GB2432960A

GB2432960A - Ballot security system

Info

Publication number: GB2432960A
Application number: GB0606825A
Authority: GB
Inventors: Kevin Illingworth
Original assignee: BRAND NEW CO
Current assignee: BRAND NEW CO
Priority date: 2006-04-05
Filing date: 2006-04-05
Publication date: 2007-06-06
Also published as: GB0606825D0; WO2007113563A1

Abstract

A method and system for processing a ballot document and an identity document. The method includes receiving a ballot document indicating a vote and a corresponding identity document associated with the ballot document; scanning at least a first area of the identity document and forming a digital representation of the first area; processing the digital representation of the first area to determine whether the scanned first area includes a predetermined digital watermark; scanning a second area of the identity document and forming a digital representation of the second area; ```processing the digital representation of the second area to determine whether the scanned second area includes a user made indicia of a known user; and counting the vote indicated by the ballot document only if it is determined that the first area includes a predetermined digital watermark and it is determined that the second area includes a user made indicia of a known user.

Description

BALLOT SECURITY SYSTEM

The present invention relates to methods and apparatus for processing ballot papers and associated identity documents. The present invention is particularly suitable for, but not limited to, processing of postal ballot papers and the associated declaration of identity documents.

Traditionally, elections for public office in the United Kingdom have been conducted with voting systems utilising hand-marked paper ballots. Typically, a voter attends a polling station local to his residence. A presiding officer at the polling station checks the identity of the voter against a list of people who are eligible to vote (the Electoral Register). Assuming the name of the voter is present on the Electoral Register, the voter is issued with a ballot paper. The Electoral Register is also marked to indicate that the person has been issued with a ballot paper, so as to prevent a person voting more than once.

The ballot paper contains a list of candidates for the public office. The voter marks the ballot paper to indicate the candidate for whom the voter wishes to vote.

The ballot paper is then placed in a container (a ballot box). Following the close of polling, the container will be opened and all of the ballot papers manually counted for determining the winning candidate e.g. the candidate with the most number of votes.

In order to be entered on the Electoral Roll, a voter must first be registered.

Figure IA illustrates a typical voter registration form 10. The registration form 10 is typically posted to each address within a voting area (constituency). Upon receiving the registration form 10 for a particular address 12, a resident at that address will subsequently fill in the registration form, indicating the names 14 of the people resident at that address. Further, an indication 16 is provided as to whether or not each of those people is eligible to vote. The form 10 is then returned to the relevant authority responsible for maintaining the Electoral Register. The Electoral Register is subsequently compiled, using the returned registration forms, as well as other sources of information (e.g. letters requesting that a person be registered to vote).

Attending a polling station can be inconvenient for many people, particularly those with busy working lives or restricted mobility. To overcome this problem, an optional postal voting system has been implemented in many areas.

I

Figure lB illustrates a typical postal voting form 20. The postal voting form includes a ballot paper 22 and a declaration of identity 26. Typically, the ballot paper 22 is separately enclosed with, or detachably coupled to, the declaration of identity form 26 e.g. by a perforated line 25. A list of candidates 24 is provided on the ballot paper 22.

In order to vote, a voter marks the ballot paper to indicate his preferred candidate. The voter also inserts his/her signature 28 at an appropriate location on the declaration of identity form 26. That signature should be inserted whilst in the presence of another person. The other person then inserts their signature 30 at an appropriate location on the declaration of identity form 26, to indicate that the voter has validly signed the declaration of identity form 26.

To prevent disclosure of the vote cast by the voter, the postal voting form 20 is normally arranged such that the face of the ballot paper containing the list of candidates 24 cannot (or need not) be seen by the person inserting the signature 30 on the declaration of identify form 26. Both signatures 28, 30 are provided, in an attempt to prevent fraud.

The postal voting form 20, with the ballot paper 22 enclosed in an attached envelope, can then be posted by the voter to an appropriate location for verification and counting of the votes by the relevant authority.

On receipt of the voting form 20, a manual check is typically performed of the declaration of identity form, simply to check the presence of two signatures.

Typically, no verification of either signature is attempted. Assuming that both signatures are present, it is assumed that the ballot paper indicates a valid vote, and the concealed ballot paper 22 is detached from the declaration of identity 26, so as to maintain anonymity of the voter (as the declaration of identity contains an indication of the voter e.g. the voter's signature 28). The ballot paper 22 is subsequently counted, along with other ballot papers, so as to identify the winning candidate(s).

It will be appreciated that such a system is inherently susceptible to abuse.

For example, counterfeit voting forms may be generated, and falsely signed, so as to register bogus votes. Equally, valid voting forms may be collated by a single person, with that single person fraudulently casting a number of votes, thus leading to an incorrect ballot result. An incorrect ballot result may also arise due to fraudulent duplication of ballot papers.

It is an aim of embodiments of the present invention to address one or more problems of the prior art, whether referred to herein or otherwise. It is an aim of particular embodiments of the present invention to provide an improved system for processing postal ballot papers, to reduce the risk of abuse of the voting system.

In a first aspect, the present invention provides a method of processing a ballot document and an identity document, comprising: receiving a ballot document indicating a vote and a corresponding identity document associated with the ballot document; scanning at least a first predetermined area of the identity document and forming a digital representation of the first area; processing the digital representation of the first area to determine whether the scanned first area includes a predetermined digital watermark; scanning a second predetermined area of the identity document and forming a digital representation of the second area; processing the digital representation of the second area to determine whether the scanned second area includes a user made indicia of a known user; and counting the vote indicated by the ballot document only if it is determined that the first area includes a predetermined digital watermark and it is determined that the second area includes a user made indicia of a known user.

Such a method decreases the likelihood of abuse of the voting system, and thus provides a more secure ballot system. Processing the user made indicia (e.g. signature or fingerprint) in such a manner, provides a check on whether a valid voter has filled in the identity document. Further, the checking on the presence of a digital watermark reduces the risk of counterfeit identify documents/ballot documents being submitted. Said step of counting the vote may include: scanning a predetermined area of the ballot document and forming a digital representation of that area; processing the digital representation of the ballot document area to determine the vote indicated by the ballot document; and incrementing a value corresponding to the determined vote.

The ballot document may include a registration identity code corresponding to the identity of a single voter, and the method may further comprise: scanning the document to determine the registration identity code of the document; checking a database to determine whether the voter corresponding to the registration identity code has already voted; and counting the vote indicated by the ballot document only if it is determined that the database indicates that the voter has not voted.

Said ballot paper may indicate at least two votes cast by a single user, and said step of counting the vote may include counting the votes indicated by the ballot document only if it is determined that the first area includes a predetermined digital watermark and it is determined that the second area includes a user made indicia of a known user.

