

Reasoning step 03 of 04

Which description of the Post Office's handling of disputed shortfalls is best supported?

Evidence-based explanation

The Court of Appeal accepted the finding that challenged shortfalls were treated as undisputed debts, and that a resigning subpostmaster still owed the disputed sum. The options describing an independent review, suspension or admission conflict with that account. This does not show that every debt was wrongly charged, since the courts decided specific cases. It does show that the recovery process assumed the data was right.

Weigh it against

Exhibit 05Shortfalls treated as debts, and the burden of proof

Reasoning step 04 of 04

Which account of the Post Office's response to reported bugs is best supported?

Evidence-based explanation

The judge found that the Dalmellington bug was discovered in 2015, and that in July 2016 the Post Office decided not to investigate other incidents further and to stand down those tasked with investigating. The judge called that decision surprising. The Post Office had also accepted that Callendar Square was a bug. The best-supported account is a serious early investigation followed by a retreat from further investigation.

Weigh it against

Exhibit 03A known bug, and a decision to stop looking

04 · The findings

The chain behind the outcome.

The record supports a narrower conclusion than either side's account. Horizon could produce false data. The Horizon Issues judgment found that bugs, errors and defects could create apparent shortfalls in branch accounts, and that they had done so on numerous occasions in both Legacy Horizon and Horizon Online. It described Legacy Horizon as not remotely robust, found HNG-X's robustness questionable, and found HNG-A far more robust. Known bugs included Callendar Square, discovered in 2005, and Dalmellington, discovered in 2015 and followed by a 2016 decision to stop investigating other incidents. The Post Office nevertheless treated Horizon figures as proof that money was missing and recovered challenged shortfalls as debts. The Court of Appeal said that, by treating an unreliable system's figures as incontrovertible loss, the Post Office effectively sought to reverse the burden of proof. Remote access by Fujitsu staff is in the evidence: the judge found the occasions were not isolated, although how often they occurred could not be concluded. The Inquiry's Volume 1 states that many hundreds of people were convicted, wrongly, of criminal offences. The record does not establish how many individual shortfalls software caused.

Contributing causes and conditions

  1. Legacy Horizon contained bugs, errors and defects that could produce apparent shortfalls, and the judge found that such bugs had actually happened on numerous occasions.
  2. Bugs persisted across Legacy Horizon and Horizon Online, and the judge found HNG-X's robustness questionable.
  3. Remote access by Fujitsu staff could change transaction information without the postmaster's knowledge, and its frequency could not be concluded.
  4. The Post Office treated Horizon figures as proof of missing cash and recovered challenged shortfalls as debts, even after a subpostmaster resigned.
  5. Known bugs were investigated unevenly, and in July 2016 the Post Office decided not to investigate other incidents further.
  6. Prosecutions and recovery actions relied on the data, and in 2021 the Court of Appeal quashed the convictions of 39 of the 42 appellants.

OutcomePost Office Horizon scandal

Take the method with you

  1. A system's output is evidence of what it recorded, not automatically of what happened, so test it against independent records before treating it as proof.
  2. When a fault is reported repeatedly, ask whether the reports form a pattern, because an investigation that stops early can hide the pattern.
  3. Who carries the burden of proof matters: a process that treats an unexplained figure as a debt has reversed the question of who must show what happened.

You can read findings at any time. Exploring every reasoning step marks this case as complete in your notebook.

Open another investigation

The open record

Sources & further reading

Read the original record and its scope before relying on a conclusion. Source references support the exhibit summaries; Faultory’s reasoning prompts are editorial reconstructions.

  1. s1
  2. s2
  3. s3

Written and curated for Faultory by Yunus Emre Vurgun, with AI-assisted research and drafting. Sources and interpretations can need correction. Read our editorial standards or report an issue.

From the journal

Field notes that use this case

Keep investigating