Consumer · Field notes REF / EZY3771

Every Mistake Went the Same Way

A cancelled easyJet flight, a regulation that is admirably clear, and four decisions that were all wrong in the same direction. I got most of the money back. What I want to talk about is what it cost to get it.

Espoo — October 2026

A few weeks ago Lucy and I were lucky enough to go to a wedding at the top of a category 3 climb, overlooking a lake in northern Italy. Cyclists will know precisely what that means, and will also know that the view at the top is usually worth it. Everybody else can take it as a long way up a narrow road. The wedding was wonderful.

The journey home was ruined by easyJet.

The text message arrived at 16:49. The flight was due to leave Milan Malpensa for Malaga at 19:20. That is two and a half hours' notice, which under European law is both late enough to owe compensation and early enough that we were still in a taxi rather than at a gate.

What follows is not really a complaint about a cancelled flight. Aircraft break and crews run out of hours, and easyJet accepted from the outset that this one was cancelled for crew reasons, which is to say not for anything outside its control. The regulation anticipates all of that. It is one of the clearer pieces of consumer law in Europe, it has been in force since 2005, and easyJet publishes its own summary of it.

The complaint is about what happened next, over seven weeks and five letters, and about the single pattern running through all of it.

Four decisions

There were four substantive decisions in this case. Here they are in order.

The compensation was assessed at €125 per passenger. The correct figure was €250: the distance is 1,487 kilometres, which easyJet itself confirmed, and that falls in the band easyJet itself publishes. The halving was achieved by treating Barcelona — where we were offered a flight to, and from which we arranged our own onward travel — as our final destination. Malaga was the final destination. It is on the ticket.

I challenged that. The decision was maintained, in terms, as correct “based on our policy”, without engaging with the point.

I challenged it again, this time quoting easyJet's own Notice of Rights back at it. On the third attempt the figure was corrected to €500 in full, and paid.

The expenses decision reimbursed €500.27: meals, and the replacement Barcelona–Malaga flight I booked and paid for myself that evening, including the extra-legroom seats that matched the original booking. It refused the hotel — €198.36 for the night of 6 to 7 September — on the ground that it was a private arrangement booked after the flight disruption took place.

Why that last one cannot be right

Read the refusal again, because it is the most interesting document in the file.

Every expense under Article 9 of Regulation 261/2004 is by definition incurred after the disruption. The right to care is created by the cancellation. A rule that accommodation must be arranged before the event that makes it necessary would empty the provision of all content, which is presumably why no such rule exists.

And the same decision, on the same page, reimbursed a flight I had also booked myself, also after the disruption, also that evening, from the same airport. A reason that did not prevent reimbursement of the flight cannot support refusal of the hotel. The two cannot both stand, and one of them is a cheque that already cleared.

Exhibit — one decision, two outcomes

Reimbursed. Replacement flight, Barcelona to Malaga. Booked by me, after the cancellation, on the evening of 6 September. €490.12.

Refused. Hotel, Barcelona airport. Booked by me, after the cancellation, on the evening of 6 September. €198.36. Reason given: a private arrangement booked after the flight disruption took place.

easyJet's own published policy says that where an overnight stay becomes necessary it will provide a hotel and transport to it, and that where it cannot arrange that itself it will reimburse reasonable expenses against itemised receipts. No accommodation was offered or arranged. Neither the cancellation message nor the cancellation email mentioned the right to care at all. The invoice has been supplied twice.

The pattern

Here is the thing I keep returning to, and it is not the money.

Four decisions. Every one of them wrong. Every one of them wrong in the same direction. Not one arithmetic slip in my favour, not one generous reading, not one instance of easyJet discovering it owed me more than I had asked for.

Errors that are genuinely random do not all point the same way. When every mistake favours the same party, you are not looking at a series of mistakes. You are looking at a setting.

I want to be careful here, because I cannot see inside the process and I am not alleging that anybody set out to cheat me. It does not require that. A system staffed by people working to templates, under time pressure, with a default of declining anything that does not fit the template cleanly, will produce exactly this distribution without a single person intending it. The bias lives in the design, not in the staff. That is in some ways worse, because there is nobody to persuade.

What makes it work is that each individual decision is small enough not to be worth fighting. €125 a head. €198.36. Figures chosen, or arrived at, at precisely the level where a reasonable person decides that their evening is worth more than the dispute.

The silence

I challenged the hotel refusal on 25 September and asked for a reply within fourteen days. That period expired on 9 October. Nothing arrived. Not a holding reply, not an acknowledgement, not a refusal. Nothing.

On 10 October I sent a letter before action. It set out the four points above, asked for payment of €198.36 or confirmation that this was easyJet's final response, and gave fourteen days. It said what would happen otherwise: a complaint to ENAC, the Italian enforcement body designated under Article 16, the flight having left Malpensa; and a claim under the European Small Claims Procedure in the courts of Malaga, as the place of arrival of the contracted carriage, against easyJet Europe Airline GmbH as operating carrier. For €198.36 in accommodation, €60 in additional dog boarding as a consequential loss, interest and costs.

That deadline expired on 24 October. Nothing arrived then either.

So both of those things are now happening. This piece was written in the gaps between ENAC's online complaint form and Form A of the European Small Claims Procedure — the latter a genuinely well-made document, clear about what it needs and why, which I had not expected to be completing over a hotel bill.

The channel that answers

Somewhere in the middle of this I also posted about it on X, tagging easyJet, on the reasonable theory that a public channel sometimes moves faster than a private one.

It worked, briefly. Somebody replied. It was prompt, it was sympathetic, and it asked me for details.

