UK court clears post office staff convicted due to ‘corrupt data’ • Hacker News Board

Re: UK court clears post office staff convicted due to ‘corrupt data’

#261

Post by zentiggr » Fri, Apr 23, 2021, 9:57 PM UTC

ClumsyPilot wrote: post #125

neolefty wrote: post #119

Earlier quoted context omitted.

Yes, it seems clear that people knew about these problems — they were obvious at one level of management — and they worked together to cover them up.

Heads have to start rolling for this, or we will end up in a dystopian nightmare where any corporate organisation can ruin your life for no reason. It will be like USSR except more unpredictable because it can come from any direction

I think we're already over the edge of that, it's more urgent than you think.

A couple of insensitive Facebook posts gets you dropped from consideration for a job... no matter how long ago and how much you may have matured in the meantime.

Google implements FLoC and cohorts start identifying political leanings, medical conditions, mental health issues, anything that's legally potentially discrimination territory... how do you know that someone deduced a cohort topic and denied you based on that...

Tip of the iceberg. Data aggregators already have opaque records on probably everybody alive, just find the one with data about your person of interest.

This needs to be a complete change of awareness and ethics and global law... otherwise we're going to have the movie "The Circle" come completely true as opposed to being just around the corner.

Re: UK court clears post office staff convicted due to ‘corrupt data’

#262

Post by giantg2 » Fri, Apr 23, 2021, 10:02 PM UTC

deepspace wrote: post #243

giantg2 wrote: post #226

Earlier quoted context omitted.

"The problem is taking the word of the system at face value and not investigating further even when dozens of people's livelihood and freedom are hanging in the balance." We do the same thing with breathalyzers in most of the US. No independent people allowed to inspect the system for bugs.

The breathalyser issue is immensely frustrating. In the few cases where the software has been allowed to be examined, they found egregious bugs. Not to mention that the one-size-fits-all measurement model is inaccurate for people outside a very narrow metabolic range. The trouble is that if you speak up about it, people ask: "why are you defending drunk drivers?" It's like innocent until proven guilty flies out the w…

"It's like innocent until proven guilty flies out the window."

Honestly, this is now the public perception (and the system) operates these days. I had a trooper recently hold a charge that he knew was incorrect and it carried with it pretrial restrictions that no other charge would. The state police say there's nothing wrong with subjecting people to pretrial restrictions under charges that they know to be incorrect. The attitude is "screw you, criminal" (just a summary offense).

Some states actually get it right and use blood tests. That means that some blood is saved if the defense wants to have it tested (evidence preservation).

Re: UK court clears post office staff convicted due to ‘corrupt data’

#263

Post by zentiggr » Fri, Apr 23, 2021, 10:03 PM UTC

mnw21cam wrote: post #40

PaulKeeble wrote: post #35

Software is in the walls. At some point legislators are going to come and ask the question how we stop things like this happening and if the Fujitsu's of the world don't have an answer then we can expect regulation that will likely embed practices that don't help. I don't think we take software reliability seriously enough, most of our focus is on speed of release, ever quicker cycles and it being OK to break things.…

I still think https://xkcd.com/2030/ has to be taken seriously. You can put a whole load of verification effort into your software, which will undoubtedly make it more reliable. But you are still likely to have some kind of corner case where it breaks down. Software is complex enough for this to be universally true. The key is how we respond when the software fails. The https://en.wikipedia.org/wiki/Therac-25 case sh…

Something about "pride goeth before a fall" and "the one thing you can expect a manager to do is whatever shields them from liability".

Re: UK court clears post office staff convicted due to ‘corrupt data’

#264

Post by Ichthypresbyter » Fri, Apr 23, 2021, 10:30 PM UTC

anonymousDan wrote: post #231

dignick wrote: post #138

Earlier quoted context omitted.

As the post office is such an old organisation (350 years), it used to have its own armed guard, has its own investigations branch and conducts its own prosecutions. The police wouldn't get involved because the post office was considered to have jurisdiction. Taken from this, which is a great listen: https://soundcloud.com/privateeyenews/page-94-the-private-ey...

They should be stripped of those powers immediately in my opinion. It's an anachronism and as been shown by this incident they are not fit for purpose.

Private prosecutions are not unusual in England, although the tide may be turning against them. For instance, the RSPCA recently announced that it would stop bringing private prosecutions for animal cruelty [0], which it has done since before there were police. There was apparently pressure from MPs for them to do so, after some fairly high-profile cases where they were seen as being too eager to prosecute.

Of course, the CPS (Crown Prosecution Service) has always had the right to take over and discontinue a private prosecution.

[0]https://www.theguardian.com/world/2021/jan/28/rspca-plans-to...

Re: UK court clears post office staff convicted due to ‘corrupt data’

#265

Post by bostonvaulter2 » Fri, Apr 23, 2021, 11:23 PM UTC

lbriner wrote: post #118

haunter wrote: post #43

https://www.computerweekly.com/news/252496560/Fujitsu-bosses... >For the first 10 years of Horizon’s existence, transaction and account data was stored on terminals in each branch before being uploaded to a central database via ISDN. Our source says this part of the system simply did not work. >“The cash account was a piece of software that sat on the counter NT box, asleep all day,” he said. “At the end of the day,…

I think a lot of "normal" people like the idea of holding corporates accountable but how would that actually work? The CEO blames one of their directors; the Director blames the supplier; the supplier blames the requirements documentation; the Business Analysts blame the culture for creating confusing and conflicting requirements. Yes, you can hold the organisation accountable but then the people who worked there bac…

One interesting idea is to have a corporate "death penalty", although that wouldn't necessarily work here as well because it's not a private corporation.

