WO2006024813A1

WO2006024813A1 - Recording and monitoring of telephone calls

Info

Publication number: WO2006024813A1
Application number: PCT/GB2005/002965
Authority: WO
Inventors: David Dalby; John David Bassett
Original assignee: British Telecommunications Public Limited Company
Priority date: 2004-08-31
Filing date: 2005-07-28
Publication date: 2006-03-09
Also published as: GB0419302D0

Abstract

A communications system for controlling access to the PSTN from specific facilities includes a control centre (2) and a number of facility domains (3) each responsive to the control centre for connecting calls from telephones (6-9) via the PSTN. Attempted calls from the facility require the caller to enter a PIN and a telephone number to which connection is desired. The permissibility of the call is determined at the control centre along with the call cost and available credit for making the call. The Control centre (2) returns signals to the facility CPU (17) to allow or deny the call attempt and to indicate monitoring and/or recording permits for the call being made.

Description

RECORDING AND MONITORING OF TELEPHONE CALLS

The present invention relates to communications systems and more particularly to communications systems for use in controlling use of the PSTN by identification of the caller.

Protection of the public from malicious calls for example is a prime concern of prison authorities. At the same time, the freedom of incarcerated individuals to have telephonic communication with friends, relatives and professional support is a privilege or, in some circumstances, a right under law. Arranging appropriate access to telephony could be a time consuming matter for prison staff, determining when and where such calls could be made and ensuring that the appropriate costs are recovered for the use of the PSTN. Determining also which calls may be monitored and which are legally privileged is also a requirement in many cases. Arranging for the recording of conversations may also require manual intervention and maintaining records in respect of recordings made could also be a complex task particularly with regard to accessing recordings subsequently if it became necessary.

US Patent No.s 6052454 and 6072860 disclose one system which includes a network central office (switch) to which an operator sends access control data. When a call is attempted from the prison based phone system the customer pin (prisoner id) originating telephone number and dialled destination number are transmitted to the network switch which determines the validity of the call attempt and returns an invalid or valid signal to the prison system which then releases or proceeds with the call. The system makes an analogue recording of the call in progress (provided that a valid signal is received) and on completion of the call sends call data back to the central office switch. The recording system checks the conditions under which calls are recorded and on call completion dumps the recorded conversations and identification details to a mass storage system.

US Patent No. 5535261 discloses a conversation recording system in which an administrator specifies recording triggers. The system includes call digitisation and digital recording of specified conversations with associated control data allowing subsequent retrieval of the recording(s) to be played back.

US Patent No. 5655013 discloses a system for call control in which call attempts are scrutinised and lines are monitored for events indicative of either the approved destination recipient or a recipient to which a call is diverted being able to block future call attempts from the same caller by keying a specified code. US Patent No 5926533 is a further telephone system monitoring device which checks for line signalling activity indicative of an approved call recipient attempting to transfer the call to a third party.

According to the present invention there is provided a communications system for controlling access to the PSTN from at least one facility, the system comprising a central control centre and at least one respective facility control centre, the or each facility control centre comprising switching means arranged to effect connections between telephones at the facility and the PSTN and messaging means for exchanging messages with the central control centre, the central control centre including a processor and a data store and respective messaging means, the data store storing data in respect of each of a plurality of users of telephones at the facility, said data being associated with each user by a respective personal identifier, said data including for each user respective parameters identifying respective permissions allocated to each user, processing means of the or each facility control centre transmitting a respective message to the central control centre for each call or attempted call from the facility said message identifying at least a plurality of said parameters, said processor at the central control centre determining from said plurality of parameters allowability of the respective call and, if the call is determined as allowable, the legality of recording conversation taking place during a connection, for each allowable call, providing a message to the facility control centre in respect of said call to cause the processing means of the facility control centre to connect the call to the PSTN and, if permissible, to cause connection of digitised conversation data to a mass storage device.

A communications system in accordance with the invention will now be described by way of example only with reference to the accompanying drawings of which: Figure 1 is a block schematic diagram of the system; and

Figures 2 to 10 are flow charts showing the operation of the control system and signalling between the various domains of the system of Figure 1.

Referring to Figure 1 , the communication system, for providing security of communications originating in a facility such as a prison essentially comprises two domains linked by the Public Switched Telephone Network (PSTN) 1. The other domains are a control centre domain 2 and a facility domain 3, each of these domains being shown in Figure 1 separated by dashed lines. The control centre 2 will provide intelligence and data storage to the facility domain 3 of which there may be many each serving a respective facility or prison. For security the control centre may be duplicated at separate locations to provide continuity of service in the event of a breakdown of communications between one of the control centres and the facility or a suspension of service at one of the control centres.