I sent the details. That was the last I heard.

No follow-up. No case reference. No connection to either of the two cases already open, which were in the meantime continuing to go wrong in the usual direction. The reply existed, and then it stopped existing, and the thing it was replying about carried on exactly as before.

Which tells you what that channel is for. It is not a route to resolution. It is a visible demonstration that somebody noticed, performed in front of an audience, and complete the moment the audience has seen it. It exists to make people feel heard. It does not exist to hear them.

The part I could not have invented

The public post did have one concrete consequence, though I doubt it was the intended one.

On the afternoon of the day I sent the letter before action, I received an email from an address at a free webmail provider, signed by an Escalation & Response Supervisor, apologising for the frustration caused by my flight cancellation and the additional hotel expenses, and referring to the €198 I was owed.

It was a phishing attempt, and a reasonably well-aimed one. Somebody knew there was an open dispute and roughly what it was worth, and the only place either of those facts was public was X. Complaining in the open is how you get noticed. It turns out it is also how you get farmed.

So I did the responsible thing and forwarded it to easyJet's published phishing address.

It bounced. The address, I was informed by the mail server, only accepts messages from people in its organization or on its allowed senders list, and your email address isn't specified.

I have read that sentence a number of times. An address published by easyJet so that customers can report fraud committed in its name, configured to accept mail only from easyJet employees. It is not malice. It is a firewall rule that somebody applied to a mailbox without asking what the mailbox was for. But it is a very exact small picture of the whole thing: a process that is correct in its parts and useless at the thing it exists to do.

What it actually cost

Let me total this up honestly, because the outcome is not a bad one.

I recovered €500 in compensation, in full, after three attempts. I recovered €500.27 in expenses. Both are paid and I have no complaint about the amounts. What remains outstanding is €198.36 and a reserved €60.

Against that: five substantive letters, a reading of the regulation, a reading of easyJet's own published policy so that I could quote it back, two document bundles, a calculation of the great-circle distance to establish which compensation band applied, and seven weeks. Call it a working day, spread thin, by somebody who is comfortable with regulatory texts and had the invoices filed.

I am unusually well equipped for this. I do compliance for a living. I have the receipts because I always have the receipts. I was not going to give up over €198 as a matter of temperament, which is a luxury, not a virtue.

Most people are not in that position, and the process does not seem to be designed on the assumption that they are. Everyone who shrugged at €125 a head because the first answer sounded official kept €125 a head less than the law gives them. The regulation is strong. The enforcement of it is almost entirely delegated to the stubbornness of the individual passenger, which is a strange way to run a right.

The point

I did not write any of this down because €198.36 matters. It does not, particularly. I am writing it because I still have not been paid, and because a deadline I set in writing has now passed in silence for the second time. The first was a fortnight that ended on 9 October. The second was a fortnight that ended on 24 October. Both were reasonable, both were explicit about what would follow, and neither produced so much as an acknowledgement.

I wrote it down because of the direction. One wrong decision is an error. Two is bad luck. Four, each of which required me to cite easyJet's own published wording back to it before it was corrected, and each of which failed in the same direction, is a system doing what it does. Nobody has to be acting in bad faith for that to be true, and no individual I dealt with was anything other than polite.

The regulation already works. The documents were never in dispute. What stood between me and the right the law gives me was nothing more than the quantity of effort required to assert it — and that quantity is, I suspect, the only variable anybody is actually managing.

Ends

REF / EZY3771 — filed from Espoo, between an ENAC complaint form and a Form A. Invoice 000000574852 remains unpaid.

Technology · Field notes REF / ARRIVAL

Everything Works Once You Exist

The whole Finnish digital state hangs off a single credential, and that credential is issued to you by a bank. Which raises an obvious question about how you ever get the first one. The answer took a Tuesday.

Espoo — October 2026

In August I wrote that I was moving to a country where the systems work, and said I'd report back once I was standing in it rather than admiring it from a distance. Here is the report. It is shorter than I expected, because the thing I had braced for — the grinding administrative onboarding that every move between countries has previously involved — did not happen.

The official start date was the first of October, which I spent at a conference in Lisbon, this being the industry I work in. I flew to Helsinki on the third, was met at the airport, and was taken straight to the flat in Leppävaara: a commuter-rail suburb built around a station and a shopping centre, which appears to be the standard Finnish pattern and is a good deal more civilised than that description makes it sound.

There was a car waiting for me at the office, and a parking space for it at the flat — numbered, on the upper deck, ramp signposted off the street. Both were simply there. I mention it because it is the first of several things in this account that worked without my having to ring anybody about it, and because I had arrived braced to spend a fortnight on exactly this sort of thing.

Note to self, recorded here so I cannot later claim I wasn't told: tyres, before the first of November. The Finnish winter tyre requirement runs from 1 November to 31 March, and it is written the way I am beginning to expect rules to be written here — not as a date on which summer tyres become illegal, but as an obligation that bites whenever the weather or the road surface actually calls for it. The old fixed December-to-February window was replaced by that condition in 2020. Which is plainly the correct design: November in Espoo and November in Lapland are not the same November, and a calendar has no way of knowing that. It does mean the judgement is mine, and that the police's view of my judgement is the appeals process.

Tyres aside, I arrived that weekend as a person with an address, a job, and no existence whatsoever as far as the Finnish state was concerned. Useful, as it happens. It makes me a test case, and the way a country handles a person who has just appeared tells you more about how it's built than any amount of reading about it does.

The single key

Start with the architecture, because the architecture is the interesting part.

