Voice ID
Can we identify citizens who call the government with their own voice? That is the question that we have answered together with Digicampus in a joint experiment. These are our findings.
Conclusion
The sum of all the points collected from the various studies surrounding Voice ID yields the result that we do not continue with this. In short, we can list the following points for this:
- According to residents, there is no added value for this solution.
- There is still a lack of legislation and regulations for this solution.
- The technology itself is currently too unknown for residents and government to feel familiar.
- An important point for now is that there is an existing workable alternative, namely a counter.
- The research into contact ID that provides authentication over the phone via DigiD gives a positive picture and will take further shape in 2022.
All studies and results can be found in this article.
What is Voice ID?
Millions of calls are made to the government every year. Various government organizations experience it as a hindrance that they cannot help people with a personal request for help through this channel. There is no good way to verify the identity of a caller. In some cases, control questions are used. But the answers to this are often known in the area or easy to find. We are therefore looking for a solution that offers more security and at the same time is easy to use for, among other things, digitally less skilled.
Voice ID (voice recognition) is one of the solutions we are investigating. It is used by the government in Australia and New Zealand, among others, to provide services by telephone.
Why are we doing this?
Your voice is unique. With Voice ID you use these unique, biometric characteristics to record a kind of 'voice print'. This can then be used to verify the caller's identity. We think that Voice ID can make government services more inclusive, partly because it can be used well by fewer digital skills. Naturally, we must test this assumption. We also know that Voice ID is not suitable for everyone, for example for people with speech or hearing problems. We are therefore not looking for a one-size-fits-all solution, but an extra option for people who prefer telephone contact over a web portal.
Flash poll
What do the Dutch think of Voice ID? To gain insight into this, we conducted an online flash poll. In July 2020, we shared an online questionnaire via LinkedIn, Facebook, Instagram and Whatsapp. This was completed by 966 respondents.
38% of the respondents is open to the use of Voice ID. 63% said it knew what it is. This is a nice score for a technology that is still fairly new. In addition, 47% says it expects voice recognition to be easy to use.
The current method, in which in some cases use is made of control questions, is seen by the respondents as the easiest and safest way. Additional research is needed to understand why this is so. It may have to do with the relative unfamiliarity of Voice ID, but it may also be due to certain perceptions or experiences. Ultimately, this kind of in-depth information is necessary to understand within which preconditions you could deploy a technology such as Voice ID.
Should we want this?
Just because something is technically possible does not mean it is a good idea. That is why we entered into discussions with people from within and outside the government about the moral and social aspects that play a role in using Voice ID. We did this with a proven method: a Moral Impact Assessment.
Based on a number of steps, we have collected opportunities, concerns and perspectives for action, for example with regard to the possible social effects of Voice ID.
In the first round of discussions, we collected more than 100 post its! With the help of voting buttons, we have put together a top 5. We got to work on this in the in-depth discussion round.
Top 5:
- Danger of function creep
- Danger of voice imitation
- The next step towards a surveillance society.
- More chance of ID fraud.
- And in a positive sense: an alternative channel for people who cannot operate a computer properly.
The next step is to look at the values that are considered important around this technology. You should see a value as something that we as a society find important to safeguard or promote.
The main values are:
- Privacy
- Inclusivity
- Safety
- Equality
- Trust
- Freedom
Prospects for action and follow-up research
Together we then devised action perspectives for the most important effects and values. What could we do to rule out the negative effects, exploit the positive effects and protect the stated values? This resulted in a list of dozens of measures and preconditions that provide us with important starting points for further research. For example, it has been stated that decentralized storage of vote imprints is essential to reduce abuse. We have to find out whether this is (technically) possible and what this requires of us. It has also been mentioned that you must supervise the providers of this technology, but how do you do that? What standards do you use to assess whether the technology is good and safe enough to use and how do you test this? And if you assume that no system is infallible, what risks does a user run, how do you limit the consequences and what does the unhappy flow look like? From a user perspective, it has been suggested that you should have a simple enrollment process to record your vote print without compromising on security and reliability.
Enrollment process
It is precisely the enrollment process that is the crux, because that is the moment when you check whether the person and voice print belong together. Can you design a process that offers sufficient certainty and yet is accessible enough for various target groups, including fewer digital skills? In short, food for thought and, above all, food for further research and experiments. In the coming period, we will be tackling this step by step, starting with the dilemma surrounding safety and ease of use.