The PSTN 1 is primarily used only as a normal communications network providing no additional facilities other then those normally provided by a licensed network operator. The present system therefore is connected to the normal switching system of the PSTN 1 using an ISDN link having multiple channels shown here as an ISDN30 4 to permit communication with customers connected to the network in the normal telephony mode using, for example, telephones 5. For the purposes of description hereinafter it will be assumed that the reader is familiar with the operation of the PSTN and the functionality of an ISDN link within the PSTN such that further description of either of these items is not required.

In the facility domain 3 the apparatus shown includes a number of telephone instruments 6 to 9 each comprising a housing 10 having a video output screen 11 , keypad 12 and handset 13. Each of these analogue instruments is linked by respective communications wire 14 to an analogue line card of .known type symbolically illustrated as line 15. Note that the dotted lines indicate an expansion potential for up to say 24 telephone instruments and respective line cards in a single facility domain 3. For completeness it should be mentioned that more than 24 telephones may be available in a single facility either through a single enlarged facility control unit 16 or by duplicating the systems shown.

The facility control unit includes a central processor unit (CPU) 17, analogue line cards 15 and digital line cards 18 which interface with the ISDN30 communications link to the PSTN. An analogue to digital converter 19 is provided between the analogue side of the control centre 16 and the digital side thereof to provide conversion between the analogue side of the system 15 and the digital interface 16 with the ISDN30 4 to the PSTN 1.

A local area network (LAN) 20 is also provided which links together the control unit and terminals at the facility. Some of the terminals connected to the LAN 20 shown as terminal 21 are provided for administrative purposes as hereinafter described, while terminals 22 provide a monitoring facility under the control of the CPU 17 as determined by the control centre 2.

Finally in the facility domain 3 a mass digital storage device 23 is provided for holding digitised recordings of conversations which have occurred again subject to control signalling from the control centre 2. The control centre 2 includes a processor 24 having data stores 25, 26 respectively storing data related to personal identification numbers (PINs) allocated to individual prisoners and calls made. Associated data for each of the PINs includes the prisoner identity, permitted numbers for dialling and whether those numbers are related to legal or privileged calls and other data such as permitted locations that is those telephones 6, 7, 8, 9 which particular prisoners are allowed to use and permitted times at which calls can be made. Also stored associated with the PIN is a credit record determining whether the user of one of the telephones has sufficient credit to enable a call to be made. The second data store maintains a record of calls made including for each call the PIN or prisoner ID, calls made, duration of such calls, the origin and destination of the calls and an allocated recording file number relating to the location of the call conversation recording held in the mass storage 23 at the facility.

Finally, shown in Figure 1 in outline only, is a mass storage device 27 connected by way of the PSTN and ISDN30 which may used as an alternative to the facility storage 23 in circumstances hereinafter described in an alternative method of operation. Also shown is a connection from the CPU 17 at the facility and the processor 24 of the control centre by way of the Internet or worldwide web 28. This again relates to an alternative mode of operation of the system comprising the facility domain and the control centre domain in alternative implementations hereinafter described.

The operation of control within the CPU 17 at the facility centre will now be discussed with reference to Figures 2 and 3 in particular, but still referring to Figure 1

Thus consider a program instance running to monitor the lines 14 to which telephones 6 to 9 are connected on the analogue side of the system, when one of the handsets 13 is lifted the CPU 17 sets up an internal call Record and at step 205 identifies the line on which connection has occurred. The line identity or CLI is stored in the particular call record at step 210 and a voice announcement is made to the user of the form of "enter your personal identification number or PIN". A timer may be started at this point monitoring for signals from the keypad 12 indicative of the PIN of the caller such that if the PIN or a valid PIN is not entered within a particular period the call may be stopped with output of appropriate voice messages to indicate that the PIN has not been entered. A further opportunity/opportunities to enter the PIN may be given.

At step 220 when the PIN has been entered on the keypad 12 it is captured and stored with the call record. Once the PIN has been successfully entered the system may invite the caller to enter a required telephone number at 225 again with appropriate time out and retrial opportunities (steps not shown).

