Casebook

Post Office Horizon

A system whose output was admitted as evidence of a crime under a legal presumption that computers work, whose known defects were logged by the supplier and withheld from defendants, and whose operator could not afford, contractually or reputationally, to find that it was wrong.

System
A branch accounting system whose reported shortfalls were treated as proof of theft or false accounting, by an operator that was also the investigator and the prosecutor.
Where
United Kingdom · Post Office Ltd, Fujitsu
When
1999 to 2015 (prosecutions); redress continuing
Scale
More than 900 prosecutions; hundreds imprisoned, bankrupted, or both; the inquiry's first volume links at least thirteen suicides to the scandal and identifies roughly 10,000 eligible for redress.
Time to halt
About twenty years
Errors carried by
Subpostmasters, who were contractually liable for the shortfalls Horizon reported, and were then investigated and prosecuted by the operator on that evidence. Each was told the system was robust and that no one else had complained.
Halted by
A group of 555 subpostmasters in civil litigation, then the Court of Appeal, then an Act of Parliament quashing convictions in bulk.
After the failure
Process unchanged

The record

What happened

From the primary sources listed at the end. Where a finding is quoted, it is the inquiry's, not ours.

Timeline
  1. 1999 Horizon is rolled out to Post Office branches. Subpostmasters are liable for the shortfalls it reports.
  2. 1999–2015 The Post Office brings more than 700 prosecutions itself. Each defendant is told the system is robust and no one else has complained. Fujitsu's log of known bugs is not disclosed.
  3. Dec 2019 In Bates v Post Office, brought by 555 subpostmasters, a judge finds Horizon had bugs capable of causing the shortfalls.
  4. Apr 2021 The Court of Appeal quashes 39 convictions.
  5. May 2024 An Act of Parliament quashes the remaining convictions.
  6. Jul 2025 The statutory inquiry publishes its first volume, on human impact and compensation.

Horizon, built by ICL and then Fujitsu, was rolled out to Post Office branches from 1999. Subpostmasters were contractually liable for shortfalls the system reported. When it reported them, the Post Office investigated, and where it chose to, prosecuted, using its own power to bring private prosecutions. Between 1999 and 2015 it brought more than 700 prosecutions itself; other prosecutors brought more on the same evidence. Defendants who said the system was wrong were told it was robust and that no one else had complained.

Fujitsu kept a known error log recording bugs that produced phantom shortfalls, and its engineers had remote access that could alter branch accounts without the subpostmaster's knowledge. Neither fact was disclosed to defendants. In Bates v Post Office, the Horizon Issues judgment of December 2019 found that the system had contained bugs, errors and defects capable of causing the discrepancies, and that the Post Office's position had been, in the judge's phrase, the equivalent of asserting the earth is flat.

The Court of Appeal quashed 39 convictions in April 2021, finding that the prosecutions were an affront to the conscience of the court. The Post Office (Horizon System) Offences Act 2024 quashed the remainder by statute. The statutory inquiry chaired by Sir Wyn Williams published its first volume, on human impact and compensation, on July 8, 2025.

Scoring

The six safeguards

One finding per safeguard, with the clauses it falls under and the law it applies.

  1. drifted

    Capability

    What could the assembled system do?

    The assembled system could alter a branch's accounts from outside the branch. That capability was known to the supplier and never declared to the people whose liberty turned on the accounts being theirs. A capability nobody has declared is one nobody has authorized.

    STD-07 §2.2 STD-06 §1.2 Law I

  2. drifted

    Authority

    Which actions was it permitted to take, for whom, until when?

    The Post Office held the authority to prosecute on its own system's say-so. The law at the time presumed that a computer's output was reliable unless the defendant showed otherwise, and the defendant had no access to the data that could show it. Authority rested on a presumption, not on evidence.

    STD-08 §4.6 STD-02 §6.2 Law II Law III

  3. failed

    Evidence

    What evidence justified that authority?

    The proposition that a shortfall meant money had been taken was never tested against the system's known error rate, because the error log was withheld. The evidence that would have shown the system's own contribution, transaction-level audit data, was available to the operator and not to the accused.