Said watermark may be invisible to the naked eye.

Said watermark may be invisible due to the marks defining the watermark being at least one of: a colour similar to a background colour of the document; and small.

The digital watermark may comprise yellow marks printed on a white background, and each mark is less than 0.003 inches in size.

Said watermark may be indecipherable to a human observer.

The digital watermark may be fragile.

Said predetermined user made indicia may be one of: a written signature; a fingerprint; and a thumbprint.

The processing of the digital representation of the second area may include: comparing the digital representation of the second area with a stored digital representation of a user made indicia of a known user; determining the level of similarity between the digital representations; and if the level of similarity exceeds a predetermined threshold, determining that the scanned second area includes a user made indicia of a known user.

The method may further include: determining that the indicia of the second area has not been made by a user if the level of similarity exceeds a second predetermined threshold greater than the first.

The method may further comprise: scanning at least a further predetermined area of the identity document and forming a digital representation of the further area; processing the digital representation of the further area to determine whether the scanned further area includes a predetermined user defined identity information; and counting the vote indicated by the ballot document only if it is determined that the scanned further area includes a predetermined user defined identity information.

The further predetermined area may include a plurality of character sequences, the processing of the digital representation of the further area including: determining which characters in said lists have been selected by a user indicia; and determining whether the selected characters correspond to the user defined identity information.

The user defined identity information may include a date.

Each document may include a batch identity code corresponding to the batch in which said document is processed, the method further comprising: scanning each document to determine the batch identity code of the document; recording whether an error has occurred in the processing of each document; providing a report indicating the errors and the corresponding batch identity codes.

An error may include any one of: an indication that a voter has submitted more than one ballot paper; a fault in scanning an area of a document; a fault in processing the digital representation of a scanned area; the determination that the first area does not include a predetermined digital watermark; and the determination that the second area includes a user made indicia of a known user.

In a second aspect, the present invention provides a method of processing an identity document, comprising: scanning at least a first predetermined area of an identity document associated with a corresponding ballot document and forming a digital representation of the first area; processing the digital representation of the first area to determine whether the scanned first area includes a predetermined digital watermark; scanning a second predetermined area of the identity document and forming a digital representation of the second area; processing the digital representation of the second area, to determine whether the second area includes a user made indicia of a known user; and outputting a signal indicative that the identity document is valid only if it is determined that the first area includes a predetermined digital watermark and it is determined that the second area includes a user made indicia of a known user.

Said watermark may be invisible to the naked eye.

Said watermark may be indecipherable to a human observer.

The digital watermark may be fragile.

The method may further include determining that the indicia of the second area has not been made by a user if the level of similarity exceeds a second predetermined threshold greater than the first.

The method may further comprise: scanning at least a further predetermined area of the identity document and forming a digital representation of the further area; processing the digital representation of the further area to determine whether the scanned further area includes a predetermined user defined identity information; and outputting a signal indicative that the identity document is valid only if it is determined that the scanned further area includes a predetermined user defined identity information.

The further predetermined area may include a plurality of lists of several character sequences, the processing of the digital representation of the further area including: determining which characters in said lists have been selected by a user indicia; and determining whether the selected characters correspond to the predetermined user defined identity information.

The user defined identity information may include a date.

In a third aspect, the present invention provides a method of processing a ballot document comprising: scanning at least a first predetermined area of a ballot document associated with a corresponding identity document, the ballot document indicating a vote, and forming a digital representation of the first area; processing the digital representation of the first area to determine whether the scanned first area includes a predetermined digital watermark; scanning a second predetermined area of the identity document and forming a digital representation of the second area; processing the digital representation of the second area, to determine whether the second scanned area includes a user made indicia of a known user; and counting the vote indicated by the ballot document only if it is determined that the first area includes a predetermined digital watermark and a signal has been received indicative that the corresponding identity document is valid.

Said step of counting the vote may include: scanning a predetermined area of the ballot document and forming a digital representation of that area; processing the digital representation of the ballot document area to determine the vote indicated by the ballot document; and incrementing a value corresponding to the determined vote.

The ballot document may include a registration identity code corresponding to the identity of a single voter, the method further comprising: scanning the document to determine the registration identity code of the document; checking a database to determine whether the voter corresponding to the registration identity code has already voted; and counting the vote indicated by the ballot document only if it is determined that the database indicates that the voter has not voted.

The method may further comprise processing the identity document as described above.

All of said scanning steps may be performed by a single scan of the relevant document.

In a fourth aspect, the present invention provides a carrier medium canying computer readable program code configured to cause a computer to carry out a method as described above.

In a fifth aspect, the present invention provides a device for controlling a scanner to carry out a scanning operation, the device comprising: a program memory containing processor readable instructions; and a processor configured to read and execute instructions stored in said program memory; wherein said processor readable instructions comprise instructions configured to control said device to carry out a method as described above.

In a sixth aspect, the present invention provides a voting document comprising an identity document comprising: a first area including a predetermined digital watermark; and a second area arranged for the provision of a user made indicia of a known user.

The voting document may further comprise a registration identity code corresponding to the identity of a single voter, the digital watermark having a predetermined relationship with respect to the registration identity code.

The voting document may further comprise a batch identity code corresponding to the batch in which said document was produced, the predetermined digital watermark having a predetermined relationship with respect to the batch identity code.

The voting document may further comprise a ballot document including a list of candidates arranged for selection by a voter.

An embodiment of the present invention will now be described, by way of example only, with reference to the accompanying figures, in which: Figure 1 A is a schematic diagram of a known voter registration form; Figure lB is a schematic diagram of a known postal voting form including both a ballot paper and a declaration of identify; Figure 2 is a schematic diagram of a voter registration document in accordance with an embodiment of the present invention; Figures 3A and 3B illustrate alternative implementations for inputting user defined identity information in a date format; Figure 4 is a schematic diagram of a voting document in accordance with an embodiment of the present invention; Figure 5 is a magnified view of a digital watermark; Figure 6 is a schematic diagram of an apparatus in accordance with an embodiment of the present invention; Figures 7A-7C illustrate a flow chart of the method for the processing of application forms in accordance with an embodiment of the present invention; Figures 8A-8C illustrate a flow chart of the method for the processing of identity forms in accordance with an embodiment of the present invention; and Figures 9A-9C illustrate a flow chart of the method for the processing of ballot papers in accordance with an embodiment of the present invention.

A preferred embodiment of the present invention will now be described with reference to Figures 2 to 9C. The embodiment relates to a system designed to provide identity authentification and verification of submitted ballot papers to minimise the risk of fraud and multiple voting by an individual. The system utilises document and signature verification technologies in conjunction with a list of eligible registered voters to check and record received voting slips, identify nominees and maintain an audit trail of vote processing for subsequent investigation in the event of any detected irregularities or fraud investigation. The system thus increases the security of the balloting process.