Essentially everything in Finnish public life — tax, residence, social insurance, health records, pensions, prescriptions — sits behind strong electronic identification. Not a password: a legally recognised, regulated identity assertion, good enough to sign a tenancy or file a return. It is the root of trust for the entire digital state.

And the state does not issue it. Your bank does. The online banking credentials that show you your current account are the same credentials that log you into the tax authority and your own medical records. The state set the legal standard, supervised the providers against it, and let institutions that were already running identity checks for their own regulatory reasons do the work once, properly, on everyone's behalf.

Finland did not build a national identity system. It accredited one, and left the enrolment desk inside a commercial bank.

For the nearly 5.7 million people already inside it, this is excellent engineering: no duplicated enrolment, no separate government app that nobody maintains, no second-rate state-built consumer product. It is also, on paper, a textbook circular dependency.

Exhibit — the loop, as written

The services require strong identification. Strong identification comes from your bank credentials. The credentials require an account. The account requires a personal identity code, a registered address and a documented reason to be in the country. And a fair number of the services that establish those would very much like you to log in with strong identification.

Every link is a sensible control, defensible in isolation, imposed by somebody with a legitimate interest in knowing who you are.

This is the point at which most countries I have lived in would hand you six weeks of correspondence and a number to ring.

One Tuesday

On the Tuesday I went to four counters.

The population register, to register my right to be here and be issued the personal identity code that everything else is cut from. The tax office, to sort out tax. The police station, to apply for the national identity card. Then the bank, to open the account.

The bank deserves its own sentence. I left the branch with a working debit card and a working credit card already live in Apple Pay, usable on the walk back to the station. The plastic followed a week later, and turned out to be one card rather than two: a single piece of plastic carrying both numbers, with a setting in the app deciding which of them it presents. That is, on a moment's thought, the obviously correct way to do it, and I have not seen it anywhere else.

By the end of that day I had all of it bar the one thing that cannot be done on day one: the strong identification itself, which needed the identity card I had just applied for. The card was ready by the Friday. My wife flew in at the end of that week and did the identical circuit; she moves over properly in November. A week later I collected both cards, walked into the bank with mine, and had strong authentication issued in ten minutes.

The tax registration arrived exactly seven days after I had sat in the tax office. Not "within six to eight weeks." Seven days.

The loop was real. It just took one morning to walk through it, in the right order, with a passport.

Why it worked

It would be easy to file this under Finnish efficiency and move on, which would miss the design decision underneath it.

The first identity assertion cannot be made digitally. That is not a Finnish limitation, it is a logical one: somewhere at the base of every chain of digital trust, a human being has to look at a document and a face and attest that they match. Every country with a digital identity system has this problem. What distinguishes them is whether they treat that physical step as a legacy embarrassment to be minimised, or as a load-bearing part of the system to be designed and resourced properly.

Here it is plainly the latter. The counters are staffed, unhurried and competent. Each one trusted what the previous one had done rather than re-litigating it. Nobody asked me to prove something that a Finnish authority had already established that morning, and nobody asked me to carry paper between two agencies that could talk to each other. The physical layer isn't what's left over when the digital path fails. It is the on-ramp to it, and it is built like one.

Which is the inversion of nearly everything else I write about here. The recurring subject of these field notes is a capability that exists on paper and stops one step short of the place the citizen actually stands: a secure portal that returns a 404, a button marked "add extra baggage" that adds no baggage, a bank that builds a secure channel and then asks you to email it the password. The defect is almost never the technology. It is the last join, left unfinished, because finishing it was somebody's second priority.

Here, the joins were made. That's the whole difference, and it isn't a technical one.

I had assumed my run was smoothed by circumstance — an employer expecting me, someone meeting the plane — and as far as I can tell that assumption was wrong. The counters show no sign of grading anybody. They were fast, in order, for whoever was in front of them, which is rather the point: an efficiency that depended on who you are wouldn't be efficiency, it would be favour. And the one part I had mentally filed as the slow bit — the right to be in the country at all, which happens upstream of every counter in this post and before you ever land — ran to the same clock. The applications went in at the embassy on a Tuesday, were approved by the following Monday, and the cards arrived a week after that. A fortnight, start to finish, for the step I had braced for.

A note on language

I had been warned about the language and had misunderstood what the warning was for. It isn't conversational — everyone speaks better English than I have any right to expect, and switches without ceremony the moment I start struggling. Nor, so far, has it been administrative. Every service I have needed has worked in English, properly rather than grudgingly, and at no point have I found myself staring at a form I couldn't read.

There is a structural asymmetry underneath it, which I record without having yet tripped over it. Finland has two national languages and English is not one of them. Swedish carries a statutory right to decisions and documents in your own language; English carries a service commitment, which is a different and weaker thing. Whether that distinction ever becomes visible to me is a question for a later post. Two weeks in, it simply works.

Housekeeping

Smaller findings, recorded for completeness. Anything stronger than supermarket beer comes from the state retailer, which now opens on Sundays in some stores and is discussed in tones suggesting this remains recent and faintly astonishing. I have the correct boots, which are studded, and I am reliably informed that the socks matter more than the boots. The national cut brandy is considerably better than its reputation, comes in a one-star and a three-star, and the three-star is the one to drink neat. I will not be taking questions.

Still outstanding: a language with fifteen grammatical cases, which I have started and which has started defeating me. A Labrador, arriving in November, who has been promised snow and is going to be delighted with every person involved in the decision.

And the question I am asked more than any other, by everyone, usually with a slight narrowing of the eyes: are you ready for November?

Yes is the short answer.

More from Espoo.

Ends

REF / ARRIVAL — filed from a flat in Leppävaara, two weeks in.

