GB2374446A

GB2374446A - Secure telephone polling

Info

Publication number: GB2374446A
Application number: GB0028940A
Authority: GB
Inventors: Peter Crabbe; Anthony Crabbe; Pamela Molyneux; Hugh Molyneux
Original assignee: Individual
Current assignee: Individual
Priority date: 2000-11-28
Filing date: 2000-11-28
Publication date: 2002-10-16
Anticipated expiration: 2020-11-28
Also published as: GB2374446B; GB0028940D0; AU2002228147A1; WO2002045396A2; WO2002045396A3

Abstract

A secure telephone polling system enables users to vote anonymously from poll organisers and eavesdroppers, whilst still allowing authorised investigators to check that only legitimate voters have participated in the poll. a voter submits to the organisers only parts of his existing personal identification codes, such as his National Insurance number. A poll organiser requires two or more partial codes related to a single personal detail, such as a home postal code. When the organiser successfully matches two or more code entries to a single personal detail, this gives a very high probability that the person entering the codes is the same person fully recorded on the third party's original databases.

Description

i v 2374446 \ SECURE TELEPHONE POLLING

BACKGROUND

In general, the organization of polls may take three forms. They solicit votes in order to: a) Confer a mandate upon selected representatives of the participating electorate.

b) Confer an honour upon selected individuals.

10 c) Register opinion about selected issues.

The organization of a mandatory poll needs to protect both the privacy of individual voters and the poll against fraudulent or malicious individuals. The present invention is concerned primarily with enabling private polls of the type a) above to be conducted by telephone calls, 15 but may also have application in the cases of b) and c). Principles of the present invention may also be applied more generally in cases where an individual is required to identify themselves.through entry.of. Personal.Identifination Numbers (PIN 3).

1. Prior Art

There are numerous systems designed to handle telephone polls of types b) and c) above. In respect of a) above, patent searching reveals that existing solutions for validating a caller's.

subscription to a telephone service fall into three main categories: 25 1. Those that use telephone pe$i erals, such as a telephone card read=, which requires the caller to identify himself by use of a card issued by the service provider (US5412727, I3S4995081, W096/02044)

2. Those that build recognition hardware into the telephone system, e.g. an identity chip on the caller's home telephone set, or a system that recognizes the telephone set from which 30 a call is being made (W097/04602A2, US5838774, JP9081821A, JP8137969A, IP8044919A, WO99126396)

3. Those that request the caller to enter PIN s on the telephone keypad and match those PIN's with pre-stored data about the caller (W097/46031A1, US5689247, US5528670, US5311594, US3644675). The present system falls under this category.

Pilot tests for political telephone voting have been nm in the USA and Canada in the 1970's and 80's. The systems used there still relied upon elements of non-telephonic activity, such as.postal correspondences A feature of the present invention is that it. can, in principle, all be operated by telephone, using a single call session to authenticate the caller and thereafter, to 40 conduct a given poll. This feature is made possible by requiring the caller only to confirm personal data that is already pre-stored in existing public or commercial records.

To safeguard both the voter's privacy and- anonymity, the present invention requires the caller to enter only fragments ofthe identifiers held in the pre-stored records, for example, the first 45 nix digits of an sight digit PIN. This use of identifier fragments allows the poll organiser a very high degree of certainty that a caller could not accidentally enter data matching their personal identifiers held in the pre-stored records. The use of identifier fragments entered on a telephone keypad also means that the caller need never give their name, address, or full PIN, which prevents anyone obtaining the poll organisers records discovering the actual identity of 50 Me caller. Yet, file same data is sufficient to pinpoint a valid caller's postal area The means by which the present invention achieves these said features, are now described by a c nbination. of working principles and: examples.

AL DESCRIPTION

VOTER REGISTRATION

5 This is the preliminary step to that of voting. In the preferred embodiment of the present invention, registration could be included as part of each voting event, or in a second embodiment, registration could be a one-off evens that registered a caller as a voter for subsequent telephone voting in polls arranged by the same organisers.

10 2. Data Sources POT secret balloting, data about the prospective voter should be obtained from at least two, or more, independent public record sets (databases). For open balloting, such as raising a petition by telephone, it may be acceptable to register a signatory with data drawn from just one 15 database. If the signatory voluntarily provides their personal telephone number, then independent monitors can validate the petition's authenticity by calling back a given sample of signatories.