The system is particularly suitable for verifying postal ballots. It can be used in the administration of local, central and European government elections and referenda. The system may be used for any balloting system e.g. whether balloting for a candidate or for a decision. It may be used by commercial, charity, social, trade union or other organisations where postal balloting of employees, memberships, shareholders or other stake holders is necessary for legislative, regulatory or other reasons.

The system is designed to verify the authenticity of the vote cast and not the nature of the vote itself (i.e. no record is kept of the vote cast by any individual voter).

Thus the system maintains the principles of ballot secrecy, whilst ensuring the legitimacy of the ballot process. The system is compliant with the requirements of schedule 1 of the Representation of the Peoples Act 1983, and with other current Rules for Local Government (UK) and European Parliamentary elections.

To illustrate an example registration document 100. The registration document 100 is utilised for the electronic capture of information (e.g. user made indicia such as signatures) that is subsequently utilised in the authentication process.

The registration document 100 as with the other documents described herein, is typically printed on a single sheet of paper. As per the known registration form 10, the registration document 100 can be utilised to obtain the information from a number of people e.g. all of the people resident at a single address. Preferably, as indicated in Figure 2, the registration form is only arranged to obtain information from a single voter.

The blank voter registration form, as despatched to the voter, includes a registration identity code 104 corresponding to the identity of the relevant voter. For convenience, the document also includes the address of the voter 112. The forms will be printed in a series of batches. To facilitate error checking, the form includes a batch identity code 102 indicating the batch in which the document 100 was printed or produced. The batch identity code 102 and the registration identity code 104 can be represented by any predetermined series of characters e.g. aiphanumerical characters.

The blank document also includes a digital watermark 110. The digital watermark is described in more detail below, with reference to Figure 5.

The blank document 100 also includes a designated area for the insertion of a user made indicia e.g. a signature, thumbprint or fingerprint. That area is marked, so as to ensure that the correct user made indicia is provided by the user.

Preferably, for increased security, a further area is provided for the provision of user defined identity information. The user defined identity information includes an identifier, defined by the user, allowing authentification of the person (user) completing the document. Preferably, that area is marked to indicate to the user the type of information and the location of the information that should be provided.

Preferably, the form is printed so as to facilitate the provision, and subsequent electronic capture, of the relevant user defined identity information.

The user defined identity information 108 could be a password (e.g. a series of characters) or a number selected by the voter, that the voter is subsequently required to remember and reproduce at a later date during the ballot process. Preferably, the user defined identity information is a request for a date of birth e.g. of the voter, or a parent or spouse of the voter). As indicated in Figures 3A and 3B, the relevant area 108 of the registration form 100 can be configured to facilitate the provision of the user defined identity information. In both examples, the requested user defined identity information is a date (e.g. a date of birth).

In Figure 3A, the user defined information area 108a comprises a series of boxes. Each box is labelled, with an indication of the information (Day, Month, Year) of the information that should be inserted in each box. Electronic capture of the information (date) is facilitated, by ensuring that the user provides the correct information in the correct location on the form, in the correct format.

Figure 3B shows a preferred user defined identity information area 108b.

Again, the design user identity information is a date. However, in this particular example, a plurality of character (numerical) sequences are provided, to facilitate the input of the user defined identity information. An indication is provided adjacent each sequence of the parameters of that sequence e.g. whether that sequence corresponds to a day (D), month (M) or year (Y). To input the user defined identity information, the user makes a predetermined mark adjacent/through the desired characters i.e. an indicia is made against the desired characters by the user. In the example shown, it is desired that the user selects a number by drawing a horizontal line through the number. To facilitate the placing of the indicia/line, a pair of dots is placed either side of each character. Figure 3B shows a date selected of l3 October 73, by appropriate horizontal lines having been made by a user.

The blank registration form 100 is then sent/provided (e.g. posted) to a registered voter. The registered voter (e.g. the authentic user, as opposed to an illegitimate user) then fills in the form e.g. signs the form in the appropriate area 106, and marks the requested date in area 108.

The form is then returned to the relevant authority, and processed so as to electronically capture the information filled in by the user. In particular, the completed registration form 100 will be scanned, and a digital representation of the user provided information (e.g. signature 106 and date 108) stored, in conjunction with the corresponding registration identity code 104. Preferably, to facilitate any required manual cross-checking of the subsequent authentification process, an image of the user made indicia (e.g. signature) is electronically stored. Predetermined characteristics of the signature can also be stored, for use in subsequent verificationlauthentification processes of the ballot document and identity document.

Figure 4 illustrates a ballot document 222 and a corresponding identity document 226. In this particular embodiment, the ballot document 222 and the identity document 226 are formed as a single voting document 200. However, the ballot document 222 and the identity document 226 are separable e.g. by perforated line 225.

One ballot document and one corresponding identity document is provided for each voter. As per the registration document 100, each document 222, 226 includes a respective batch identity code 202, 212 corresponding to the batch in which the relevant document was produced/printed, and a registration identity code 204, 214 corresponding to the respective voter.

For convenience, the registration identity codes 104, 204 and 214 could be the same. Alternatively, for convenience, one or all of the registration identity codes 104, 204, 214 could be different, as long as each code is only associated with a particular voter (at least in the context in which the registration identity code is used e.g. the document on which it is provided). For convenience, and to prevent user confusion, typically the registration identify code 204 will be the same as the registration identity code 214.

Each document 222, 226 also includes a respective digital watermark 206, 230. The digital watermark will be described below in more detail, with reference to Figure 5.

The ballot document 222 further includes an area arranged for the insertion of the relevant vote 224. In the example illustrated in Figure 4, a list of candidates is provided, with the voter simply making a predetermined indicia (e.g. a cross) adjacent the preferred candidate, so as to indicate the vote cast by the voter. The identity document 226, includes an area for the insertion of the

user made indicia 228 (typically, this area will have the same format as area 106 on registration document 100, as the same information is required). Again, preferably, an area 232 is arranged for the provision of user defined identity information. That area 232 can have the same format as described above, with reference to the area 108 for the user defined identity information in registration document 100. As will be described in more detail below with references to Figures 6-9C, during the balloting process, information onlwithin areas 228, 232 is subsequently checked against pre-stored information (e.g. information obtained using the registration document 100), to facilitate in the determination of whether the ballot document 222/identity document 226 has been completed by an authentic voter. In an alternative embodiment (not illustrated), at least a portion of the user defined identity information is not provided on the registration document 100. Instead, an alternative source of information (e.g. database indicating birth dates of individuals) is used to obtain the initial user defined identity information for each voter. In the authentification process, the user defined identity information provided in area 232 can be checked against the known information, to verify whether the identity document 222 has been completed by the authentic voter. By not requiring that information on the initial registration document 100, an extra level of security/complexity is incorporated into the ballot system, to decrease the likelihood of fraudulent votes.

