Notes from a scandal
I spent years observing the Post Office scandal up close. Here’s how it shaped my views on tech accountability.
As the UK has been gripped by the appalling Post Office scandal in recent days, for some of us this has been a long running issue waiting to erupt.
Between 2010 and 2016, I led the policy team at the statutory watchdog for post office consumers, giving me a ringside seat to the Horizon scandal as it unfolded.
One thing that was always abundantly clear to me - and that the nation is now seeing in its for horror - is the shocking organisational culture which allowed this to happen. That culture was driven right from the very top.
When I moved into the tech accountability space, I used to get some decidedly quizzical looks when I said my experience of working up close with Post Office Ltd was instrumental in shaping my views on tech accountability and online harms regulation.
Perhaps that explanation makes rather more sense today.
My personal take on Horizon
My personal take on the Horizon scandal is that there were compelling incentives for the Post Office senior leadership and politicians, particularly during the Coalition years, to do nothing about an increasingly obvious problem.
Back in 2010, the Post Office Chief Executive Paula Vennells had committed to delivering a deeply ambitious but arguably unrealistic transformation plan. Their vision was clearly supported by ministers, particularly Ed Davey and subsequently Jo Swinson, who saw the opportunity to address a long running problem - the Post Office was increasingly reliant on public subsidy, and multiple waves of closure programmes had failed to stem systemic losses.
Personal ambition was very much at play.
When the gravity of the Horizon scandal became increasingly difficult to dismiss, it was clear that admitting the scale of the potential problem would derail the transformation programme at a stroke. Any admission of the scale of the IT problems could readily tip the Post Office towards bankruptcy and would likely necessitate a massive public bailout (in the middle of the austerity years). That would have amounted to a significant but also very personally felt admission of failure.
The extent to which the scandal was allowed to run and run was driven by a mix of an appalling senior leadership and organisational culture within Post Office Ltd; a noticeable lack of transparency and effective external scrutiny; ineffective governance arrangements; and a particularly poor calibre of politicians who chose to commit to a strategy of plausible deniability over doing the right thing.
In particular, Ed Davey demonstrated a remarkable lack of curiosity, and in my experience, an obvious aversion to any facts or information that might challenge the delivery of his signature achievement.
Lessons to be learnt
As I mentioned above, my experience of years working with Post Office Ltd provided me with a formative understanding of how organisational cultures can drive deeply negative outcomes - and a clear sense of what incentives need to be in place to ensure companies that operate with relatively unchecked power and unchallenged opacity can be effectively held to account.
Here’s some lessons that I took away from the Post Office’s approach during this time, and how they’ve shaped my thinking about how we must deliver strong and effective tech accountability regimes.
1. It’s all about the culture, especially at the top
The actions of the Post Office Chief Executive and her senior leadership team - over many years looking to deny, delay and obfuscate around the scale and nature of the Horizon scandal - was entirely in keeping with a senior culture which was ruthlessly focused on delivering a sweeping business transformation programme at all costs.
The modus operandi of the business was to disregard or downplay any threats to the delivery of its business objectives, and many others working in and around the company had repeated first-hand experience of the extent to which the Post Office was prepared to be entirely ruthless when it chose.
No one should be in any doubt that while the Horizon scandal was driven by an IT failure, this was a scandal into entirely driven by a senior leadership culture. Over many years, Paula Vennells and her team were able to operate with virtually unchecked power and influence. A lack of effective transparency and scrutiny mechanisms meant that the Post Office could continue to operate with relative impunity.
Meanwhile Lib Dem ministers were actively prepared to turn a blind eye, and the broader Government, despite being the sole shareholder of the company at the time, displayed a remarkable lack of meaningful oversight.
If there’s one lesson that I’ve taken away from the Horizon years, it’s that effective corporate oversight requires a clear and robust focus on the senior management team and their actions.
It’s only if senior managers are made personally accountable for their actions that we can expect a corporate culture and decision-making regime that is driven by responsibility, not recklessness.
It’s only if the right mix of incentives, scrutiny and transparency are in place that senior execs will be encouraged to view the consequences of their actions as anything more than an externality. Put simply, senior manager accountability is a prerequisite for meaningful responsibility.
2. This was never just about the tech
The reason that the Horizon scandal reached such unfathomable proportions ultimately has very little to do with the faulty technology that initially triggered the problems, but everything to do with the systems, processes and organisational culture that allowed red flags to be deliberately obscured time and again over many years.
Effective risk assessment is a process that needs to embrace organisational and leadership culture as much as the technology it oversees. It’s abundantly clear there were clear disincentives for problems to be identified, the dots to be joined-up, and for the scale and extent of an emerging pattern to be identified.
3. Organisational culture is pervasive, and it actively shapes outcomes
While the worst excesses of the Horizon scandal were driven by the actions of senior leadership, one of the significant reasons why the extent of the issues remained under the radar for so long was the broader organisational culture in POL.
To say that there were clear disincentives to speak up and report problems is arguably the biggest understatement I could write.
