Comment by unfocussed_mike | Hacker News Reader

Comment by unfocussed_mike | Hacker News Reader

Parent Full thread

unfocussed_mike

> This should induce criminal charges not against the software developer, it should induce charges against management and those that believed the data is enough for a conviction. Difficult case because that would also implicate judges and public prosecutors. Of course that will not happen, but they are guilty far more than Fujitsu.

Not against the software developer? Let's wait and see whether they did due dilligence, shall we?

This happened over a very very long period of time.

People committed suicide over these false charges. Ruling out prosecuting the developer if it can be proved that they knew, did nothing, colluded in silence, etc., would be insane.

FWIW, I don't think "public prosecutors" in the conventional sense (Crown, CPS etc.) were even involved here. The Royal Mail is (like until recently the RSPCA) one of the few entities in the UK entitled to bring its own prosecutions. The Royal Mail pretty much invented the concept of formal investigation and prosecution. This is the Post Office acting with the assumed prosecutorial power of the state; the CPS may not ever have been involved.

> The Royal Mail is (like until recently the RSPCA) one of the few entities in the UK entitled to bring its own prosecutions

No, the ability to bring a private prosecution is not restricted to specific entities - it is a right everyone has (though some offenses can only be prosecuted with the consent of the DPP, and the DPP can choose to take over a private prosecution) [1]. For example, a woman tried to crowdfund a private prosecution for rape [2].

From [1]:

> There are a number of organisations that regularly prosecute cases before the courts of England and Wales but they do so as private individuals, using the right of any individual to bring a private prosecution. One example is the RSPCA.

[1]: https://www.cps.gov.uk/legal-guidance/private-prosecutions

[2]: https://www.bbc.co.uk/news/uk-england-41885897

OK -- I knew individuals could bring private prosecutions but I wasn't aware, I must admit, that the Royal Mail prosecuted as an "individual" now[0], and I stand happily corrected :-)

Though strictly speaking, before the concept of the "private prosecution" was formalised in law, the Royal Mail already had prosecutorial powers; it has always had prosecutorial powers. (The Royal Mail basically invented investigation-backed prosecution in the 17th century).

The Royal Mail is for sure one of the only major organisations to do it at scale too -- though the RSPCA did. The RSPCA have announced that they will no longer do it at all (not least because they have a terrible record of poorly founded and abusive prosecutions and had their arses handed to them in the High Court).

The point I was making here is that this investigation would never have gone to the police, because they have always reserved and widely wielded this power to investigate and prosecute. The Royal Mail even prosecute dog owners whose dogs bite postmen.

[0] which if you think about it presumably now imperils some individuals in a way that is distinct even from the extent to which Royal Mail (and Post Office Ltd) are vulnerable corporately.

> Ruling out prosecuting the developer if it can be proved that they knew, did nothing, colluded in silence, etc., would be insane.

This should also include developers doing code review of the code in topic, but also all related code, all testers/QAs and product owner. There isn't one developer that missed that bug.

I don't know where you find the limits here, in the sense that at some level there is a mistake here. People make mistakes.

What I do think is that anyone who pretended there wasn't a mistake, downplayed it when they knew it could be causing the prosecutions or even significant reconciliation issues, should be looked at.

First and foremost, in the UK, Fujitsu itself can (and I think should) be prosecuted for corporate manslaughter here if there is any evidence that Fujitsu executives conspired with the Post Office to keep this quiet, ever.

If anyone ever ordered a developer not to go public with their complaints, threatened a whistleblower, deleted evidence, that should crush Fujitsu for good.

But yes, individual executives should be at risk (the corporate veil can be pierced to include directors), and it's difficult to see how it is possible to rule out right now that there is real liability down the chain.

The situation at the Royal Mail is likely to be dramatically more serious, because there's a significant chance they were both covering up serious failings and knowingly directly prosecuting people to do so.

>I don't know where you find the limits here, in the sense that at some level there is a mistake here. People make mistakes.