The documents described above with reference to Figures 2 and 4 have all been described as incorporating a digital watermark 110, 206, 230.

The digital watermark can take a number of forms. For example, it could be the modification of an image printed on the relevant document. For example, in the case of an image, the current values of certain pixels would be changed from the default values. Subsequent detection of the watermark can be performed by checking how the image (or at least the pixels which are known to be watermarked) compare with the original image/pixels.

The watermark is a printed watermark, printed on the relevant document.

Preferably, the watermark is imperceptible i.e. it is not possible for a human to distinguish the watermark from an un-watermarked original with its own senses (i.e. using the naked eye). It is known that certain colours are difficult for the human eye to pick out from a similar background e.g. yellow marks on a white paper. Further, it is estimated that the limit of human eyesight in being able to resolve small objects is approximately 0.003 inches i.e. features/marks less than 0.003 inches will not normally be detected by the human eye. It will be appreciated that images/features larger than 0.003 inches can be provided, if the colour of the watermark is similar to a background colour (at least as far as the human eye is concerned). For example, the watermark could appear to have the same visible colour, but could have a different, alternative colour to the background, that is outside of the range of human vision.

Preferably the watermark is indecipherable e.g. a human observer cannot determine the meaning of the watermark using solely his/her senses, or the fact that the watermark is a watermark. For example, the watermark could take the form of a series of dots printed on the paper, which are visible to the human eye. The dots could be positioned on the paper such that they appear, to an uninformed observer, to be randomly arrayed e.g. the uninformed observer would perceive that the dots are simply an error in production of the document i.e. the result of a poor quality photocopy. Alternatively, the digital watermark could take a form other than dots, but could be formed such that they appear to the uninformed observer to be other types of production defect or photocopying error.

Preferably, the watermark is fragile i.e. it will be destroyed by a typical copying operation such as using a photocopier. The use of certain colours (e.g. yellow on a white paper) and high-resolution printing e.g. l200dpi) makes it very difficult or impossible to copy watermarks using photocopying equipment.

The watermark could be formed to have a predetermined relationship to other information on the relevant document. For example, the watermark could have a predetermined relationship with respect to the batch identity code, the registration identity code, or both the batch and registration identity codes. For example, a predetermined watermark could be assigned to all ballot documents within a particular batch, and a different watermark assigned to all identity documents within a batch. Alternatively, the watermark could be calculated using a mathematical algorithm or transformation, and using either a portion, or the whole of, one or more of the identity codes.

Figure 5 illustrates an example watermark 110, 206, 230. The outline of the area defining the watermark is shown in this Figure (and in Figures 2 and 4) with a rectangular box. However, it should be appreciated that preferably no such visible information is provided on the actual documents 100, 200. It can be seen that the watermark 110, 206, 230 comprises a series of small dots arranged in a predetermined fashion within the relevant area. The view shown in Figure 5 is a magnified view of the dots. Preferably, the dots are of such a resolution that they are not visible to the naked eye. Similarly, the dots are shown as being black for purposes of clarity only.

Preferably, the dots are yellow, and printed on a white background. In this particular example, the same watermark 110, 206, 230 is used for each of the registration ballot and identity documents. The watermark 110, 206, 230 comprises a mathematical transformation of the relevant registration identity code. The watermark is suitable for being detected by a colour scanner of predetermined type and with a scanning resolution of a minimum of 200DPI. The watermark is a spatial watermark i.e. the position of the dots forming the watermark provide the watermark. The size of the dots may also be utilised to provide the watermark, preferably in conjunction with the relevant spatial position of each of the marks. A watermark is utilised by the company AlpVision SA of Switzerland. US 2004/0013285 describes how a digital watermark can be applied to printed material, whilst EP 1433305 describes how a spatial watermark, formed utilising a relatively high resolution can be scanned using a lower resolution image acquiring apparatus (i.e. scanner).

Figure 6 illustrates the apparatus 300 arranged to implement the preferred embodiment of the present invention, whilst Figures 7A-9C illustrate flow charts for the processing of the various documents in accordance with the invention.

The apparatus 300 is arranged to run as a secure self-contained system, to prevent corruption of the system by outside sources. The apparatus 300 includes at least one computing device 302 (e.g. PC or workstation) coupled to an image acquiring apparatus (the scanner) 304. The workstation 302 includes a program memory for containing processor readable instructions, and a processor configured to read and execute instructions stored in the program memory. In certain embodiments, the invention can be implemented utilising simply a scanner and a corresponding computing device. However, in this particular embodiment, the apparatus 300 further includes a server 306 to act as a store for all required data and system files.

Additional workstations 320, each with a corresponding scanner, are provided to allow the simultaneous process in parallel of a number of documents. A printer 312 is provided, to allow the printing of reports relating to the operation of the system e.g. error reports and audit reports of the processed documents. Such reports can also be displayed on the corresponding screen of any workstation.

A network switch 310 is provided, to allow communication between the various system components.

As a number of workstations/scanners are connected to the server, and as simultaneous processing of various documents can occur, in some instances data has to be locked on the server to prevent the potential of the same data record being updated on the server via requests from different workstations. It will be appreciated that such locking would not be required if only a single computer/computing device was utilised to perform all of the processes.

A vertical dotted line is provided within each of Figures 7A-9C. The actions indicated on the right of the dotted line are, in the preferred embodiment, performed by the server 306, whilst the steps indicated on the left of the dotted line are generally performed by the workstation, associated scanner or printer.

Figure 7A-7C illustrates the steps involved in the preparation (402-420) of blank registration forms, and also the steps (430-486) in the subsequent processing of the completed forms, once the forms have been completed by a user (422).

Firstly, application (registration) documents are received 402 requesting that a user is registered as a voter. The registration documents could be returned by post.

Each registration document will have been filled in by a relevant user/voter e.g. the document will have been signed in area 106, with a relevant date indicated in area 108. Received documents will be processed in batches. Data regarding the applications 402 is then input into the relevant workstation. A batch header is then prepared 404, for use with the returned registrations forms that are subsequently captured. The batch details and the request to issue the relevant data for capturing the registration documents are then passed from the workstation 406 to the server 408.

