Sir Alan Bates has “serious concerns” that the government’s budget for Post Office scandal compensation will be stretched to cover the legal costs of those making claims.

This comes as he welcomed a “very positive and quite insightful” report from the parliamentary business and trade select committee.In its report, the committee called for legally building deadlines for subpostmaster redress with financial penalties for failure.

In its Post Office and Horizon scandal redress: Unfinished business report, the committee also demanded the Post Office be removed from administering any of the redress schemes, up-front legal advice to be offered to claimants, and the appointment of independent adjudicators.

It said lawyers being paid by taxpayers should be instructed to speed up payments to subpostmasters, reduce delays, give the benefit of the doubt to claimants and publish figures on government spending on lawyers.

In February 2024, during a mammoth five-hour business and trade select committee hearing, MPs heard that the complexity and unfairness of schemes for the financial redress of former subpostmasters is leading to slow and often unfair settlements. Witnesses, including Bates, called for a legally binding deadline on when payments should be made.

A year on, and payments are still too slow. In her Autumn Budget statement in October, chancellor Rachel Reeves announced Post Office Horizon scandal compensation funding of £1.8bn.

As of November, just £499m of the £1.8bn has been paid out across four redress schemes, with 72% of the budget for redress still not paid.

Lawyers’ fees

In the report, the committee referred to oral evidence provided by Carl Creswell, director for Post Office policy and business engagement at the department of business and trade, which states that the Budget 2024 allocation of £1.8bn to settle redress costs includes claimants’ lawyers’ fees.

“I have very serious concerns about subpostmaster legal costs being taken out of the financial redress pot,” said Bates. “That money should be ring-fenced for financial redress for victims, not paying their legal costs.”

The business and trade committee said it is “imperative” that claimants are offered legal advice up-front, at no cost to themselves but paid for by the scheme administrators.  

“Years on from the biggest miscarriage of justice in British legal history, thousands of Post Office Horizon victims still don’t have the redress to which they’re entitled for the shatter and ruin of their lives … we can’t go on like this,” said chair of the committee Liam Byrne MP. “Justice delayed is justice denied.

“Victims should have up-front legal advice to help make sure they get what’s fair,” he said. “We need hard deadlines for government lawyers to approve the claims with financial penalties for taking too long. Crucially, we need the Post Office, which caused this scandal in the first place, taken out of the picture.”

Bates said the committee report shows that “at least the politicians involved can see the problems, although the civil servants in the department are blind to them”.

Recommendations welcome

Neil Hudgell at Hudgell Solicitors, which represents hundreds of former subpostmasters seeking compensation, said: “We welcome any recommendations to speed up redress, and many of these seek to remove unnecessary obstacles to justice we have seen over the past few years, repeated across hundreds of cases.

“We have repeatedly said claimants should have access to up-front legal advice in all scheme claims, that they should be given the benefit of the doubt where written evidence is limited given the timeframes we are talking, and that offers should be made at the top of the range for each category of loss. Sadly, we’ve not seen that across most schemes to this point, certainly not with any level of consistency.”

The Post Office scandal was first exposed by Computer Weekly in 2009, revealing the stories of seven subpostmasters and the problems they suffered due to the accounting software (see timeline of Computer Weekly articles about the scandal below).

Source

Only two of the top 100 listed companies in the Middle East reported cyber security incidents last year, according to defence vulnerability scanning firm SecurityScorecard, but most incidents in the region went unreported, it said. 

SecurityScorecard’s findings highlighted an impressive record in the Middle East and North Africa (MENA) when compared with Europe, where 18 of the top 100 firms had security breaches, and to the US, where 21% of firms in the S&P 500 stock market index were hit. 

Gulf states in particular have invested heavily in cyber security to deter rampant attacks in the region as they transform from central, state-controlled petro-states to diverse economies more dependent on vulnerable information communications. But experts said it still lagged EU and US in laws required to guarantee open reporting deemed necessary for resilience. 

Ryan Sherstobitoff, vice-president of research at SecurityScorecard, said he believed most security breaches that large MENA corporations suffered last year went unreported. 