When the number has been received at 230, this too is stored in the call record set up at step 205. The CPU will now send a message to the control centre 2 using a channel of the

ISDN30 to communicate with the control centre 2. The message essentially comprises the CLI₁ PIN and the number dialled which will be analysed in the control centre as hereinafter described with reference to Figures 4 to 6.

As an alternative to sending a message by way of the ISDN30 4 it is possible to use other connectionless signalling methods such as the worldwide web 28 for transmitting the request message from the facility control 16 to the control centre 2. The CPU 17 now awaits a response either by way of the worldwide web 28 or the ISDN30 4, as indicated at 240. The received message will contain various indications based on the analysis of the CLI, the PIN and the number dialled. Depending upon the validity of the call attempt the valid indicator flag will be set at the start of the message which in turn will determine the information contained in the following message returned. If the call is not permitted for any reason then, for example, a reason code may be included in the returned message for example prohibited location derived from the CLI would indicate that the attempted use is not permitted from the location at which the call is being attempted. This may also be a time dependent factor or all calls may be barred to the particular user at the time the call is being carried out. A third reason could be that that the destination is barred, alternatively the destination is invalid or financially a pre-pay PIN customer may have insufficient credit or if the PIN indicates that the caller is permitted to make reverse charge or collect calls the dialled number has been identified as one which is not able to accept collect calls. The analysis of the CLI, PIN and dialled number to determine the validity of the call and various specifics relating to things such as privilege and recording of calls is described hereinafter as a function of the control centre.

Returning to Figure 3, while still referring to Figure 1 , at 305 the message will be received from the control centre 2 and the first interrogation is in respect of the validity of the call as indicated at 310. If the call is not permitted then at 315 the voice announcement is passed to the telephone unit which may of the form your call is not permitted because of the following problem, which being followed a voice announcement of the reason as indicated by the validity indicator following an invalid indication.

Included in the message received at 305 will be an indication of whether this is a credit call or a collect call and if it is a credit call the balance of the account associated with the PIN will also be transmitted together with the operating tariff for the particular time of day/day of week and destination of the call.

Thus at 320 the credit information is transferred to the telephone and will be displayed on panel 11. The operational tariff will also be transferred to the telephone and once the call is in progress will be decremented from the credit available against the PIN within the telephone unit. Assuming that the call is valid, then the CPU 17 causes a call set up message to be sent through the ISDN30 4 at step 325, the ISDN30 4 linked to the PSTN operating in normal manner establishing calls such that no modification of the PSTN in terms of the data held or its operation is required. If the message received at 305 also indicates a recording flag permit then a recording file number may well be sent at this stage from the control centre back to the facility. If the recording flag is set then a file number received with the recording flag will be used to set up a file number on the mass digital storage facility 23. The digital output of the A to D converter 19 appropriate to the call will also be set up to the store 23 so that the digital recording of a conversation does not need any further control contribution from the CPU since direct storage of the digital output of the ISDN system is passed through the CPU to the main digital storage facility 23.

A check may now be carried out to see if the privileged information flag is set such that for example at 345 it is determined if this call is not only permitted but also legally privileged. If the call is not legally privileged then at step 350 the call will be placed on the LAN available to one of the monitoring stations 22 and an alert message for display may be sent to that monitor or both monitor units. The system now has to wait at 355 for a call clear which, referring back to Figure 2 either when the phone clears the call due to insufficient funding remaining in the user credit or the user replaces the handset 13. When call clear is detected the balance (displayed on screen 11 ) is recovered from the telephone at step 250, which reduces the call credit available and displayed in accordance with the tariff during the course of the call, and this is now transmitted with the PIN, for example, to indicate the source back to the control centre 2 at step 255. In the control centre the call record of the call balance will be used to store complete details of the call for subsequent recovery if required. An acknowledgement message may be returned at 260 with the actual file number to be allocated to the recording in the mass store 23.

As an alternative to having a facility based mass store 23 it will be possible to have a mass store 27 separately accessed by the PSTN. If a mass store 27 is in use then at the time of connecting the call, provided that the call is not privileged and recording is authorised, a conference connection via the ISDN30 could be set to the mass storage system 27 rather than the digital output being transferred to the store 23. In either case the future access to stored recorded conversations will be limited to individuals who are identifiable by the central control centre on request for a recorded output. Having received the call, file number and an acknowledgement of the satisfactory transfer of the call record and credit balance at step 255, the instance of program closes or returns to monitoring for a further handset operation.