Subsequently, the server allocates the batch header data 410, and retrieves/determines the relevant document data e.g. the type and nature of the documents to be processed and the image capture and validation parameters to be applied to document verification such as the list of registration identity codes and batch identity codes to be captured, the types (if any) of user defined identity information 108 to be captured, and the digital watermarks 110 and actual physical watermarks in the paper substrate to be captured. The batch header and document data is then passed from the server 414 to the workstation 416. The workstation 416 subsequently instructs the printing of the batch header 418 via a printer, to attach to a set of received registration documents 420 corresponding to the batch header.

The batch header and each of the received documents in a batch are scanned 430 using a scanner, until all of the documents in that batch have been scanned (432).

The scanner produces a digital representation (e.g. image) of each document. The scanner can be arranged so as to also scan only predetennined portions/areas of each document (e.g. the areas corresponding to the position of the watennark 110, the signature 106, and the user defined identity information 108), and to provide an image (or sequences of images) for subsequent processing. However, in the preferred embodiment, the whole of each document is scanned, and the whole image subsequently stored, to provide a complete electronic record of the document. Each of the document images are sequentially processed 434 by the workstation. In particular, the workstation subsequently extracts the relevant desired information from the scanned images.

Firstly, the workstation extracts the voter identity by determining the registration identity within the scanned image (e.g. using optical character recognition to recognise the characters defining the registration identity code 104).

It is possible that a voter may have registered for an earlier ballot. In any event, it is desirable that the voter data stored on the server is locked whilst the image of the registration document corresponding to that voter is processed. Consequently, a request for the voter data is sent from the workstation 436 and received by the server 438. The voter data corresponding to the registration identity code is subsequently locked 440, and any pertinent voter data (e.g. date of birth, watermark used in registration document or algorithm used to determine watermark) retrieved from the server storage 442. Additionally, if the voter has previously registered in conjunction with a voter signature, then the stored voter signature is retrieved 446. An image of the stored voter signature can be retrieved, or data corresponding to the stored voter signature can be retrieved e.g. a determination of the signature characteristics such as the crossings, curves and ioops, upstrokes and enclosed areas within the signature.

Preferably, both an image of the voter signature and the corresponding data is retrieved.

The retrieved voter data and any stored signature is then passed from the server 448 to the workstation 450 for subsequent processing 456.

The image corresponding to the signature is identified within the document image, and either the signature extracted 458 for subsequent processing 460, or simply the area containing the signature identified for subsequent processing 460.

The extracted signature/relevant signature is then processed using a signature analysis routine 460. The signature analysis routine 460 determines the characteristics of the signature on the completed registration form e.g. it determines one or more of the crossings, curves and loops within the signature, upstrokes or downstrokes within the signature, or enclosed areas within the signature. Such signature analysis routines/characteristics are known e.g. the company Softpro GmbH & Co. of Germany produces routines that are suitable for analysing such static signature characteristics.

In the flow chart, only the signature is indicated as being extracted 450 and subsequently analysed 460. However, other authentification information is preferably also extracted and analysed e.g. the characteristics of the watermark 110 and also the characteristics of the user defined identity information 108 such as the date of birth.

The data extracted from the registration document is then compared with the voter data stored on the server 456.

If the voter data stored on the server matches the corresponding data extracted from the registration document (at least within a predetermined criteria) then the registration document is accepted as being a valid document.

Typically, the threshold for accepting whether a signature is a valid signature will be set relatively low, due to the relatively low frequency of ballots and the fact that signatures can evolve over time. Signatures particularly evolve when people are relatively young. Preferably, the threshold for accepting a signature as valid is set so as to be dependent upon the age of the voter e.g. a relatively low acceptance threshold is set for relatively young (e.g. 25 or under) and more mature (e.g. 65 or older) voters, with a higher threshold set for other voters. Preferably, if the level of similarity between the signature on the registration document and the stored signature is too high, then the registration document is determined to be invalid. The majority of signatures vary slightly, with an identical signature often indicating that the signature has been generated using a digital copying or tracing technique. Thus, if the level of similarity between the digital representations is too high, the registration document is rejected.

Assuming that the voter data (e.g. digital watermark, date of birth) and signature stored on the computer match within predetermined limits the corresponding items from the registration document, then the captured signature is then passed from the workstation 466 to the server 468, to update the signature information stored on the server 470. Such a system ensures that an up to date signature is maintained on the server.

If the voter datalsignature are determined not to match 462, then the stored voter data and the corresponding images (e.g. the individual images of the signature and date of birth information) are all displayed on the screen of the workstation (step 464).

A further check is then made as to whether the application is valid or not (step 465). This validation could be performed using a computational routine e.g. if no voter signature data was previously stored, but the other information is deemed to be correct, then the application is deemed valid, and the captured signature passed to step 466 for subsequent updating of the signature stored on the server (468, 470). In such an instance, it will be appreciated that no display of the relevant data need be performed (i.e. step 464 could be omitted).

More preferably, the application validity check 465 is performed by an operator of the workstation. The operator can check that a valid signature has been utilised, and can also determine whether any obvious errors have resulted in corruption of the image. For example, the operator can check that the signature appears to be a good copy of the signature. Equally, if an error was made by the voter in recording the user defined identity information (e.g. a crossing out has been performed in the date of birth, and a subsequent correction made), then an operator can relatively easily detect such a change, and ensure that the correct data is passed for subsequent storage (steps 466-470). Equally, if the signature has been placed in the wrong position, then the operator can arrange for an update of the signature capture area to be provided, and the verification routine re-run.

Assuming the application is assumed valid from steps 465, then once the captured signature has been used to update the voter data, the image of the complete registration document ("application") is then passed from the workstation 472 to the server 474, for subsequent storage/updating of the information stored on the server 476. Preferably, any other relevant information (e.g. user defined identity information) is also passed from the workstation to the server for storage/updating on the server.

The registration document processing is subsequently deemed to be complete 478, and the relevant voter data (corresponding to the registration identity code of the document being processed) then unlocked 480 on the server. Additionally, the batch history (i.e. the record of the document processing) is also updated, to show that the relevant registration form was successfully processed.

However, if the application validity check 465 should determine that the registration document is invalid, then the registration document is rejected 484 and the batch history updated to reflect that rejection 482. Additionally, a prompt is provided so as to ensure that the relevant registration document is removed and quarantined for later inspection 486. Such a prompt can be provided to an operator, or can be provided to a document feed used on the scanner, and used for sorting ace epted/rej ected documents.

The production of the blank identity documents (e.g. declarations of identity) and corresponding ballot documents (e.g. a ballot paper) will now be briefly described. The preparation of the documents 222, 226 can be regarded as two separate operations, even though the documents 222, 226 might both be printed in a single printing operation e.g. on a single sheet of paper. Alternatively, each document could be printed separately, with each ballot document being subsequently matched with the corresponding identity document for despatch to the relevant voter. Firstly, a request is input into a printing system, indicating which identity/ballot documents should be prepared e.g. documents from a particular set of voters/subset of voters, such as all voters within a constituency or geographical area. The printing system then retrieves or determines the relevant document data for the respective identity documents and/or ballot documents.