Note: The following participated in the Moral Impac Analysis: Ministry of BZK, Volksbank, SVB, Privacy First, Waag, VodafoneZiggo, Innovalor, Hooghiemstra, Novum, Digicampus, ANBO, Seniorweb, Code4NL, Province of South Holland, ICTU, User Central, Tax Authorities, Municipality of The Hague, Land Registry, TU Delft, NFI, UTwente, Visio, RvIG and DUO, Logius.
Prototype test with Storyboards
We did the prototype test for Voice ID with storyboards and it turned out that the participants see no added value from the addition of a Voice ID in the telephone channel at the government. This test was done with a small group and there were no visual impairments among the participants. They may think very differently about it. Authentication over the phone can be made easier and less cumbersome via existing means of authentication such as DigiD. After all, this is already known and feels safe and familiar to many people. For people who are less comfortable with digital government services, there is a safety net through a counter where telephone services are not possible due to the lack of telephone authentication. The strongest and most certain conclusion of this test is that creating a Voice ID while you want an answer to your question is not workable and that it is undesirable to increase your Voice ID again. motto: good first time.
Findings by test and organization
Policy - BZK
- There is no policy to identify or authenticate citizens through biometric data on the phone or other means such as chat, app or smart speaker
- Requesting biometric data from citizens should only be an additional option and should not be made mandatory without additional legislation
- There is a policy on the storage of personal data, these also apply to the storage of biometric data, but saving is only allowed if you are also allowed to use it and then you have to sort it out
- There is a policy on the storage of personal data, these also apply to the storage of biometric data, but saving is only allowed if you are also allowed to use it and then you have to sort it out
- Question marks about the accessibility of the issuance process. The intended target group is expected to be less digitally skilled. Are they able and willing to apply for a Void ID? Draw up a number of scenarios for how and in which situation you would like to apply a Voice ID for authentication of citizens and submit these to the Ministry of the Interior
Market
- There are different solutions available from different suppliers that can be used.
- Voice ID can be used via the telephone, but also for access to an app.
- Voice ID, also called speech authentication, is a type of user authentication that uses voiceprint biometrics. Voice ID is based on the fact that vocal characteristics, such as fingerprints and the patterns of people's irises, are unique to each individual.
- Voice ID is a good anti-fraud tool as you cannot use searchable data.
Flash poll
- 13% would certainly want a Voice ID, 25 maybe, 30% thinks not and 32% certainly does not say.
- 63% knows what voice recognition is and 47% finds it easy to use and 21% finds it safe
- 78% of people say their identity is always or often checked when they call a bank or government agency with a personal question
- The current method of control questions is seen by the majority as the safest and easiest.
Moral Impact Assessment
- When done right, an easy-to-use, inclusive, low-cost way that introduces reliability.
- Framework of standards for biometrics, a framework must be drawn up for voice biometrics and its application for authentication.
- Government can finally really help people who call. But we fear that you will never be able to call anonymously again.
- Privacy and Security by design, when designing the system, design must be based on privacy and security. These are the most important conditions before any other steps can be taken. Unleash ethical hackers on this.
Science
- The technology behind Voice ID / voice identification and authentication works well and is sufficient for this application. Especially when it comes to an extra step/
2 step authentication. - Technically it is in good order.
- The technology is in motion, so it is not always robust and will require a lot of attention.
- Spoofing runs as fast as system security, this remains a cat and mouse system
- Enrollment is important, data input is essential, bad start results in an unsafe system.
- System is safe because you do not store votes but a derivative in 2 rows of numbers that are compared.
- Voices are not unique, you can distinguish between 10,000 people on the forensic side.
- You don't have 1 set of characteristics that is always right, people talk differently every time, you also feel different. You have to build in extra checks for this, for example by updating the set every time you call.
- The situation where people call is dependent on the success of the authentication. A busy environment or bad connection does not help.
Performance
- RDW has conducted a trial with storing photos (also biometrics). They can advise more on security/encryption, etc
Conclusion
The sum of all the points collected from the various studies surrounding Voice ID yields the result that we do not continue with this.