It is here noted that the handset monitoring may be carried out in isolation with an • instance of call set up being spawned each time a handset is raised. While not specifically mentioned other features are readily built into the system, for example causing alarms at the monitoring stations 22 if multiple attempts are made from a handset without entering a valid PIN over a predetermined period or if a consecutive series of invalid call attempts are made.

Referring now to Figures 1 and 4, receipt of a message transmitted at 235 of Figure 2 from the facility control to the control centre 2 spawns a validity check instance 400. The processor 24 having received the message comprising the CLI, PIN and dialled number at step 405 recovers details of the user record associated with the PIN from the store 25 as indicated at step 410. As a first action the current time is compared with a permitted times record in respect of the identified user at 415 and a determination based on the time of day and, possibly, day of week information is made as to whether the call is allowed or not. If the call is not permitted then at step 425 a reason field in respect of the current validity check is set to time or to a code indicating that the call is not permitted due to it being outside permitted times of operation regardless of the other factors involved.

Although we are showing here a limited time consideration it is possible to allocate permitted times to permitted locations on a narrower basis so that rather than a blanket block on permitted times, permitted time may be dependent upon the location of the user that is to say the CLI and the number dialled. Thus throughout the description that follows whilst specific entities and fields are mentioned with regard to the determination of the validity of a call it will be appreciated that significant flexibility can be provided by the system based on varying combinations derivable from the CLI₁ the PIN and the dialled number.

Assuming however that in the current case the current time is within the permitted time periods then a check is made on the CLI 425 to determine the location of the telephone 6, 7, 8, 9 from which the call has originated and this is compared at step 430 with permitted locations in the user associated information. If a permitted location is not being used, then at 435 a reason code of location is set.

At step 440 a check is carried out on the dialled number and in particular initially on a stored list of numbers to which no calls from the facility are permitted. These numbers can be, for example, emergency service numbers which users are not permitted to connect to directly so that at step 445 if any such number previously identified and added to the barred numbers list is dialled the system ceases to carry out further checks determining that the call attempt is invalid. This will result in a reason of barred number being set at 500 of Figure 5 which continues on from the present Figure 4. Assuming that the dialled number is not in a list of barred numbers then a check may be made to determine whether the user has only limited permissions at 450. If permissions are not limited for a particular user, that is the user is permitted to call any number other than specified barred numbers in the overall facility list, the system can skip straight to a credit check at 505 of Figure 5. If permissions are limited as will generally be the case then a further check is carried out to determine whether the dialled number is within the permitted numbers for the specified user at 455 and again if this is not the case reason is set to barred number at step 500, otherwise the system goes on to carry out the necessary credit check at 505.

Thus, turning to Figure 5, at step 505 a check may be carried to determine whether the particular user has a credit account or whether calls to be made are on collect numbers only. If the user is permitted to call collect to other numbers then at 510 a check is determined on a database either specifically created for the purpose or from a publicly

^' available database indicating whether a dialled number is billable or not. If the number is not billable once again at step 515 a reason code of call collect unavailable is set in the system and then in common with all invalid call attempts for whatever reason an invalid flag is set in the message for return at 520 together with the reason code in respect of the call attempt.

Returning briefly to step 510, if the number is billable then at 525 a billing identity is created and a collect flag is set. For credit users as indicated at step 505, the tariff based on the current time and the dialled number is determined at 530 and at 535 the credit available in the user's account is determined. A comparison is made between the tariff and the credit available to determine whether there is sufficient credit for an effective call and if not at 545 the reason is set to no credit and the program instance returns to step 520 where a message invalid flag is set as before. Assuming that sufficient credit is present at 540 then the call attempt can be determined as valid in respect of the identified user and a check is carried out to determine whether the call can be recorded or not. Thus at 550 a check of permitted numbers against legal status is carried out and if the legal flag is not set against a specific permitted number a further check is carried out to determine whether the call is likely to be privileged according to an alternative flag set.

Again while only two flags are shown as settable against permitted numbers other categories of permitted number where recording may or may not be carried out can be added to the system. If the dialled number is determined as being either a legal or a privileged number at steps 550 and 555, then at step 560 the creation of a message for return to the facility is started by setting the message to valid and a record flag to negative. In the alternative if neither of the above conditions prevail, then at step 565 a message flag of valid with a positive indication of recording flag and a recording identity added into the message for transmission.