For example, the ballot document data could include all of the information required to indicate the batch identity 202, the registration identity 204, the watermark 206 and the list of candidates 224 for each of the desired ballot papers 222. Similarly, the data for the identity document could include the relevant registration identities 214, the batch identity (or identities) 212, the data for forming the digital watermark 230, and an indication of any user defined identity information 232 that should be printed (if any).

Figures 8A-8C and 9A-9C show respectively the steps involved in the authentification of a received identity document (e.g. a declaration of identity) and a corresponding ballot document (e.g. a ballot paper). As indicated in Figure 4, the ballot document 222 and the identity document 226 can be formed as a single voting document 200. In such an instance, the processing of the received documents 222, 226 can be regarded as two separate operations (steps 502-520 and 602-620 respectively) even though the documents 222, 226 might both have been printed in a single printing operation. If the ballot and identity documents 222, 226 are provided by a single voting document 200, then the documents 222, 226 are separated once they have been received by the authority receiving the documents from the relevant voter. Each document is then subsequently processed separately, to maintain voter anonymity.

As the processing of the documents 222, 226 involves similar steps, for convenience, the processing of both documents will now be described simultaneously, with reference to Figures 8A and 9A.

Firstly, a request/instruction 502, 602 is provided to the workstation, requesting that batch header information is produced for the relevant identity documents ("declaration of identity" documents) or ballot documents ("ballot papers") are produced/printed 502, 602. A batch header is prepared 504, 604, for use with the received documents that are subsequently processed. The batch details and the request to issue the relevant data for processing the identity/ballot documents are then passed from the workstation 506, 606 to the server 508, 608. Subsequently, the server allocates the batch header data 510, 610, and retrieves/determines the relevant document data for the respective identity documents (step 512) and ballot documents (step 612). The batch header data is then passed from the server 514, 614 to the workstation 516, 616. The workstation subsequently instructs the printing of the relevant batch header document 520, 620 for the received documents 518, 618 via a printer.

Turning now to only Figures 8A-8C, the batch header document and each of the returned identity documents are scanned 530 using a scanner, to form a digital representation of the document (e.g. digital image). Each document is scanned 530 in turn, until all of the documents in a batch 532 have been scanned.

Once the scanning has been completed, the document images are subsequently sequentially processed 534. As described above with reference to Figure 7A, preferably the whole document image is saved, although it is possible for only particular areas of each document to be saved, corresponding to the information that it is desired to obtain from each document.

The first step in the processing of the image data is the check on whether the digital watermark indicates that the document is authentic. In the example shown in Figure 8B, it is assumed that the same watermark is utilised for each document.

Consequently, the scanned image can be processed by comparing the digital watermark on the document (step 536) with the known digital watermark with which the document was originally printed. This analysis can be done by a watermark analysis routine 538, such as can be provided by Alp Vision.

It will be appreciated that different digital watermarks can be provided on each document (e.g. due to the digital watermark having a predetermined relationship with respect to the registration identity code/or to different batch identity codes), then the scanned image can be processed to extract the relevant code, the intended, predetermined digital watermark calculated based on the extracted code and the digital representation of the scanned area compared with the predetermined digital watermark to determine whether the two match, and the document is authentic.

Equally, a common predetermined digital watermark can be obtained from the server memory for the document type being processed, and the digital representation of the scanned area checked against that predetermined digital watermark.

Whether or not the digital watermark/position on the digital watermark matches that of the predetermined digital watermark determines whether or not the document is regarded as authentic 540.

If the document is not regarded as authentic, then the identity document is immediately rejected (step 542) and instruction is then provided to remove the identity document from the batch, and quarantine the identity document 572. A further instruction is also provided to ensure that the corresponding ballot paper is removed and quarantined (step 574). As per the removal/quarantine step 486, such removal/quarantining can be performed by an operator, or automatically by an appropriate scanner feeder. The batch history is then subsequently updated, preferably including not only the reason for the rejection, but also which documents (e.g. corresponding to which batch identity codes and registration identity codes) have been removedlquarantined. The batch history may subsequently be utilised to run a report, indicating what errors have occurred and why. Such a report can be useful in tracking down either errors in the document preparation or scanning process, or fraudulent voting attempts.

If the document is found to be authentic (step 540), then the document can be processed to extract the registration identity code (i.e. voter ID). A request for the relevant voter data is then passed from the workstation 544 to the server 546. The relevant voter data is locked 548, and the voter and ballot data retrieved, along with the stored voter signature (i.e. user made indicia) 542, and the voter, ballot data and signature passed from the server 544 to the workstation 556, for comparison with the data extracted from the scanned image. The voter data will include any user defined identity information e.g. date of birth either input on the registration form, or obtained from another data source.

Information on the signature is then subsequently extracted from the scanned image (step 566/564), and analysed e.g. using a static signature analysis routine 564.

Similarly, any other relevant identity information (such as user defined identity information e.g. an indication of a date of birth provided in area 232) can also be extracted 566. The extracted data (e.g. the characteristic components of the signature and the date of birth extracted from the scanned document) is then compared with the corresponding data that had been stored on the server 558.

If the voter data matches the data extracted from the document image, then the identity document is accepted as valid (step 578). A signal is then output indicating that the identity document is valid. In particular, a notification is passed from the workstation 578 to the server 580 to update the voter record to indicate that a valid identity document has been received. Further a copy of the relevant identity document image is passed from the workstation 588 to the server 584, for storing in conjunction with the voter data corresponding to that registration identity code, so as to provide a digital record of the identity document(step 586). The application processing is then regarded as complete 580, then notification sent to the server to unlock the voter data corresponding to that registration identity code (step 590). At the same time, the bath history is updated, so as to provide a record of the successful completion of the processing of that declaration of identity document, for subsequent audit trails/checks.

If, in step 560, it is determined that the voter data does not match the data obtained from the extracted image, then a further check is made on the validity of the identity document (step 568). As described above with reference to steps 464, 465, this validity check can be performed automatically. More preferably, the voter data and the corresponding image data extracted from the identity document is displayed on a screen of the workstation 562, to allow comparison/validation by the operator (step 568).

If the identity document being processed is determined as valid (step 568), then the procedure passes to step 578, and is processed in the normal way. In the final updated batch history, preferably a record is kept that the initial voter data match step 560 was inconclusive, and that a further validity check was required (steps 562, 568).

Again such a log in the batch history can assist with tracking down fraudulent documents.