    STD-02 §5.3 STD-02 §6.3 STD-06 §2.4 Law III Law X

  4. failed

    Dependency

    How hard had withdrawal or substitution become?

    Every branch ran on Horizon. There was no substitute, the contract with Fujitsu was among the largest the Post Office held, and every prior conviction rested on the system being sound. Admitting a defect meant admitting all of them. A fault in the software had become a fault the Post Office could not afford to find.

    STD-06 §5.1 STD-06 §5.2 STD-06 §5.3 Law V

  5. failed

    Standing

    Who could challenge a decision, and did the challenge have to be answered?

    The subpostmasters who bore the system's errors were prosecuted by its operator. There was no route by which a subpostmaster could put the system itself in question, and the operator told each one they were alone. Standing was not merely absent; the operator's incentives ran against it.

    STD-02 §7.1 STD-02 §8.1 STD-02 §8.4 Law VII Law XII

  6. failed

    Correction

    Which interventions were still possible, and how fast?

    Correction took two decades, civil litigation funded at the claimants' risk, an appellate court, and primary legislation. At no point was the operator willing to use any means it had to halt the system or reverse the decisions behind the harm. The inquiry's first volume is about compensation because the underlying harm can no longer be undone.

    STD-02 §3.2 STD-02 §4.2 STD-06 §5.6 Law IV Law VI

Remediation

Avoid this failure in your system

The diagnostic that tests for this defect, the standard that would have required a fix, and the essay that explains why it recurs.

1. Run the diagnostic

Record conformance checker

Reads a system's decision records and recomputes their hashes, so a record that was edited or removed afterward shows up.

2. Apply the standard

STD-07: Revisable delegation record

Requires that no record is edited or deleted: a change is a new record that names the one it replaces. Each record carries a hash and links to the one before it, so an alteration shows.

3. Read why it recurs

Automation and capture

When does an institution come to rely on a system so heavily that it can no longer question, replace, or halt it?

After the failure

Did the institution change?

Whether the institution changed the rule, category, or workflow that produced the errors, or corrected the errors and left that process as it was.

Process unchanged

The operator never revised the machinery. The system's known defects were logged by the supplier and withheld; each subpostmaster was answered alone, so no one could see the pattern; and admitting a defect would have admitted every prior conviction, so correcting the system was a cost the operator could not afford. The learning came entirely from outside the institution — civil litigation, an appellate court, an inquiry, and an Act of Parliament — none of which the operator's own machinery produced. Settling cases one at a time, with the system unchanged, lasted twenty years.

Read the theory: exception learning · Corrective learning eval suite

The record that was not there

Every case reduces to a record the standards require and the operator did not hold. This is that record.

A published record of how far the Post Office depended on Horizon and what replacing it would cost. The dependence was total, replacing it meant replacing the business, and correcting it took twenty years. STD-06 §5.5 would have barred any widening of the system's authority, including its use as evidence in prosecutions, until the Post Office showed it could reverse course.

Further reading

An essay that uses this case

Published elsewhere, as part of a wider argument. It is not one of the primary sources.

The Corrigible Machine · The Crumple Zone

An essay on systems in which nobody acts arbitrarily and nobody can be corrected. It uses Horizon as an example: the system's version of the accounts had the final say, and the subpostmasters who bore its errors had no way to challenge it.

The primary record

Courts, statutory inquiries, regulators, and parliaments, in that order of weight. Operator and NGO documents appear only where they record what the primary record established. No press coverage.

  1. Court Bates & Others v Post Office Ltd (No 6: Horizon Issues) [2019] EWHC 3408 (QB) · Dec 16, 2019
  2. Court Hamilton & Others v Post Office Ltd [2021] EWCA Crim 577 · Apr 23, 2021
  3. Inquiry Post Office Horizon IT Inquiry, Volume 1: Human Impact and Compensation · Jul 8, 2025
  4. Parliament Post Office (Horizon System) Offences Act 2024 · May 24, 2024