3. Secret balloting and data protection For secret balloting, the following requirements are essential: 1. Only the voter knows what choice he or she has made.

2. The voter's personal details are neither shared nor disclosed in a manner contrary to data 25 protection laws The present invention addresses these secret ballot requirements in the following ways: 3. The voter never supplies their name, or address.

30 4. The voter only supplies a fragment of any given ID they have, for example, only the 6 digits of their 3 letter 6 digit UK National Insurance no. This prevents anyone with access to either the poll organiser's database, or the voter's telephone calls, from gaining enough information to consult other record sets in order to find out the voter's name.

5. The data fragmentation described in 2 above also means that the owners of public records 35 can supply their records to a poll organiser, in a way that never breaches their Data Privacy obligations to individual citizens. The record owners may further secure their data from a poll organiser by "locking" the display mode of their computer database files, so that for instance, all file data is displayed in password format, ****. Proprietary software applications like Microsoft Access enable owners to set this type of data protection so that 40 only users with the on ner's password can Mange the file design.

4. Fraudulent voting and misuse of data It is desirable to protect against the following polling abuses: 1. Fraudulent acquisition of another person's I1) numbers.

2. Eavesdropping, such as telephone tapping.

3. Unauthorised use or distribution of individual records by the database holder.

50 The present invention does not allow either the poll organisers, or telephone eavesdroppers, to deduce the voter's name or address. However, the present system cannot prevent a) above if it is achieved by means such as mail interception, or disclosure by the voter, which is also a

problem with other secure systems, such as credit cards and electoral registration. The present

invention could make use of voice "signatures" if required. These voice entries could be recorded as WAV files, for instance. In the event of a fraud investigation the WAV files could be matched with recordings made by suspects.

5 5. Data Entry The data entry and system responses for the preferred embodiment of He present invention are now described by example. The telephonic system linking the caller to the poll organiser via the telephone carrier is shown schematically in Figure 1. At the poll organiser's telephone 10 exchange system, calls are relayed to a series of voice response interfaces, each linked to a personal computer, with each said computer being linked to a main server, in which the poll organisers keep their master database. The term "voice" may refer either to a human operator or a set of pre-recorded voice messages. The master database holds pre-stored personal identification data sullied by two record set holders who are independent of each other and 15 do not share data. Callers are prompted to enter their details using either speech or the telephone keypad. Speech entries are recognised and processed either by a human operator or by voice recognition software installed on the controlling computer for the response interface.

The communication between the response interfaces and computers would be managed by existing software, such as British Telecommunication's Meridian application, running on 20 personal or main frame computers, linked either to an automated, or operator controlled telephone exchange. The sequence of registration procedures is then shown schematically in Figure 2.

6. Data Latching In the following example, the poll organiser asks the caller-to enter at least two individual ID numbers, a and c, where a is an element of a personal data setpl, stored in Database 1 and c is an element of a personal data setp2, stored in Database 2. Database 1 is owned by the Department of Social Security, an organization which does not share any of its record data 30 with the owners of Abase 2. Nor do the said owners share information through any intermediary such as the said poll organiser, because the said owners only supply the said poll organiser with fragments ofthe said sets pi end p2.

Caller en Database i a = 1st 6 digits of National Insurance No. Data field 1 = a = 1 st 6 digits of N.l. No.

Data field 2 = b = Postcode

Database 2 c = 19t 6 digits of Nat. Health Service No. Data field 1 = c = 1st 6 digits of NHS No

Data field 2 = d = Postcode

35 As shown in the Venn diagram in Figure 4, the said poll organiser can match the said caller's entries a and c by finding a common factor, the said caller's postcode, in the intersection of sets pi and p2. The general principle illustrated here is that the caller's personal data set {p}, can only qualify for inclusion in the registry of valid voters { V} held in the poll organiser's master database, if it satisfies the following general criterion: For all {p} _ a,b),(c,dJ}, lip} is a member of{V} if andonlyifb=danda c b (1) In this example, the total number n, of 6 digit sequences taken from an NHS ID, can only be 1 million. So potentially, at}east 40 ofthe 40 million UK electors {V}, share the same 6 digit 45 sequence for either an HI or NHS no. By coincidence, Here may also be another 40 electors sharing one ofthe million or so valid UK Postcodes, {p},2 However, the odds against finding at random in {V3, a pair of NI & NHS 6 digit sequences (a,c) that both correspond to the same post code b = d, are

[(Y/nl)l [(V/n2)l [(Y/P)lP] = (40/4x10')(40/4x107)(40/106) = (2.5 x 1016) to 1 (2) Since there are 40 million pairs of NHS and NI that do satisfy equation (1) above, then a 5 rogue caller entering two 6 digit numbers at random has the following odds of getting his or her entry registered: (2. 5 x 1016)/(4 x 10') = 1 in 6.25 x 108 (3) 10 The security set-up of the present invention is then, based on a statistical notion of certainty.