Technology · Field notes — REF / RELOCATION

Moving to a Country Where the Systems Work

A state monopoly that read its own specification, decided it was wrong, and rewrote it — and the job I’ve taken inside it.

---

The blue cross, and a city built around water and winter

Regular readers will have noticed a pattern in these pages. A bank asks you to email it the very documents it warns you never to email. An airline designs a baggage policy whose main function is to be unfindable until you’re standing at the gate. In every case the system performed exactly as specified. That was the complaint.

This entry is different. This one is about a system that looked at its own specification, decided it was wrong, and rewrote it. And about the fact that I’ve taken a job inside it.

The facts of the case

Later this year I’ll be joining Veikkaus — Finland’s national gaming company — as EVP of Technology, leading its technology organisation and joining the executive team. We’re moving to Helsinki: myself, my wife, and a Labrador whose general position on snow is I love it — though he has yet to encounter this much of it, for this long. His views will be entered into the record as the winter progresses.

For those who don’t follow the gambling industry (a defensible life choice), the short version: Veikkaus has held the exclusive right to operate gambling in Finland for decades. In December 2025, Finland’s Parliament passed a new Gambling Act. From 1 July 2027, the most competitive parts of that market — sports betting, online casino — open to licensed competition. Veikkaus keeps the lottery and goes head-to-head with the world’s operators on the rest.

Read that again, because it’s rarer than it sounds. A state monopoly did not cling on, lobby for delay, or quietly nobble the reform. The country examined a system that was functioning exactly as designed, concluded the design no longer served the people it was built for, and legislated a hard deadline to change it — in public, with the incumbent expected to compete on merit. Having spent a fair portion of this blog documenting institutions that fail precisely because they work as designed, I find the inversion genuinely refreshing.

Why take the job

I’ve spent thirty-odd years building and running enterprise technology — platforms that serve millions, through mergers, migrations, and at least one transformation that was advertised as “exciting” and turned out to be accurately described. The honest summary of the trade: the technology is rarely the hard part. The hard part is changing an organisation’s design while the organisation is running at full speed.

Which is exactly the problem on offer here, at national scale, on a legislated clock, inside a company whose stated purpose is not shareholder yield but doing gambling safely — every player identified, harm actively detected, profits to the Finnish state. You can be cynical about corporate purpose statements; I usually am. But a gambling operator that is publicly measured on how well it protects its own customers is at minimum a more interesting engineering brief than one measured on how efficiently it extracts from them. I wanted the hard, honest version of the problem. This is it.

A monopoly that volunteered to compete. In my experience, institutions do not often choose the harder, honest path.

Helsinki in winter — lit windows, a green tram, and snow that means it

Credit where it’s due, meanwhile, to Finland itself, which keeps turning up on the right side of this blog’s ledger without trying: a country where the trains run, the shelters are maintained, the coffee is taken seriously, and a speeding fine scales with your income — a piece of systems design so elegantly incentive-aligned I may frame it.

Housekeeping

First: nothing changes until it changes. I have a role I’m committed to finishing properly — projects to land, a handover to do well, and a team I intend to leave in better shape than I found it. They’ll have my full attention until the last day, because that’s the only way I know how to leave anywhere.

Second: the About page of this blog says I’m a techie on the Costa del Sol. That sentence is now on notice. The road bike is being consulted about studded tyres. The dog has not yet been told that the Baltic is for swimming.

Third: this blog carries on. The subject matter may drift north — expect future field notes on Finnish bureaucracy (early practical experience demonstrates it is very timely and functional), on learning a language with fifteen grammatical cases, and on what -20°C does to a man who has spent the last seven years enjoying the Andalucian climate.

The wider observation

Most institutional failure documented here shares one root: systems optimised for the institution’s convenience and defended long past their sell-by date. What Finland is doing with its gambling market is the opposite move — a system dismantling its own comfortable position because the design no longer fit the purpose. It will be messy, contested, and hard, as honest redesigns always are.

I’ve decided the most useful place to watch it from is the inside, holding a screwdriver.

More from Helsinki.

Ends

---

REF / RELOCATION — filed from somewhere over the Bay of Biscay, probably.

Technology · Field notes — REF / HORIZON

Will AI Prevent Another Horizon?

Everyone wants to know whether smarter software would have caught the bug. It is the wrong question. The fatal fault in Horizon was never in the code.

---

For a quarter of a century the Post Office held to one position with the conviction of scripture: the computer was right, and the people were wrong. More than nine hundred sub-postmasters were prosecuted on that basis. Lives were ruined, some of them ended. It remains the most widespread miscarriage of justice in British legal history, and it turned on a single, fatal article of faith — that the machine does not lie.

So now, with a far cleverer breed of machine arriving in every workplace, the natural question is whether it would have saved them. Would a modern AI, let loose on the Horizon system, have caught what the courts could not? It is a comforting question, and I understand why people ask it. I think it misses the point so completely that answering it on its own terms does more harm than good.

Horizon was not a software failure

Let me be clear, because this is where most takes go wrong. Yes, Horizon had bugs. Phantom shortfalls that appeared from nowhere. Transactions that reversed themselves. A remote-access capability that let Fujitsu reach into branch accounts and alter figures without the sub-postmaster ever knowing. These were real defects, and they mattered.

But bugs are not remarkable. Every non-trivial system ever shipped has them. I have said before that there are still bugs in Horizon today — they simply haven't been found yet. That is not cynicism; it is how software works. A buggy accounting system is a Tuesday. It is not a national scandal.

