Artur Marciniec - Fotolia

Fujitsu Post Office IT support team were ‘legalised hackers’

Backdoors meant it was possible for Fujitsu staff to steal money from Post Office branches, says former Fujitsu tech worker

Fujitsu staff in the Post Office Horizon support centre could have stolen money from subpostmasters without them knowing, but never did, according to a 2015 whistleblower interview.

According to former Fujitsu tech worker turned vital scandal whistleblower Richard Roll, remote access auditing rules could be ignored by a team of “legalised hackers” who used backdoors to access branch accounts.

Roll, who worked in the Fujitsu support centre from 2001 to 2004, offering third-line tech support to subpostmasters, gave evidence in the High Court that helped subpostmasters expose the truth about the Post Office and Fujitsu’s treatment of them.

The latest information from the recorded 2015 interview comes as Fujitsu’s European boss Paul Patterson prepares to face MPs in the Business and Trade Committee, where he will face questions over Fujitsu’s role in the scandal and the steps it is taking provide redress to victims.

Roll gave evidence in the 2018/19 group litigation order (GLO) for subpostmasters led by campaigning former subpostmaster Sir Alan Bates, who were suing the Post Office after they were blamed and punished for accounting shortfalls caused by computer errors.

Around 800 subpostmasters were wrongly blamed for accounting shortfalls and convicted of financial crimes between 2000 and 2015, based on flawed evidence from the Horizon system. The Post Office Horizon scandal also saw many more subpostmasters lose their livelihoods and have their lives turned upside down after being blamed.

Hacking the system

In a recorded interview with forensic investigator Ron Warmington from Second Sight in 2015, months after the firm was sacked by the Post Office from its role in investigating the Horizon system, Roll said Fujitsu staff circumvented auditing of remote access to accounts.

Roll told Warmington: “The system was pretty full of holes when I was there. The guys I was working with were just legalised hackers, and they could crack anything.”

At this time, the Post Office was using its private prosecution powers to send subpostmasters to court or force them into plea bargains. Hundreds were wrongly convicted as a result.

Roll said the engineers never stole money, but admitted it was possible for them to do so: “We could just hack in through the backdoor and do what we wanted. If we wanted to, we could have hacked in and stolen loads of money, but we never did.”

The Post Office finally admitted that remote access was possible at the GLO, and unaudited access was later described by a former Fujitsu IT boss during a Post Office scandal public inquiry hearing in May 2023. In the hearing, it was revealed that Fujitsu had no control over staff in one of its tech support teams accessing Post Office branch accounts remotely to make changes which could be hidden from subpostmasters.

While it had already been revealed that remote access was possible, the lack of control of this access shed further light on Fujitsu’s lax practices in supporting its error-prone system. The public inquiry heard that staff working at Fujitsu’s Software Support Centre (SCC), which provides third-line tech support to Post Office branches, had “unrestricted and unauditable” remote access to branch accounts.

Stephen Parker, a former SCC manager, faced the public inquiry in its current phase, which is investigating the operation of the controversial Horizon system. During questioning, he admitted that control of SCC staff remotely accessing branch systems relied on them being trustworthy and following the access policy, with no policing of their activity.

Fujitsu had not responded to a request for comment by the time this article was published.

The Post Office scandal was first exposed by Computer Weekly in 2009, revealing the stories of seven subpostmasters and the problems they suffered due to the accounting software (see timeline of Computer Weekly articles about the scandal below).

Timeline: Computer Weekly articles about the scandal since 2009

Read more on IT for retail and logistics