On the one hand, the use of PIN fragments helps to disguise the voter's identity on the other hand, the criteria for relating the said PIN fragments give a very high level of confidence that they identify the same voter - and that the high odds against the registration of rogue voters effectively prevents them from participating in telephone polls.

7. Prior preparation of record sets To safeguard against freak duplications in originating databases, it is necessary to search the said databases for duplicate values before using them for registration purposes. Before use, 20 these said databases would also need to be filtered by date of bird, to remove all individuals under the voting age. Finally, each PIN would be stripped down to 6 digits by removing the unwanted letters or digits in the manner illustrated in Figure 4. The removal of letters from the required data entry has the benefit of making data entry by telephone much easier for the caller. 8. Example of A database slipup Figure 5 shows a database set-up for the above example. Callers enter the first six digits of their NHS number and the six digits of their NI number. For the purposes of example, the 30 second colas of the NHS and NI data records are shown "unbidden". However, in practice, both these columns would be displayed in password format, as illustrated in Figure 5, and the design of the tables be "locked" in that view by the owner's choice of a 20 digit security password. The two query tables could also be locked in the same way, which still allows the database user to view the necessary query data PIN numbers are automatically assigned to every caller as their data is entered on the table called "Caller" in this example. In practice, the PIN s will comprise of much longer digit sequences than those shown in the example. Each data field in the "Caller" table is set to

reject duplicate data entries, so that each record of each call in which the caller seeks 40 registration is unique and any caller entering the same identification details more than once Not be registered more than once. In the example shown Figure 5, caller 1 has entered erroneous information for their NI number and Caller 5 for their NHS number. Only callers listed in the "Match Postcodes" query will have their PIN numbers validated for use in the next phase, that of voting.

THE VOTING PROCESS

This is the second of two processes, wherein registered callers can cast their votes in a poll.

A. Data Entry Figure 6 schematically shows the processes in the preferred embodiment At-enable callers who have successfully registered themselves to cast their votes in a subsequent telephone poll.

55 The said callers are guided through a menu of options, from which they may then make a a

selection by keying in the item numbers on their telephone keypad. As for the registration database, data fields are set to reject duplicate voter details and thus to prevent the same caller

voting more than once.

5 10. Data Matching As shown in the example database, illustrated in Figure 7, the voting options are defined on a table "Options for Election 001 and all votes cast by registered callers are entered on a form linked to a table, "Votes for Election 001. A sub-programme embedded in the form matches 10 the caller's entries with the register of users and will not open the choice box in event of mismatches, which in ton, prevents the call from being recorded as an entry on the master database. The votes cast can then be counted and correlated with specific geographical areas by matching the individual votes with postcodes, as in the kind of crosstab query illustrated.

15 11. Data Privacy and Security Figure 2 shows that the information given by callers during the voting process does allow the poll organisers to correlate the following personal information about the caller: (19$ 6 of 10 digits of NHS no.) + (Postcode) + (Option choice).

20 But once again, the present system does not allow telephone the said the poll organisers, or eavesdroppers to deduce the voter's individual identity, nor their name and individual address.

So the present system provides a very high level of guarantee that the caller is the person who is described by public identification systems, and the system also secures the voter's right to anonymity. Only someone with legal authority to search all the databases used in the present 25 system could get closer to matching the date with a particular individual. However, data protection legislation may allow the said poll organisers to supply to third parties, trend details abstracted from the above information, such as votes cast by geographic region.

12. Voter's check on how their vote has been recorded A filer benefit ofthe present invention over traditional voting systems is that voters can, if they wish, call the poll organisms to verify how their vote was recorded ire a given poll. This they may do by calling another service, which operates as shown in the schematic of Figure 8.