In short, the Post Office’s organisational culture actively reinforced the obfuscation and denial being propagated by its senior leadership. At all levels for the business, it was abundantly clear that the Post Office was driven by a culture of fear - the singular focus on business transformation meant this was not a culture that invited necessary curiosity, whistleblowing, or the reporting of problems.
This culture of fear was exacerbated by a remarkable sense of corporate defensiveness. The explanation ? Many of the Post Office’s middle and senior managers had spent their entire careers working for the Post Office, meaning that any sense of curiosity and accountability had long since been blunted - and if anything there was a fear of doing and saying anything that might hasten their departure from the only organisation many of them had ever known.
Put these factors together and you have a palpable mix that explains why such a clear and disturbing pattern of injustice was allowed to propagate undisturbed for many years.
It also demonstrates clear lessons that should be learnt to prevent a repeat from happening again.
Strong corporate accountability means a clear and well-defined risk assessment process that is actively embedded into organisational structures and corporate culture. Corporate malfeasance will only be prevented if risk owners are made clear, there are clear personal and corporate incentives that require risk holders to speak up and identify problems, and the regulator identifies and delivers cultural change as a core part of its mission.
4. Scrutiny is essential, and without it we should expect (and get) negative outcomes
One of the abiding failures of the Horizon scandal, and one of the questions that many people have been asking over recent days, is how could so many senior figures could fail to ask seemingly obvious questions – and why there was such a demonstrable failure of scrutiny functions, from the Post Office Board, to senior ministers, to civil servants and beyond?
The answer is complex, but it is important. As covered above, there were clear political incentives for ministers to display a remarkable lack of curiosity about the growing scale and nature of concerns relating to Horizon.
While serving ministers have been quick to pass the blame to the Post Office senior management in recent days, there are significant questions for Ed Davey and others to answer about why they weren’t asking questions about a problem that simply wouldn’t go away.
With such a clear direction from the politicians to avoid difficult questions, it’s perhaps no surprise that senior civil servants – including those in the Shareholder Executive that oversaw the Post Office as an arms-length, wholly-owned body - also failed to display a natural and professional curiosity that should have been reasonably expected of them.
There are particular questions to be asked of Susannah Storey, who for much of the period in question sat on the Post Office Board as the Government’s representative (and until last year was the DSIT’s Director General covering Telecoms and Digital, meaning that she had overall responsibility for delivering the Online Safety Act.)
But it was a much broader issue than the lack of reasonable curiosity from ministers, civil servants and governance functions that was at play.
As the extent of the Horizon scandal became clear, the Post Office worked hard to dampen down external scrutiny, most notably effectively buying-out the independent organisation that represented subpostmasters (resulting in the now only notionally independent National Federation of Subpostmasters publicly parroting an improbable narrative that the technology was sound, and that if there was an issue it was seemingly an epidemic of fraud among their former members.)
Meanwhile a niche and arguably unsexy issue – post offices rarely set the world alight - received steady and determined coverage from publications including Computer Weekly and Private Eye, but for many years failed to receive the scale of mass media or political interest that we’ve see in recent days.
And here is a crucial area where tech accountability comparisons need to be made, and where there are palpable concerns about whether Big Tech is still able to avoid much needed scrutiny.
As regulation steps up, we’re seeing tech companies borrow from the Big Tobacco Playbook - looking to achieve civil society and academic capture through a combination of financial, data access and non-financial incentives. Much as the Post Office was able to dodge scrutiny by weakening civil society, we’re seeing a similar set of tactics by deployed in the tech space.
Much as the Horizon scandal was dismissed or overlooked by ministers, regulation will succeed or die by the oversight it receives – it is only if parliament, ministers and civil society hold the regulator’s feet to the fire that meaningful industry change will take place.
So far the idea of a standing scrutiny committee, so often called for during parliamentary passage, has yet to materialise.
Finally, politicians need to recognise that those sectors that cause clear potential for harm have to of course be treated with constructive engagement, but that ministers and civil servants are also likely targets for ministerial and civil service capture. They need to be conscious of and take steps to prevent this. It’s abundantly clear that the Post Office knew they had achieved ministerial capture during the Coalition years, and in my experience, it was this that encouraged them to think and act in way that they were invincible.
When you look at the AI companies and the ways they were treated with reverence by ministers during last year’s AI Summit at Bletchley Park, you have to wonder if (m)any of these lessons have yet been learned.
Concluding thoughts
As I said at the outset, my experience of working in and around the Post Office actively informed my approach to tech accountability. As the Horizon scandal now publicly pays out, I’m more convinced than ever that it is only through delivering much needed shifts in senior management and organisational culture that we can deliver a transformative shift in corporate outcomes.
If there’s one lesson that we should all take away from companies that have overseen scandals that seem too improbable to be true, or so calculated that it’s staggering they were ever allowed to take place unchecked or undiscovered for so long, it’s that we can only see corporate outcomes if we have the right incentives and the right regulatory model in place from the start.
A few years ago, I would have expected short shrift if I’d said there were lessons from the analogue world for this brave new world of the digital tech giants.
Today, learning lessons from some analogue failings seems very wise indeed.