Re: UK court clears post office staff convicted due to ‘corrupt data’

#266

Post by ghufran_syed » Fri, Apr 23, 2021, 11:29 PM UTC

temporama1 wrote: post #238

davidhyde wrote: post #98

Those postmasters defending charges of theft against them in the 2000s should not have had to prove that the computer system they were forced to use had bugs. In order to prosecute them in the first place, the Post Office should have had to prove, beyond a shadow of a doubt and without risk of bias, that the computer system was correct. So, independent review at the very least, not testimony from parties with a veste…

Any independent review would inevitably be done by the same type of "expert" that wrote the software in the first place. No doubt it's some sprawling, insane Java monstrosity Manhattan project or suchlike. "Yeah - 10,000 classes - completely fine and not crazy at all."

doesn’t each side call it’s own expert witnesses? and cross-examine the other sides expert witnesses? Doesn’t seem like it would be hard for the defense’s expert witness to show the possibility of bugs?

Re: UK court clears post office staff convicted due to ‘corrupt data’

#267

Post by DaiPlusPlus » Sat, Apr 24, 2021, 12:01 AM UTC

da_chicken wrote: post #235

DaiPlusPlus wrote: post #224

Earlier quoted context omitted.

Formal proof of program correctness tends to require that the software's purpose lies in a very narrow, and extremely well-defined problem space. The _Horizon_ software in-question is a general-purpose line-of-business system, which presumably has to react to ever-changing business requirements - that's probably the hardest space to implement formal-methods in - with little benefit for doing-so precisely because requ…

You don't need a formal proof for the entire system as a whole. You could simply have a formal proof of specific functions of the software. Those functions which will have their data audited, for example.

Correct - but this is a line-of-business application software: so I'm assuming that everything about it is subject to changes. The parts of the system that would be thoroughly spec'd out, QA'd (and maybe do have formal proofs) would be the underlying database system they're using which would be a third-party system like Oracle or Sybase or MS SQL (I just hope they're not using Progress/OpenEdge...).

As it is, I don't know what part of the system is responsible for reporting money stolen by postmasters - the BBC News article is light on technical details. The Register has more details: https://www.theregister.com/2021/04/23/post_office_scandal_f... as does this website focused entirely on the trial: https://www.postofficetrial.com/2019_03_25_archive.html

The bugs are described as being part of the systems' payments processing system (as the Post Office does function as a financial institution, after-all) - but that at least some of the bugs were caused by ad-hoc work on the system (wot, no CI/CD to gatekeep releases?!) so I'm thinking this is just institutional incompetence - let alone a lack of software-engineering processes - so the idea of them implementing formal-methods for proving the system's correctness is laughable.

Re: UK court clears post office staff convicted due to ‘corrupt data’

#268

Post by TruthWillHurt » Sat, Apr 24, 2021, 12:15 AM UTC

lbriner wrote: post #122

PaulKeeble wrote: post #35

Software is in the walls. At some point legislators are going to come and ask the question how we stop things like this happening and if the Fujitsu's of the world don't have an answer then we can expect regulation that will likely embed practices that don't help. I don't think we take software reliability seriously enough, most of our focus is on speed of release, ever quicker cycles and it being OK to break things.…

How do you know this culture existed 20 years ago when this system was developed? It is almost certain that a corporate developer in the 1990s would be 100% waterfall. The issue is very often related to massively complex corporate requirements (the Post Office makes me cringe, even today, with the complexity of their postal system) and then coupled with the ever-present need to keep costs low, especially when designi…

You are correct. I've seen the Horizon design documents - they are very detailed, thorough and complete. The system was not designed in an Agile manner of iterative design / build first - document later.

Re: UK court clears post office staff convicted due to ‘corrupt data’

#269

Post by qmmmur » Sat, Apr 24, 2021, 12:29 AM UTC

hermitcrab wrote: post #257

toyg wrote: post #233

Earlier quoted context omitted.

On internal UK news, there is nothing as good as Private Eye. Every two weeks they publish more “hard” material than newspapers do in a month. I’m a subscriber, the value for money is simply ridiculously good.

I have also recently subscribed to Private Eye - mostly because there is now so little other investigative journalism going on in the UK that I think they deserve some support (the main papers are nearly all owned by billionaire mates of the Conservative Party). It is also quite funny.

You should check out bellingcat. It's very reputable

Re: UK court clears post office staff convicted due to ‘corrupt data’

#270

Post by qmmmur » Sat, Apr 24, 2021, 12:33 AM UTC

lbriner wrote: post #118

haunter wrote: post #43

https://www.computerweekly.com/news/252496560/Fujitsu-bosses... >For the first 10 years of Horizon’s existence, transaction and account data was stored on terminals in each branch before being uploaded to a central database via ISDN. Our source says this part of the system simply did not work. >“The cash account was a piece of software that sat on the counter NT box, asleep all day,” he said. “At the end of the day,…

I think a lot of "normal" people like the idea of holding corporates accountable but how would that actually work? The CEO blames one of their directors; the Director blames the supplier; the supplier blames the requirements documentation; the Business Analysts blame the culture for creating confusing and conflicting requirements. Yes, you can hold the organisation accountable but then the people who worked there bac…

You wanna make CEO money you're on the line for the problems you cause.