The voter dials the service number for the poll they wish to check and logs on by entering 35 their registration PIN. The computer interface then automatically uses that PIN to searches the data table "Voter Cross Check" illustrated in Figure 8, matches the PIN with the vote option number and the name of that option. The option name is then announced by voice to the caller, via the response interface system.

REFERENCES

An extensive review of these appears under the website of "Government by the People" at 4S http://www.vote.org 2 Based on the assumption that each full UK postcode covers a group of 15-30 households, sharing a common street name, of. information given under http://www.brainstorm.co. uk/utils/postcodes.html

Claims

What is claimed is:

5 1. A system for a service provider to authorise a correspondent to be a legitimate user of the service without recording the personal identity of the said correspondent, wherein: a) the said provider records, on a database, the identification codes of any potential correspondent in a one-to-one relationship with at least one of the said correspondent's personal details, such as his home postal code 10 b) a said correspondent enters onto the said database, only parts of the full sequences of symbols that comprise his said identification codes, such as the first six digits of an eight digit sequence c) the said provider authorises a said correspondent as a service user on the condition that two or more ofthe said correspondent's partial identification code entries match 15 the same said personal detail that is related to each said personal identification code on the said database d) the said provider offers services such as voting to said correspondents who have entered said partial sequences of identification codes that satisfy the said condition for matching the said individual records on the said database.
2. The method according to claim 1 whereby the said service provider may authorise the said correspondent as a legitimate user of the said service, on the condition that one or more ofthe said correspondent's identification code entries match with the identification codes that already exist in a said one-to-one correspondence with the said correspondent's 25 personal details on the said database.
3. The apparatus of claim 1, wherein the said service provider records data about said correspondents on a computer, using existing software that can automate actions and responses to and from the computer, including those said actions necessary for 30 maintaining a telecommunication dialogue with the said correspondent.
4. The apparatus of claim 1, wherein a said correspondent enters his said personal identification symbols onto a computer database from a location remote from the said computer, by using a computer peripheral device such as a keyboard or a telephone.
5. The apparatus of claim 1, wherein the said service provider may use telecommunication devices such as telephone handsets, to present a spoken or printed menu of choice options to a correspondent who is authorised on the said service provider's database by the matching of said identification codes with said personal details.
6. The apparatus of the preceding claims, where a said correspondent may use the said peripheral devices to enter his choices of said options presented by the said service provider onto the said service provider's computer database.

45
7. A method where the said service provider may use computer database software to relate a numba of said correspondent choice selections to the said correspondents' pasonal details, in order to produce summary information lists, such as those relating all the

entries of one particular choice to one particular postal district.

50
8. A method wherein the said service provider obtains the data about said users from third par ies who do not share their complete data with any other parties, who provide the said savice provider only with parts of the said data, such as six of eight symbols from the said user's pasonal identification codes, and who provide identification codes that are related only to a usa's postal code, not to his name or address.
9. A method where the said service provider cannot learn the full identity of a said correspondent who has been authorised by the methods according to the preceding claims, but can only identify the said correspondent as an anonymous person who has overcome high statistical odds against entering at random, one or more said partial identification 5 codes that correspond with personal details supplied by the said independent third part data owners.
10. The method according to claim 9, where the said odds against random symbol entries matching said personal details increase with the number of symbols comprising a said 10 personal identification code and comprising a said personal detail, such as a postcode.
11. The method according to claim 9, where the said odds against random symbol entries matching said personal details increases with the number of said third party databases stored by the said provider and therefore, the number of said partial identification code 15 sequences that must be entered by the said correspondent.
12. A method where an authorised investigative agency may take the said service provider's database records and relate them back to the records of the said third party data suppliers to establish with a statistical probability that a particular person was the correspondent 20 who entered a particular choice onto the said service provider's database.
13. A method wherein the said service provider may record the choices made by a correspondent and relate the said choice to the said correspondent's data set on a said database, in order that the said correspondent can use again the service described in the 25 preceding claims, to check which choices have been related to his data set on the said database.
14. The apparatus of claim 13, where the said service provider may use computer software to record user choices and enable any said user to check the said records by using computer 30 peripheral devices as described in the preceding claims.
15. A system as claimed in any preceding claim for a user to correspond with a remote service provider and to choose service options, such as voting for a political candidate, without disclosing Weir fall identity to the said service provider.
16. A telecommunication voting system substantially as herein described and illustrated in the accompanying figures and diagrams.