What turned defects into a catastrophe was not the defects. It was the decision — taken by people, knowingly, and repeated for years — to trust the machine over the human in front of them, to withhold what was known, and to prosecute anyway. The disaster was a choice. Several thousand of them, in fact, made by individuals with names and salaries and the option, at every turn, to do otherwise.

What AI would genuinely have caught

I want to be fair to the optimistic case, because there is one. Point a modern anomaly-detection model at the Horizon transaction logs and it would have raised its hand almost at once. The same impossible shortfall surfacing across unconnected branches. Balances that reconciled to no human action. Corrections applied with no corresponding entry. This is precisely what such systems are good at: finding the one inconsistency in a mountain of data, tirelessly, at three in the morning, without getting bored or being told to stop looking.

Run a capable model over the codebase and it might well have flagged the remote-access function and the silent edits as exactly the kind of thing that should never exist in a system used as courtroom evidence. So on the narrow technical question — could AI have spotted the problem sooner — the honest answer is yes. It probably could.

But the machines already knew

Here is the part the optimists skate straight past. The discrepancies were never hidden from the computers. They were in the data. Fujitsu's own engineers could see them. The system logged the remote access. The information that would have exonerated hundreds of innocent people sat inside the technology the entire time, available to anyone who cared to look.

Horizon did not fail to detect the problem. People failed to act on what the detection plainly showed them — and, worse, chose to suppress it. The bottleneck was never detection. You cannot fix a refusal to look with a better pair of eyes.

AI will tell you the numbers don't add up. It will not phone the regulator.

AI does not come with a spine

A model will tell you, instantly and without fear, that the figures are impossible. It will not then walk into a manager's office and say we are prosecuting innocent people. It will not refuse to sign the witness statement it knows is misleading. It will not put its own career on the line to stop a prosecution. Those are acts of conscience, and conscience is the single component Horizon lacked — and the one thing no model ships with.

I have sat in a witness box on IT matters. I know what it costs a person to tell an uncomfortable truth under oath, and I know what it costs everyone else when they decline to. None of that arithmetic changes because the software got cleverer. The hard part of Horizon was never the part a computer could do. It was the part where a human being had to be brave, and too few were.

The new danger is worse than the old one

The Post Office's entire institutional defence reduced to four words: the computer is reliable. It rode on a long-standing legal presumption — that a computer was working properly unless you could prove otherwise — which Horizon exposed as dangerous and which has since, belatedly, come under review.

Now consider what we are about to do. We are replacing the merely opaque computer with one that writes its own code, reasons in ways nobody fully audits, and cannot always explain itself even to the people who built it. The "computer says" defence does not weaken in this world. It gets stronger, more impressive, and far harder to challenge from the witness box — because now even the engineers can only shrug. Automation bias was the accelerant last time. We are preparing to pour a great deal more of it onto the fire. When a sub-postmaster in 2032 says "the AI got it wrong," who in that courtroom will be equipped to prove they're right?

Where AI could actually earn its keep

None of this means the technology is useless against the next Horizon. It means we are aiming it at the wrong target. Stop pointing it at the accounting engine and point it at the human layer — the place the failure actually lived.

Tamper-evident, immutable audit logs that no engineer can quietly amend. Anomaly reports routed to somewhere a frightened middle manager cannot intercept them — to an independent board, not up a chain that punishes bad news. Whistleblower channels that surface a pattern after five branches, not nine hundred prosecutions. The value is not a smarter till. It is using the technology to remove the human discretion that let the cover-up breathe — to make looking away harder than facing the thing. That is the Root Cause Analysis instinct: repair the system that produced the failure, not merely the symptom it threw off. AI can help build that scaffolding. It will not choose to build it. We have to.

A year on from the first volume of Sir Wyn Williams's final report, the scale of the human damage is set out in unsparing detail. What is still not settled is the bill for it. Fujitsu has conceded a "moral obligation" to contribute and set aside nothing against it, pending the remainder of the report it says it is waiting on. The total redress is now valued in the region of two billion pounds.

Where it stands, mid-2026 — the suffering catalogued, the contribution still unquantified. The defects we understood years ago. It is the accountability that remains outstanding.

The honest answer

So — will AI prevent another Horizon? It will probably prevent a few. It will catch defects sooner, flag the impossible faster, and spare some people the version of this that begins with a software bug. That is worth having, and I won't pretend otherwise.

But the Horizon that mattered did not begin with a bug. It began with a culture that prized the institution's reputation above the truth, leaders who did not want to be troubled with detail, and a presumption that the machine does not lie. AI touches none of that. If anything, it hands that same culture a more dazzling machine to hide behind, and a better answer to give when someone asks how they could possibly have known.

The next Horizon will not be stopped by a cleverer model. It will be stopped, if it is stopped at all, by someone willing to say "this is wrong" — and by an organisation, for once, willing to listen. We have built remarkable tools for finding the truth. We have never been much good at the part that comes after, where we are supposed to act on it.

Ends

We've opened a secure channel. Please email us the password.

Consumer · Field notes REF / SECURITY — FOLLOW-UP

A follow-up. Of the two banks that asked me to email my identity and income documents, one has now run its full course — a refusal, a threat, a climbdown, an apology, and then, at the very last step, a request to email the one thing that should never be emailed.

What happens when you decline to email your identity documents, cite the regulator, and copy in the data protection officer.

A while ago I wrote about two banks that, in the same stretch of weeks, asked me to send proof of identity and proof of income by email — the one channel they spend a fortune warning me never to trust. This is what happened when I stopped complying with one of them and started pushing back. It has, I’m pleased to report, a sort of happy ending. It also has a punchline neither of us should be proud of.