Turning now to Figure 6, at step 605 the collect flag is checked to determine whether this is a collect or credit call. The message will be dealt with accordingly for a collect call at 610 by setting a collect call flag in the message or at step 615 by adding the credit available and tariff to the message. The message having been created added to and completed in all cases whether the call is valid or invalid at step 620 the call attempt details are stored against the PIN records so that the CLI, PIN, dialled number and recording identity, if any, are stored against the user identity in the call record store 26. The completed message is now transmitted back via the ISDN30 4 or the worldwide web 28 as appropriate to the facility to be received at step 305 of Figure 3. At step 630 the instance of validity check will now wait for a call clear indication from the facility, this call clear indication being either as a result of the call being barred and serving as an acknowledgement of the message transmitted or being received at step 635 on the clearing of the call when the call record credit balance is transferred back to the control centre 2. On receiving a call clear or acknowledgement message at step 635, at step 640 the call detail in the store 26 is now updated with the length of call and the call cost is calculated. Once again using the collect flag at 645 either a billing record is created at 650 for a collect call to be handled in the normal way between the centre operator and the licensed operator of the PSTN or at 655 the credit level in the store 25 in respect of the particular user is adjusted and stored back. Finally at step 660 the processor 24 causes a transmission of an acknowledge message and a recording file number to be associated with the call recording, if any. The instance of validity checks spawned can now be closed. Having considered the validity checks on call attempts from the facility some of the basic administrative functions of the system will now be considered referring to Figures 1 and 7 initially where the administration functions of the facility operating with the facility management terminals 21 communicating via way of the LAN 20 to the CPU 17 will be considered.

Although the description hereinafter is in relation to administration occurring at the facility it will be appreciated that such administration could be carried out at a place other than the facility to create various controls and credits for an individual user of the system and so that transfer of a prisoner, for example, between facilities will enable the current PIN and prisoner identity to be maintained to provide the same customer facilities with minimal input of additional information in respect of that prisoner. In order to set up a new account effectively a screen display at the terminal 21 will be used so that the operator can enter details of the identity to be associated with a new account. Thus, within the CPU 17 at 700 the identity entered is captured at 705 and is then transmitted by way either of the ISDN30 4 or the worldwide web 28 to the control centre processor 24 at step 710. Administrative facility now awaits for a PIN to be created as hereinafter described and returned to the facility.

In an alternative, if a user forgets the allocated PIN it may be possible for an administrator to enter simply the ID which would be transmitted to the administrative centre to recover the PIN associated with the particular user. (Process not shown.) Having obtained the PIN either the PIN or a user ID can be used to carry out interactive administrative tasks between the terminals 21 , the CPU 17 and the processor 24 of the control centre 2. Thus two further administrative strings are shown relating either to the user IDs credit arrangements or to parameters associated with the user ID. Thus at 725 if either a check on the value available to the user is required or value is to be added to the user's account the operator will enter identification in the form of the PIN or the user ID and will select whether this is a credit query or a credit top up at step 730. Assuming for now that the user wishes to top up the value associated with credit then at 735 an amount paid or to be credited is entered and the CPU 17 causes a message comprising the identity and the value to be transmitted to the control centre 2 at step 740. If at step 730 it is merely a query of the credit available then the CPU 17 causes a query message comprising the identity to be transmitted at step 745. In either instance the response from the control centre will be the credit value now available, this is received at step 750 for display on the user interface of one of the terminals 21.

In respect of other parameters such as authorised times, locations and permitted numbers, an operator of one of the screens 21 is again prompted to enter an identity in the form of a PIN or user ID at 755. The details associated may be recovered from the control centre and displayed in list form or as a table for the operator to amend in a user friendly screen format. For the purposes of description the first step to be carried out at the entry of the parameter 760 is a determination as to whether the entry is a number or another function such a time or permitted locations. If the parameter is a number then the operator may be prompted to enter details of whether this is a legal or privileged number at 770 and 775 with appropriate flags being set in the transmission message by the processor 24 in respect of legal and privileged information at steps 780 and 785 respectively. The CPU 17 will now cause either the complete table or the parameters and user ID to be transmitted to the control centre at step 790 and will in return receive the parameter table at 795 for display either for further correction or updating to be carried out or for termination of the administrative function in respect of the current entry.