If the identity document validity check 568 determines that the document is not valid, then the identity document is rejected 570, and steps 572, 574, 576 performed to remove both the identity document and the corresponding ballot paper, with a record of the document processing (including the validity checks performed by steps 562, 568) updated in the batch history.

Turning now to Figures 9A-9C, the procedure for the processing of the ballot documents will now be described in more detail. It is noted that the procedure for the production of the batch headers for the received ballot documents has already been described above, due to the general similarity between steps 502-620 and steps 602-620.

Similarly, steps 624-634 can be regarded as identical to steps 530-634, as the same scanning procedure and watermark authenticity checks will be made on the ballot document as is made on the identity document.

If the document authenticity check (step 634) determines that the digital watermark stored on the ballot document does not match the predetermined digital watermark, then the ballot paper is rejected (step 662). An instruction is then indicated to remove and quarantine the relevant ballot paper (step 664). As described above with reference to other removal/quarantine steps, such a process can be performed either manually or automatically. Once the rejected ballot paper has been removed, then the batch history will be updated (step 660) indicating the reason for the removal of the ballot paper, and preferably also providing a record of the relevant registration identity code 204 andlor batch identity code 202, for subsequent audit trail analysis.

If the watermark check determines that the document is authentic (step 634), then the registration identity code is extracted from the scanned image (step 636).

The workstation passes the registration identity code (as used on the ballot document) to the server, and requests the relevant voter data (638). The relevant voter data is an indication as to whether (i) a valid identity document has been received for that voter, and (ii) the relevant voter has voted previously in that ballot.

The server locks the voter data corresponding to the registration identity code (i.e. so as to prevent that voter data being updated by other information sources e.g. other workstations) 640. The relevant voter data! ballot data is then retrieved by the server 642, and passed from the server 644 to the workstation 646.

The workstation subsequently checks that the registration data passed to it by the server matches the scanned registration document (i.e. by comparing the relevant batch! identity codes on the document with those provided by the server) 648, and if not re-issues the request for the relevant information from the server.

The workstation checks whether a valid identity document has been received for that voter, and the relevant voter has voted previously in that ballot. If the relevant voter has previously voted (or if no valid identity document has been processed), then the ballot document is rejected. (step 662), with steps 664, 660 followed as described above. Preferably a record of the reason for the rejection is provided to the batch history log (step 660), for subsequent analysis.

If a valid identity document has been received for that voter, and the relevant voter has not voted previously in that ballot, then the ballot paper is accepted (step 652). Notification of the acceptance of the ballot paper is passed from the server to the workstation, and the voter record updated to indicate that the voter has now voted in the relevant ballot (step 654).

The workstation issues a notification to the server that the processing of the ballot document is complete (step 656), and the server subsequently unlocks the voter data. The batch history is also updated, to indicate that the ballot paper has been passed as acceptable.

The accepted ballot paper is then passed for subsequent vote counting. The counting of the vote indicated by the ballot paper can be performed manually. More preferably, the counting is performed automatically, by scanning of the relevant portion of the ballot paper to form a digital representation (e.g. image), and that digital representation processed to determine the relevant vote. The total value of a counter (corresponding to the determine vote) is then incremented. The vote determination can be performed by processing the image of the ballot document (as captured in step 624). Alternatively, the scanning and subsequent processing can be performed utilising a separate scanner! computation (processing) device.

Preferably, to maintain the secrecy of the vote cast by the ballot paper, no record of the scanned image of the ballot paper (or at least the area of the ballot paper indicating the vote) is kept, nor is any record the vote cast stored on the computer in combination with any information that could be used to identify the voter.

The above embodiment is described by way of example only. Other embodiments will fall within the scope of the present invention. For example, although the ballot system has been described in relation to a vote casting a single vote, it will be appreciated that the present invention can be used in ballot systems in which a voter casts multiple vote e.g. in German national elections, in which a voter can cast two votes on a single ballot document, one vote for the local candidate, the other vote for the party.

In the preferred embodiment described with reference to Figures 7A-9C, it is assumed that the user made indicia is a signature; as described herein it will be appreciated that other user made indicia could be utilised e.g. fingerprints or thumbprints, using similar checks as with the signature analysis! comparison steps. In such instances, appropriate routines are utilised to extract the pertinent characteristics of the user made indicia.

Claims

CLAIMS

1. A method of processing a ballot document and an identity document, comprising: receiving a ballot document indicating a vote and a corresponding identity document associated with the ballot document; scanning at least a first predetermined area of the identity document and forming a digital representation of the first area; processing the digital representation of the first area to determine whether the scanned first area includes a predetermined digital watermark; scanning a second predetermined area of the identity document and forming a digital representation of the second area; processing the digital representation of the second area to determine whether the scanned second area includes a user made indicia of a known user; and counting the vote indicated by the ballot document only if it is determined that the first area includes a predetermined digital watermark and it is determined that the second area includes a user made indicia of a known user.

2. A method as claimed in claim 1, wherein said step of counting the vote includes: scanning a predetermined area of the ballot document and forming a digital representation of that area; processing the digital representation of the ballot document area to determine the vote indicated by the ballot document; and incrementing a value corresponding to the determined vote.

3. A method as claimed in claim 1 or claim 2, wherein the ballot document includes a registration identity code corresponding to the identity of a single voter, the method further comprising: scanning the document to determine the registration identity code of the document; checking a database to determine whether the voter corresponding to the registration identity code has already voted; and counting the vote indicated by the ballot document only if it is determined that the database indicates that the voter has not voted.

4. A method as claimed in any one of the above claims, wherein said ballot paper indicates at least two votes cast by a single user, and said step of counting the vote includes counting the votes indicated by the ballot document only if it is determined that the first area includes a predetermined digital watermark and it is determined that the second area includes a user made indicia of a known user.

5. A method as claimed in any one of the above claims, wherein said watermark is invisible to the naked eye.

6. A method as claimed in claim 5, wherein said watermark is invisible due to the marks defining the watermark being at least one of: a colour similar to a

background colour of the document; and small.

7. A method as claimed in claim 6, wherein the digital watermark comprises yellow marks printed on a white background, and each mark is less than 0.003 inches in size.

8. A method as claimed in any one of the above claims, wherein said watermark is indecipherable to a human observer.

9. A method as claimed in any one of the above claims, wherein the digital watermark is fragile.

10. A method as claimed in any one of the above claims, wherein said predetermined user made indicia is one of: a written signature; a fingerprint; and a thumbprint.

11. A method as claimed in any one of the above claims, wherein the processing of the digital representation of the second area includes: comparing the digital representation of the second area with a stored digital representation of a user made indicia of a known user; determining the level of similarity between the digital representations; and if the level of similarity exceeds a predetermined threshold, determining that the scanned second area includes a user made indicia of a known user.