Where we left off

The secure upload portal they pointed me to returned a dead link. The mobile app I authenticate into with my face offered no way to upload a document. And when I pointed both of these out, the answer came back that email was, regrettably, the only way.

Exhibit — the only solution

“We kindly ask you to send the requested documents by email, as we do not have any other solution to proceed with and complete this case.”

“No other solution” is doing a lot of work there. It describes a gap in their own systems — a portal that doesn’t load, an app that can’t upload — and reaches for the insecure channel as though it were a law of nature rather than a thing they hadn’t finished building.

The refusal

I declined to send a complete identity-and-income bundle as an unencrypted attachment, and proposed the method the national data-protection regulator itself recommends: an encrypted file, with the password shared separately, by telephone. I cited the law — the provision that requires appropriate technical measures, including encryption where appropriate, for personal data of this kind — and the regulator’s own guidance that email is rarely a safe way to move it. I mentioned, for good measure, that the same regulator had already fined a company precisely for asking its customers to email personal data.

The threat

The reply engaged with none of that. Instead it recast my position — a “decision not to provide the required information” — which was simply untrue; I’d offered to provide everything, securely. And it attached a list of consequences.

Exhibit — the consequences

Rejection of certain banking transactions. Inability to access certain services. Blocking of payment methods. And, “possibly, termination of the business relationship.”

Nothing quite concentrates the mind like being told your account is on the line over the question of which envelope you use. I could have folded there, and I suspect most people do — which is rather the point of putting the sentence in.

The climbdown

So I escalated, and copied in the data protection officer. That changed everything. Within a few days: an apology, an explicit acknowledgement of the security concern, a note that the relevant teams had been reminded of good practice, confirmation that the portal fault was being investigated, and — the thing I’d been asking for the whole time — a secure workspace, opened for thirty days, for me to upload the documents into.

This is the part where the system worked. The desk whose actual job is data protection understood the problem in a sentence. The people who’d been demanding the data hadn’t understood it at all.

The one person whose job was data protection got it at once. The people asking for the data never did.

The last step

And then, having built the secure channel, they asked me to send the password to it — by email.

Exhibit — the last step

Upload the documents to the secure workspace; then “send the password separately” by email. And — this is the part that stings — “please note that any text entered in comment or message fields is not encrypted during transmission… do not include the password or any sensitive information.”

Read that twice. They understood channel security well enough to warn me off the unencrypted comment box — and in the very same breath, asked me to put the password in an email. The link to the secure workspace had also arrived by email. So both halves — the way in, and the key that opens it — would end up sitting in the same inbox, one compromise away from being lifted together.

The entire point of sharing a password “separately” is that it travels by a different channel, so that no single breach hands over both the lock and the key. A password by email, when the link came by email too, is not a different channel. It’s the same envelope, posted twice.

The oldest secure channel

By this point I was, as it happened, in the country where the bank lives. So I did the one thing in this entire saga that turns out to have no security holes at all: I put copies of the documents in a folder, walked into a branch, and handed them across the counter against a dated receipt.

No transport encryption to argue about. No attachment left decrypted in anyone’s sent folder. No password to send by any channel, secure or otherwise. Just paper, a human, and a stamp. The oldest method in banking quietly outperformed every digital channel the institution owns — not because those channels are bad ideas, but because not one of them had been finished to the point where it actually worked from end to end.

That’s the whole story, in the end. The security was never missing. It was there in pieces — a portal, an app, a secure workspace, a data protection officer who understood all of it — and it stopped, every single time, one step short of the place I actually needed it.

The security was never missing. It just stopped, every time, one step short of where I needed it.

That’s one of the two closed out. The other bank — the one that assured me its email was “securely encrypted,” then admitted it had no portal at all — is still, at the time of writing, thinking about it. That’s a story for when it ends.

Ends

Just Email Us the Documents

Consumer · Field notes REF / SECURITY

How two banks, in the same week, asked me to send my most sensitive documents over the one channel they spend a fortune warning me never to trust — and what happened when I asked for something safer.

Two requests for proof of income, a dead upload link, a secure app that can’t take a file, and a polite suggestion that I use the post.

Two banks. Same week. Both wanted proof of residency and proof of income. Both, without a flicker of self-awareness, asked me to email it to them.

These are institutions that freeze your card if you buy a coffee in the wrong postcode. That make you authorise a €30 transfer with a fingerprint, a one-time code, and a passive-aggressive push notification. That bury you in literature about phishing, about never sharing details, about how they will never ask you to send sensitive information by email.

And then they ask me to send sensitive information by email.

What’s actually in those documents

Stop and think about what a “proof of residency and proof of income” bundle contains. A utility bill or bank statement with my full name and home address. Payslips or tax documents with my employer, my salary, my national insurance or tax reference number. Often an account number or two thrown in for good measure. Frequently a signature.

That is not paperwork. That is a starter kit for identity theft, assembled and gift-wrapped, sent over the one channel specifically designed in 1971 without a single thought for confidentiality.

Email was never secure and never pretended to be

Here’s the part the average compliance officer seems to have missed. Email is not a sealed envelope. It’s a postcard that may or may not be carried in an armoured van for part of the journey.

Yes, most providers now negotiate TLS between mail servers, so the message is usually encrypted in transit. But “usually” is carrying a lot of weight there — if the receiving server doesn’t support it, plenty of systems silently fall back to plaintext rather than fail. And in-transit encryption does nothing about the rest of the lifecycle:

• The attachment sits decrypted at rest in my Sent folder, indefinitely.
• It sits decrypted in their inbox, indefinitely, on infrastructure I will never see and cannot vouch for.
• It passes through, and is logged by, however many intermediate systems, spam filters, and archiving appliances sit between us.
• It is exactly one compromised mailbox — mine or theirs — away from being copied wholesale. And email accounts are the single most phished, most credential-stuffed, most reused-password target on the internet.