I worked in a highly regulated company, we were under supervision of FDA, EMA and German EMA. We once missed a bug in database migration where a boolean field was false by default in java (non-nullabe), but it could be null in database column. It apparently broke a few reports (NOT running software, just pdf reports) for pharmacological clinics, 2 developers, 2 testers, our PO and out CTO had "disciplinary" actions (don't remember what it was really called) and their actions were under supervision from external consultants our company had to pay for.

It's crazy we don't have such rules in finance, food, data processing and publishing industries.

> The situation at the Royal Mail is likely to be dramatically more serious, because there's a significant chance they were both covering up serious failings and knowingly directly prosecuting people to do so.

Yes, RM decided to start internal investigation that lasted a few years, instead immediately contacting police, this is why it lasted so long and were so many victims.

> Yes, RM decided to start internal investigation that lasted a few years, instead immediately contacting police, this is why it lasted so long and were so many victims.

Yes, but the distinction here is not actually as useful here as you might think.

In this situation, Royal Mail _are_ the police (the USPS has its own police too). But Royal Mail are also the prosecutors in court (they have/had prosecutorial power).

They didn't really delay sending it to the police because they never would have. It wasn't a police matter because definitively it was a Royal Mail matter. (The Royal Mail has had the power to investigate and prosecute since before there even were police.)

Edit to add: it is now a "Post Office" matter as well because they are distinct businesses as of 2013, and Post Office Ltd is an ordinary company. But the key period concerns a time when they were one and the same

If I'm not mistaken, this is not some special power Royal Mail has. In the UK, anyone can launch a prosecution.

Yes. I have been corrected above.

It is a longstanding power the Royal Mail had, in fact.

But yes, private prosecutions are protected by law and Royal Mail now prosecutes using the right of an individual RM employee to bring the charge.

So the bit I want to read up on later is exactly who the individuals were in each prosecution. Is it the chief executive?

The only place there is a failure here is on the management level on both sides.

Any kind of certification in this space have you have the following for developing core functionality regarding financial data:

* Proper definition of hard requirements and acceptance tests. * Developers have to develop and write tests against this specification. * Another developer have to perform a review and sign off that this code indeed lives up to this specification. * QA will run tests that verify the specification is met, and sign off that it met specification.

That is a PM/PO that have responsibility for the specification. At least two developers and a QA person that have verified that the specification was met. A bug like this only goes live due to impossible to meet deadline or incompetency on multiple levels.

The only remotely acceptable explanation would be that this is the result of some really weird edge case or possibly race condition. But in that case we're back to incompetency, since no experienced developers should design financial software without well known patterns and technologies for the core of the application.

In this particular domain there is zero excuse for a bug like this.

The bug can still be missed and this is not an offense. Otherwise our industry would not exist. To prosecute on the basis of wrong data is the significant problem, not the bug.

Right, but I definitely did not say that missing bugs or making mistakes is criminal.

The question is how those people who discovered the bug or managed the components in which it exists handled themselves.

There is no way that Fujitsu (or even individual Fujitsu employees and directors) should be considered off the hook just because software is only software, which is the defence I am seeing here and elsewhere. It should depend on how they acted.

It could also be that the developers knew about the bug, reported it, were told not to fix it (probably due to more "important" work), and then either management or sales hid the bug from their customer and denied their software could be at fault. I.e. garden-variety lies to customers and management face-saving.

The way developers can be at fault here is if they managed to conspire with QA or testing to hide the existence of the bug from their management and continue to deny it when asked. Which implies a pretty toxic workplace, but, then again, Japanese conglomerates are not famous for sunshine and daisies.

And sure enough, that's the claim: https://www.computerweekly.com/news/252496560/Fujitsu-bosses...

Right, then as soon as the developers knew the bug had caused an erroneous conviction, if they did not blow the whistle they should be interviewed by the inquiry. If they did not blow the whistle after 500...

Reply on news.ycombinator.com