Anonymous questionnaires

My partner is a participant in a long term psychological study. I have been
asked to fill out a questionnaire to aid in this study. Some of the
questions address issues that I would never answer non-anonymously. After
speaking with the research director, I ended up with the following problem:
is there a way that would allow the institute to

1. Correlate my answers to the answers of my partner.
2. Verify that I have indeed sent in a filled out questionnaire (and send
me a check for participating).
3. Allow a supervisory agency, such as the U.S. Department of Health and
Human Services, to verify that the researchers did not just make up all the
data - that is to allow an audit.
4. Protect my privacy by making it impossible to correlate my name to the
answers given.

I would very much like to help to advance medical knowledge, but am
concerned what might happen once the institute is forced to hand over all
accumulated data to the Kommunal Kare Kontrol Kommittee under the Health
Care and Crime Prevention Act of 1998.

The researchers seem to think that there is no way to satisfy all the above
criteria. I, after following discussions on this list for a long time, am
not so sure. I intend to forward any workable suggestions (if the problem
even has a solution) to the researchers. I am sure that better privacy
protection would not only increase the number of participants, but also the
quality of the data.

Thank you all in advance,



-- Lucky Green <shamrock@netcom.com>  PGP public key by finger

On Wed, 24 Aug 1994, Lucky Green wrote:

> My partner is a participant in a long term psychological study. I have been
> asked to fill out a questionnaire to aid in this study. Some of the
> questions address issues that I would never answer non-anonymously. After
> speaking with the research director, I ended up with the following problem:
> is there a way that would allow the institute to

Interesting problem.  The suggestion (by whom?) to use two envelopes is 
useable as long as there is a trusted party involved.  This is very 
similar to the way such surveys are performed in Norway:  Each questinare 
has a random number on top and a trusted party is able to link numbers to 
participants' names and check who has answered and so on.  Researchers 
only see numbers and not names.  The problem is that the trusted party is 
often very close to the researchers using the survey...

Here is a suggestion for an electronic solution based on anonymous 
electronic coins:

You fill in your form and submit it electronically to the survey 
organizer.  The organizer acknowledges your form by giving you a blind 
signature much in the same way as a withdrawal in a Chaumian electronic 
cash system.  Later you unblind the signature and send it to the 
organizer together with name and adress to be registered as a 
participant.  The blind signature prevents linking of your name to the 
returned form but still proves that you have returned a form.

> 1. Correlate my answers to the answers of my partner.

Not directly provided by this simple solution, but the suggestion made by 
Stephen D. Williams to link you and your partner by writing down the same 
random number on the returned forms can be used.  There are other ways to 
link anonymous transfers too, but I won't come into that now...

> 2. Verify that I have indeed sent in a filled out questionnaire (and send
> me a check for participating).

OK.  They get your name together with the unblinded "coin" to prove your 
participation.

> 3. Allow a supervisory agency, such as the U.S. Department of Health and
> Human Services, to verify that the researchers did not just make up all the
> data - that is to allow an audit.

Same as above.

> 4. Protect my privacy by making it impossible to correlate my name to the
> answers given.

OK due to properties in the anonymous cash schemes.

The problem with this seemingly simple approach is that it requires an 
anonymous online connection between you and the survey organizer.  
Confidential and/or anonymous channels does not seem to be "in" among 
network providers today... :-(


-- Rolf


----------------------------------------------------------------------
Rolf Michelsen                           "Nostalgia isn't what it
Email: rolf.michelsen@delab.sintef.no     used to be..."
Phone: +47 73 59 87 33                   
----------------------------------------------------------------------

Lucky Green:

| My partner is a participant in a long term psychological study. I have been
| asked to fill out a questionnaire to aid in this study. Some of the
| questions address issues that I would never answer non-anonymously. After
| speaking with the research director, I ended up with the following problem:
| is there a way that would allow the institute to
| 
| 1. Correlate my answers to the answers of my partner.
| 2. Verify that I have indeed sent in a filled out questionnaire (and send
| me a check for participating).
| 3. Allow a supervisory agency, such as the U.S. Department of Health and
| Human Services, to verify that the researchers did not just make up all the
| data - that is to allow an audit.
| 4. Protect my privacy by making it impossible to correlate my name to the
| answers given.
| 
| I would very much like to help to advance medical knowledge, but am
| concerned what might happen once the institute is forced to hand over all
| accumulated data to the Kommunal Kare Kontrol Kommittee under the Health
| Care and Crime Prevention Act of 1998.

	Correlation is easy; assign people consecutive numbers or
somesuch.  If both participants are anonymous, no problem.  Could you
bring by the questionnaire by hand, in exchange for cash?  If not, how
about a money order and a PO box?

	The audit part of this is the tough part.  Would the HHS care
to agree to a broadcast means of verification?  Would participants 44,
71 and 94 please come into the re-testing center to verify their
participation?  There could be a zero knowledge proof of some type to
demonstrate that you are really patient 94.

	I doubt that the HHS would be agreeable to that.  Might want
to phone your local ACT-UP chapter, if you have one.  AIDS activists
tend to be privacy nuts, and they may have protocols for anonymous
testing/surveys.


Adam