End-to-end encryption — the thing that would actually fix this — is something neither a high-street bank nor a normal customer has set up. So it isn’t happening. The document is travelling in the clear at both ends of its life, which is most of its life.

The bit that should genuinely worry them

Forget the technical exposure for a second. The worse damage is behavioural.

Banks have spent two decades and untold marketing budgets trying to train customers on one rule: we will never ask you to send personal information by email, so if someone does, it’s a scam. It’s printed on statements. It’s in the app. It’s read out by the hold music.

Then the real bank emails you and asks for personal information by email.

Every time a legitimate institution does this, it sands down the one instinct that protects people. It teaches customers that yes, actually, banks do fire off unsolicited requests for sensitive documents over email, and the right response is to comply quickly. That is the precise reflex every phishing campaign on earth is trying to manufacture — and the banks are manufacturing it for free, on the bank’s own letterhead, making the next fraudulent request indistinguishable from a real one.

You cannot run a customer-education programme that says “this never happens” while operating a back office that does it twice a week.

It isn’t even hard to do properly

The maddening part is that the fix is mature, cheap, and already sitting in most of these organisations:

• A secure upload portal — a link to an authenticated page on the bank’s own domain where you drop the file. Standard for a decade.
• In-app document upload. The app I authenticate into with biometrics every single day. The file never touches email at all.
• Secure messaging inside online banking, where the document stays within their walls end to end.
• Failing all of that, bring it to a branch — remember those?

This is not a budget problem or a technology problem. It’s an institutional shrug. Email is the path of least resistance for whichever team is chasing the document, so email wins, and the security function that would object either wasn’t asked or was overruled by “the customer just needs to send it.”

So I asked. Reader, it went well.

I didn’t email anything. I asked both banks for a secure alternative, and the responses were instructive.

The first bank actually had a portal — and sent me a link to it. The link was broken. Dead. A 404 where my sensitive documents were supposed to go. This is, in a grim way, the most honest outcome of the lot: the secure capability exists on paper, someone built it, someone is presumably reporting it up the chain as “customers can upload securely” — and it doesn’t work. A broken secure channel is arguably worse than an honest lack of one, because it lets everyone tick the box while the real-world fallback quietly becomes “oh, just email it then.” Security that 404s isn’t security. It’s a screenshot for an audit.

And here’s the kicker. This same bank has a perfectly good secure app — the one I log into with my face, the encrypted channel I’m already trusted to move money through. It just doesn’t support document upload. So the most secure pipe they own, the one I’m holding in my hand, can’t accept the very thing they’re asking me for. The secure channel exists and the broken channel exists, and the only one missing is the join between them. So the document gets routed to email — the least secure option on the menu — not because the secure one is unavailable, but because nobody finished building the on-ramp to it.

The second bank is still thinking about it. But it did offer an alternative while I wait: the post. Send the documents by mail.

And — how, exactly, is that more secure?

Post is a sealed postcard’s more confident cousin, and not much else. Standard mail has no encryption because it has no anything — it’s a physical object handled by a chain of strangers, dropped through a letterbox that, in plenty of buildings, is a communal tray anyone can reach into. There’s no tracking unless you pay for it, no proof of delivery, no audit trail, and no way to know it arrived until it doesn’t. It can be lost, misdelivered, or simply lifted — mail theft is a real and growing route into exactly this kind of identity fraud. And in my case the documents would be crossing a border to get there, which adds days of exposure, more hands, and more depots.

So the menu I’ve been offered is: an insecure digital channel (email), a secure digital channel that doesn’t load (the dead portal), or a Victorian analogue channel with no security model at all (the post). The only option deliberately designed with confidentiality in mind is the one that’s broken.

Security theatre, meet security tragedy

We’ve all rolled our eyes at security theatre — the elaborate, visible rituals that make you feel protected while achieving very little. Forced 90-day password rotation. The transaction you have to approve from three different directions.

This is the inverse, and it’s worse. It’s a real, serious risk handled with total informality, behind a façade of an institution that talks about security constantly. The performance is all front-of-house. Out the back, your tax documents are going out as a Gmail attachment — or, when someone finally builds the proper channel, sitting behind a link that 404s while the bank suggests you pop them in the post instead.

Everything secure about the bank stopped exactly where I needed it most.

If your bank asks you to email proof of income, don’t. Ask for the secure portal — and then check it actually loads, because apparently that’s on you now too. And if the fallback they offer is the post, ask them, as I did, how a chain of strangers and an unlocked letterbox is the more secure option. Make them sit with the question. Somewhere in that organisation is a secure channel that works. They just haven’t been asked often enough to go and find it.

Ends

The button marked “Add extra baggage” that adds no baggage

Consumer · Field notes REF / BAGGAGE

How British Airways, Qatar Airways and the Civil Aviation Authority built a perfect little trap — and each, quite correctly, denied responsibility for it.

A reward booking, one checked bag, and the limits of trying to give a company your money.

There is a particular kind of modern absurdity that only reveals itself when you try to give a company money and discover you can’t. This is a story about that — about a checked bag I tried to buy ten months early, the airline website that cheerfully invited me to buy it, the two airlines that then spent a fortnight explaining why I couldn’t, and the regulator that wrote back to say the whole thing was none of its business.

It is, I think, a small but perfect example of how a system can be working exactly as designed and still be ridiculous.