12. A method as claimed in claim 11, wherein if the level of similarity exceeds a second predetermined threshold greater than the first, determining that the indicia of the second area has not been made by a user.

13. A method as claimed in any one of the above claims, further comprising: scanning at least a further predetermined area of the identity document and forming a digital representation of the further area; processing the digital representation of the further area to determine whether the scanned further area includes a predetermined user defined identity information; and counting the vote indicated by the ballot document only if it is determined that the scanned further area includes a predetermined user defined identity information.

14. A method as claimed in claim 13, wherein the further predetermined area includes a plurality of character sequences, the processing of the digital representation of the further area including: determining which characters in said lists have been selected by a user indicia; and determining whether the selected characters correspond to the user defined identity information.

15. A method as claimed in claim 13 or claim 14, wherein the user defined identity information includes a date.

16. A method as claimed in any one of the above claims, wherein each document includes a batch identity code corresponding to the batch in which said document is processed, the method further comprising: scanning each document to determine the batch identity code of the document; recording whether an error has occurred in the processing of each document; providing a report indicating the errors and the corresponding batch identity codes.

17. A method as claimed in claim 16, wherein an error includes any one of: an indication that a voter has submitted more than one ballot paper; a fault in scanning an area of a document; a fault in processing the digital representation of a scanned area; the determination that the first area does not include a predetermined digital watermark; and the determination that the second area includes a user made indicia of a known user.

18. A method of processing an identity document, comprising: scanning at least a first predetermined area of an identity document associated with a corresponding ballot document and forming a digital representation of the first area; processing the digital representation of the first area to determine whether the scanned first area includes a predetermined digital watermark; scanning a second predetermined area of the identity document and forming a digital representation of the second area; processing the digital representation of the second area, to determine whether the second area includes a user made indicia of a known user; and outputting a signal indicative that the identity document is valid only if it is determined that the first area includes a predetermined digital watermark and it is determined that the second area includes a user made indicia of a known user.

19. A method as claimed in claim 18, wherein said watermark is invisible to the naked eye.

20. A method as claimed in claim 19, wherein said watermark is invisible due to the marks defining the watermark being at least one of: a colour similar to a

background colour of the document; and small.

21. A method as claimed in claim 20, wherein the digital watermark comprises yellow marks printed on a white background, and each mark is less than 0.003 inches in size.

22. A method as claimed in any one of claims 18 to 21, wherein said watermark is indecipherable to a human observer.

23. A method as claimed in any one of claims 18 to 22, wherein the digital watermark is fragile.

24. A method as claimed in any one of claims 18 to 23, wherein said predetermined user made indicia is one of: a written signature; a fingerprint; and a thumbprint.

25. A method as claimed in any one of claims 18 to 24, wherein the processing of the digital representation of the second area includes: comparing the digital representation of the second area with a stored digital representation of a user made indicia of a known user; determining the level of similarity between the digital representations; and if the level of similarity exceeds a predetermined threshold, determining that the scanned second area includes a user made indicia of a known user.

26. A method as claimed in claim 25, wherein if the level of similarity exceeds a second predetermined threshold greater than the first, determining that the indicia of the second area has not been made by a user.

27. A method as claimed in any one of claims 18 to 26, further comprising: scanning at least a further predetermined area of the identity document and forming a digital representation of the further area; processing the digital representation of the further area to determine whether the scanned further area includes a predetermined user defined identity information; and outputting a signal indicative that the identity document is valid only if it is determined that the scanned further area includes a predetermined user defined identity information.

28. A method as claimed in claim 27, wherein the further predetermined area includes a plurality of lists of several character sequences, the processing of the digital representation of the further area including: determining which characters in said lists have been selected by a user indicia; and determining whether the selected characters correspond to the predetermined user defined identity information.

29. A method as claimed in claim 27 or claim 28, wherein the user defined identity information includes a date.

30. A method as claimed in any one of claims 18 to 29, wherein each document includes a batch identity code corresponding to the batch in which said document is processed, the method further comprising: scanning each document to determine the batch identity code of the document; recording whether an error has occurred in the processing of each document; providing a report indicating the errors and the corresponding batch identity codes.

31. A method of processing a ballot document comprising: scanning at least a first predetermined area of a ballot document associated with a corresponding identity document, the ballot document indicating a vote, and forming a digital representation of the first area; processing the digital representation of the first area to determine whether the scanned first area includes a predetermined digital watermark; scanning a second predetermined area of the identity document and forming a digital representation of the second area; processing the digital representation of the second area, to determine whether the second scanned area includes a user made indicia of a known user; and counting the vote indicated by the ballot document only if it is determined that the first area includes a predetermined digital watermark and a signal has been received indicative that the corresponding identity document is valid.

32. A method as claimed in claim 31, wherein said step of counting the vote includes: scanning a predetermined area of the ballot document and forming a digital representation of that area; processing the digital representation of the ballot document area to determine the vote indicated by the ballot document; and incrementing a value corresponding to the determined vote.

33. A method as claimed in claim 31 or claim 32, wherein the ballot document includes a registration identity code corresponding to the identity of a single voter, the method further comprising: scanning the document to determine the registration identity code of the document; checking a database to determine whether the voter corresponding to the registration identity code has already voted; and counting the vote indicated by the ballot document only if it is determined that the database indicates that the voter has not voted.

34. A method as claimed in claim any one of claims 31 to 33, further comprising processing the identity document as claimed in any one of claims 18 to 30.

35. A method as claimed in any one of the above claims, wherein all of said scanning steps are performed by a single scan of the relevant document.

36. A carrier medium carrying computer readable program code configured to cause a computer to carry out a method according to any one of claims 1 to 35.

37. A device for controlling a scanner to carry out a scanning operation, the device comprising: a program memory containing processor readable instructions; and a processor configured to read and execute instructions stored in said program memory; wherein said processor readable instructions comprise instructions configured to control said device to carry out a method according to any one of claims 1 to 35.

38. A voting document comprising an identity document comprising: a first area including a predetermined digital watermark; and a second area arranged for the provision of a user made indicia of a known user 39. A voting document as claimed in claim 38, further comprising a registration identity code corresponding to the identity of a single voter, the digital watermark having a predetermined relationship with respect to the registration identity code.

40. A voting document as claimed in claim 38 or claim 39, further comprising a batch identity code corresponding to the batch in which said document was produced, the predetermined digital watermark having a predetermined relationship with respect to the batch identity code.

41. A voting document as claimed in any one of claims 38 to 40, further comprising a ballot document including a list of candidates arranged for selection by a voter.