“I would say probably 80% is not reported,” he said. “The Middle East isn’t exactly required to report breaches in the same way as North America, or even some locations in Europe. So, it’s never going to be recorded.”

When a MENA security breach did become public, it was usually because hackers had hit the subsidiary of a foreign corporation whose home rules required it to report the incident, said Sherstobitoff. Moreover, the geopolitical situation spawned more attacks than elsewhere. Four-fifths of the top 100 MENA corporations are in Gulf countries – usually state-owned banks, energy firms and utilities. 

The would-be ratings agency noted a correlation between firms that reported no breaches and those it scored ‘A’, after assessing detailed scans it did of their security vulnerabilities, along with incident reports. Breaches diminish a firm’s rating significantly, but only briefly, according to its methodology. 

It gave half the top 100 MENA firms A ratings – twice as many as Europe, and a fifth more than the US S&P 500. SecurityScorecard rated 84 of the 100 as either A or B. The strength of MENA cyber security, widely attributed to massive investment, was confirmed in the ITU global index, with Gulf economies ranked among the most secure in the world. 

MENA incident reports that appear more reliable involve indirect attacks, with 84 of the top 100 firms admitting they suffered breaches caused by the mistakes of their suppliers, according to SecurityScorecard. Almost every single top EU firm reported the same. A spokesperson said that it has not produced comparable third party breaches of US firms. 

Ross Brewer, an expert with deep experience of high-level security in the region, said MENA’s immense spending on cyber resilience was not as good in reality as on paper. “In Western societies, bad news travels fast. In the Middle East, if the government has anything to do with it, bad news does not travel at all. When you are building a utopian future that will attract global tourists, you want to present the absolute best image,” he said. 

Firms “in these pretentious countries” did not report incidents because the culture encouraged dignified face-saving, said Brewer. Intense government control of all communications in and out of the region, and internally, was effective at catching attackers. But MENA investment in cyber defences, according to Brewer, had been hasty, shoddy and done piecemeal by expats who left behind them a fractured and vulnerable security architecture. People were afraid to speak out, he claimed. 

Bharat Raigangari, board adviser to Dubai security consultancy 1CxO, a company which large firms in the region, said an independent security ratings agency was just what the region needed to address the security problems implied by its third party breaches. Raigangari said was trying to create one, with the backing of the UAE cyber security Council, “but it is much easier said than done”.

It was true MENA had fewer reported incidents because firms were not inclined to report them, he said. But the region’s security, and its regulations, were maturing fast and catching up with the West. 

Experts in the region applaud state authorities for their progress in building cyber defences and enacting legislation. 

Yedhu Krishna Menon, head of third-party cyber security at a MENA bank, who asked for his employer to remain anonymous because it is culturally unacceptable to reveal it, said that reported incidents were low because the region’s defences were particularly good. 

Whereas hiding security breaches to save face was not limited to MENA, a bigger concern is “reputation damage, fear of negative publicity, of stigma – it’s a global thing”, he said. 

“They don’t report the majority because they don’t want to lose business,” he added. MENA culture had also progressed. “It’s not like 10 years back.” 

Attackers, aiming to bring down economies and exploit vulnerabilities introduced by the region’s transforming economies, had merely prompted MENA countries to implement regulation to drive investment in security. The regulatory impetus had been momentous and like nowhere else in the world, said Menon. 

Munir Subor, a partner at law firm Taylor Wessing in Dubai, said that it was common practice for firms in the region not to report incidents. Those reported to government would remain secret. 

Nick Loumakis, MENA managing director at Obrela, a Greek firm working closely with UAE cyber security authorities, believed the region’s low incident numbers were correct. 

Government was “always in the room” whenever he had dealt with an incident, but he knew of only one large firm hit in the past two years. He didn’t think saving face played a factor. “It’s not easy to keep this information hidden,” he said, believing that government control of large firms and an oligarchical economy has allowed MENA countries to stamp out attackers more effectively. 

MENA state authorities contacted by Computer Weekly were unavailable for comment. 

Source