The setup

I booked a long-haul return trip using Avios — a reward booking on flights operated end to end by Qatar Airways , but ticketed and sold by British Airways . This is an entirely normal thing to do. Millions of people redeem miles on partner flights every year. Because of how these redemptions work, the booking can only be made by telephone; the website won’t do it.

Fine. I made the call, the Avios came off, the tickets were issued, and a confirmation arrived listing a generous baggage allowance and noting — reasonably enough — that I “may also be charged for extra or overweight checked bags.” Extra bags, then, were a thing one could arrange. Good to know, because I wanted one.

The button that does nothing

So I went to manage the booking on the British Airways website, where the airline presents a tidy grid of things you can do: choose a seat, request a special meal, upgrade your cabin, and — right there, with its own little suitcase icon — Add extra baggage .

British Airways “Manage My Booking.” “Add extra baggage” is offered as a service, alongside seat selection, meals and cabin upgrades.

I clicked it.

It did not let me add extra baggage. It took me to a general information page explaining that baggage on partner-operated flights is governed by the operating airline, with a link sending me off to Qatar Airways’ site. No purchase. No price. No bag. Just a door marked “Add extra baggage” with a brick wall behind it.

Where the button leads: an information page about partner-airline allowances. No purchase, no price — just a redirect to the operating carrier.

This, it turns out, is the whole story in miniature.

The bounce

Following the trail, I asked British Airways directly. Its escalations team — and I want to be fair here, because they were genuinely helpful and human throughout — told me in writing that extra baggage “can be booked directly through” Qatar Airways’ website.

So we rang Qatar Airways. They said no: extra baggage can’t be added to a ticket issued by another airline, and the only option is to pay at the airport on the day. We rang again. Same answer. And again. Three times. Eventually they put it in writing: prepaid baggage is available only on Qatar Airways’ own ticket stock, this restriction “applies strictly in all circumstances,” and no exception would be made.

One airline tells you, in writing, to go and buy the bag from the other. The other tells you, in writing, that it will never sell it to you. Both are correct about their own rules.

The passenger is simply standing in the gap between two policies that don’t meet.

The price you’re not allowed to know

Here is the part that tips it from frustrating into faintly insulting. Because I couldn’t prepay, the only route left was the airport excess-baggage desk — which, on this route, runs to around fifty US dollars per kilo . A single extra suitcase would cost north of a thousand dollars. Buying the same allowance in advance online — the option I was structurally barred from — would have been up to 20% cheaper.

And when we asked Qatar Airways simply to tell us what the airport charge would be, so we could at least budget, the answer was that it would be “the rules and rates applicable at that time.” You cannot buy the thing in advance. You cannot find out what it will cost. You can only turn up on the day and discover the number at the precise moment you have no alternative.

(The rational move, for the record, is to ignore the airline entirely and post the suitcase home, which costs roughly a tenth as much. When shipping a bag across the planet by courier is an order of magnitude cheaper than checking it in, something in the pricing has come loose.)

Credit where it’s due

I said I’d be fair, and I mean it, because the contrast is the point. British Airways actually engaged. A named human looked at the case, phoned me, took it to Qatar Airways himself, and was honest about the limits of what he could do. He couldn’t fix it — but he tried, and he didn’t hide.

Qatar Airways did the opposite. It recited a policy, linked to a webpage, and declined four times to engage with the substance, including a flat refusal to quote a price. One airline ran out of road. The other built the roadblock and put up a sign saying the road was someone else’s responsibility.

The bit nobody discloses

Strip away the back-and-forth and the real fault is singular: none of this is told to you when you book. Not on the phone, not in the confirmation, not anywhere a normal person would look before paying. You find out only afterwards, when you try to buy a bag and hit the wall. A reward booking that millions of people make comes with a quiet, undisclosed catch — that one of the most ordinary purchases in air travel is closed to you, and that the fallback is the most expensive version of it, at a price you’re not permitted to see in advance.

That’s not a service hiccup. That’s a transparency failure, and a structural one, because Qatar Airways confirmed in writing that it applies to every ticket not issued on its own stock. Which is to say: to everyone in my position, every time.

And the regulator?

You might think this is what a regulator is for. I did too. So I referred it to the Civil Aviation Authority — carefully framed not as “fix my booking” but as “here is a market-wide practice worth looking at.”

The CAA wrote back to say it no longer handles complaints about airlines that belong to a dispute-resolution scheme, and — my favourite sentence of the entire saga — that it “has no legal powers to impose a solution on an airline.” It directed me to that scheme, the Centre for Effective Dispute Resolution (CEDR), instead.

But CEDR only does one thing: it makes binding decisions on individual claims. It cannot touch the underlying practice. It can, at best, order one airline to refund one passenger one fee. It cannot ask why the door marked “Add extra baggage” leads to a wall, or why a price can’t be quoted in advance, or why none of this is disclosed at the point of sale.

So the systemic problem has no home. The regulator says it’s the scheme’s job; the scheme only does individuals; and the practice itself sails on, undisclosed, for the next person who clicks the button. I’ve now reported it to the Competition and Markets Authority , which — under the new consumer-protection regime — is the one body that can actually look at a practice rather than a single complaint. We’ll see.

The point

I will probably end up posting the suitcase. The fee, in the end, is survivable. What isn’t quite so easy to shrug off is the shape of the thing: a button that promises a purchase it can’t deliver, two airlines each pointing at the other, a price you can’t discover until it’s too late to avoid, and a regulator that has quietly arranged to have no responsibility for any of it.

Everything here is working as designed. That’s exactly what’s wrong with it.