Casebook

Post Office Horizon

A system whose output was admitted as evidence of a crime under a legal presumption that computers work, whose known defects were logged by the supplier and withheld from defendants, and whose operator could not afford, contractually or reputationally, to find that it was wrong.

System
A branch accounting system whose reported shortfalls were treated as proof of theft or false accounting, by an operator that was also the investigator and the prosecutor.
Where
United Kingdom · Post Office Ltd, Fujitsu
When
1999 to 2015 (prosecutions); redress continuing
Scale
More than 900 prosecutions; hundreds imprisoned, bankrupted, or both; the inquiry's first volume links at least thirteen suicides to the scandal and identifies roughly 10,000 eligible for redress.
Time to halt
About twenty years
Halted by
A group of 555 subpostmasters in civil litigation, then the Court of Appeal, then an Act of Parliament quashing convictions in bulk.

The record

What happened

From the primary sources listed at the end. Where a finding is quoted, it is the inquiry's, not ours.

Horizon, built by ICL and then Fujitsu, was rolled out to Post Office branches from 1999. Subpostmasters were contractually liable for shortfalls the system reported. When it reported them, the Post Office investigated, and where it chose to, prosecuted, using its own power to bring private prosecutions. Between 1999 and 2015 it brought more than 700 prosecutions itself; other prosecutors brought more on the same evidence. Defendants who said the system was wrong were told it was robust and that no one else had complained.

Fujitsu kept a known error log recording bugs that produced phantom shortfalls, and its engineers had remote access that could alter branch accounts without the subpostmaster's knowledge. Neither fact was disclosed to defendants. In Bates v Post Office, the Horizon Issues judgment of December 2019 found that the system had contained bugs, errors and defects capable of causing the discrepancies, and that the Post Office's position had been, in the judge's phrase, the equivalent of asserting the earth is flat.

The Court of Appeal quashed 39 convictions in April 2021, finding that the prosecutions were an affront to the conscience of the court. The Post Office (Horizon System) Offences Act 2024 quashed the remainder by statute. The statutory inquiry chaired by Sir Wyn Williams published its first volume, on human impact and compensation, on 8 July 2025.

Scoring

The six state variables

One finding per variable, with the clauses whose obligation it falls under and the law it instantiates.

  1. drifted

    Capability

    What could the assembled system actually do?

    The assembled system could alter a branch's accounts from outside the branch. That capability was known to the supplier and never declared to the people whose liberty turned on the accounts being theirs. A capability nobody has declared is one nobody has authorized.

    STD-07 §2.2 STD-06 §1.2 Law I

  2. drifted

    Authority

    Which actions was it permitted to take, for whom, until when?

    The Post Office held the authority to prosecute on its own system's say-so. The law at the time presumed that a computer's output was reliable unless the defendant showed otherwise, and the defendant had no access to the data that could show it. Authority was coupled to a presumption, not to evidence.

    STD-08 §4.6 STD-02 §6.2 Law II Law III

  3. failed

    Evidence

    What propositions justified that authority?

    The proposition that a shortfall meant money had been taken was never tested against the system's known error rate, because the error log was withheld. The evidence that would have shown the system's own contribution, transaction-level audit data, was available to the operator and not to the accused.

    STD-02 §2.1 STD-02 §6.3 STD-06 §2.4 Law III Law X

  4. failed

    Dependency

    How hard had withdrawal or substitution become?

    Every branch ran on Horizon. There was no substitute, the contract with Fujitsu was among the largest the Post Office held, and every prior conviction rested on the system being sound. Admitting a defect meant admitting all of them. This is the purest instance in the casebook of dependence converting a technical fault into a structural one.

    STD-06 §5.1 STD-06 §5.2 STD-06 §5.3 Law V

  5. failed

    Standing

    Who could challenge a decision, with what procedural force?

    The people bearing the system's errors were prosecuted by its operator. There was no route by which a subpostmaster could put the system itself in question, and the operator told each one they were alone. Standing was not merely absent; the operator's incentives ran against it.

    STD-02 §3.2 STD-02 §7.1 STD-02 §8.4 Law VII Law XII

  6. failed

    Correction

    Which interventions stayed feasible, and on what clock?

    Correction took two decades, civil litigation funded at the claimants' risk, an appellate court, and primary legislation. At no point did the operator hold an intervention it was willing to exercise. The inquiry's first volume is about compensation because the underlying harm can no longer be reversed.

    STD-02 §5.2 STD-06 §5.6 STD-02 §4.3 Law IV Law VI

Learning outcome

Where the failure trajectory ended

Handled or learned: did the sequence from failure to challenge end in case resolution, or did the exception change the machinery that produced it?

absorbed — exception absorption versus exception learning

The operator never revised the machinery. The system's known defects were logged by the supplier and withheld; each subpostmaster was answered alone, so the pattern could not aggregate; and admitting a defect would have admitted every prior conviction, which made correction institutionally impossible for the operator itself. The learning came entirely from outside the institution — civil litigation, an appellate court, an inquiry, and an Act of Parliament — none of which the operator's own machinery produced. Exception absorption here lasted twenty years.

Read the theory: exception learning · Corrective Learning eval suite

The missing record

The one object that was not there

Every case reduces to a record the standards require and the operator did not hold. This is that record.

A dependency record with the exposure score computed and published. Dependency depth was total, substitution cost was the business, and correction latency turned out to be twenty years. STD-06 §5.5 would have barred expansion of the system's authority, including its use as prosecution evidence, until institutional reversibility was evidenced.

Sources

The primary record

Courts, statutory inquiries, regulators, and parliaments, in that order of weight. No press coverage.

  1. Court Bates & Others v Post Office Ltd (No 6: Horizon Issues) [2019] EWHC 3408 (QB) · 2019-12-16
  2. Court Hamilton & Others v Post Office Ltd [2021] EWCA Crim 577 · 2021-04-23
  3. Inquiry Post Office Horizon IT Inquiry, Volume 1: Human Impact and Compensation · 2025-07-08
  4. Parliament Post Office (Horizon System) Offences Act 2024 · 2024-05-24