Turning now to Figure 8 while still referring to Figure 1 , the response of the control centre processor 24 to the various requests can be considered. Thus if the request is for a new entry to be made at step 805 the received message will be processed and an appropriate PIN will be created and added to store 25. Having created the PIN at step 810 a record is created with default entries and the PIN and default table is transmitted back to the facility at step 820 again using either the ISDN30 4 or the worldwide web 28 as appropriate. Finally at this stage the PIN record for calls in store 26 is created to enable calls and call attempts to be recorded once the allocated user is allowed to use the facility telephones. A PIN to ID link is created and stored at step 880 in case it is necessary to provide the PIN owner with a reminder of the PIN allocated to the personal identity.

If a credit update is received, as indicated at step 830, then the credit record associated with the PIN or user ID is updated with the amount received at step 835 and the credit record is recovered by the processor 24 at step 840 and transmitted back to the facility as a credit value and acknowledgement at 845. If the received message merely indicates, as shown at 850, that a credit query is being made then the processor 24 simply recovers the credit from the appropriate user identified record at 840 and transmits that value back. Finally, in respect of parameter updates being received at 855 the appropriate parameters are checked for validity at 860 and if they do not appear to be valid with respect to format or type indicated then a query may be returned at 875. Assuming that the received parameters or parameter table contains valid parameters then those parameters are updated in the store 25 at step 865 and an acknowledgement is transmitted at step 870, the acknowledgement being accompanied by a complete parameter record for the particular user identified.

Other administrative functions that require interchange between the control centre and the facility may be readily added as required and parameter tables may be adjusted to take into account other features which may be required of the system.

Considering now a further function of the system which is that which permits a recovery of recorded conversations from the mass store 23 or the mass store 27, access to the play back facility is limited to authorised individuals and may be requested from monitoring station 22. While, in respect of the description, the monitoring stations 22 are shown as being associated with the facility it will be appreciated that secure listening stations could be provided for use by the authorities at other places such as police stations for example, and recovery of recorded conversations may not necessarily be limited to the facility at which the conversation occurred in the first instance. Thus, permitted officers at other facilities served by the control centre could request access to conversations in respect of a particular user ID. In the simplest case an authorised user at the facility 3 where the recording was originally made may use the monitoring station 22 to enter details of the user identity or PIN ID together with a self identification, which again may be made by a screen based form details of which are handled by the CPU17 to create a message to the control centre 2 indicative of a request for recording as indicated at 905. In response to the request the control centre will transmit back an acknowledgement and list of conversations associated with the particular user ID or will indicate that the requester is not authorised by returning an invalid message. This ensures that only authorised individuals are allowed to request recordings to be listened to. Assuming that the request is valid a list of conversations that have taken place and which are available to the requester is returned for display at the monitoring station 22 as indicated at 915 to enable the user to select from the list a recording to be played back. Although, for the purposes of description, it has been indicated that a listing of all calls available can be made available, at the time of entering a request to listen to a recording other parameters may be entered such as specific dates or telephone numbers either as single dates or as a range to enable selection to be narrowed down.

Once a user has given an indication using monitoring station 22 of the selection from the list the CPU 17 causes a message to be sent to the control centre 2 indicating the selection in response to which the location or file number of the recorded conversation will be returned to the CPU 17 allowing the connection of the appropriate file to the LAN from the mass store 23. Although as indicate at 930 the appropriate file is transferred from the mass store 23 to the LAN 20 for monitoring on the station 22. It will be appreciated that file stored in a different site can be recovered to the monitoring site by use of the ISDN30 4 transferring the digital data from either store 23 to another facility or for calls recorded in digital form to be transferred by way of the ISDN30 4 to the facility from the mass store 27 or stores 23 at other facilities.

Thus in the control centre processor 24 in Figure 10, to which reference is now also made, on receipt of a request for a recording as indicated at 1005 with the user identity and the requester identity and such other parameters as may be selected by the user of the monitor 22 at the facility 3, the first check is on the availability of recordings to the particular requester as indicated at step 1010. Various levels of authority to listen to particular calls can be set in dependence upon the requester's identity so that security of recorded conversation and secrecy appropriate to the nature of the conversations can be maintained. If the requester is not authorised to access particular files this will be determined and an invalid indication or error indication will be returned to the facility 2 in an appropriate message at step 1015. The authorisation check may be carried out after searching of records whereby the status of recorded conversations can be determined and compared with the requester's authorisation level.

Having determined that the request is prima facie valid the records associated with the particular user ID are recovered from the store 26, step 1020, and selected in accordance with the parameters provided, the lists then being transmitted to the facility 2 at step 1025. The processor 24 at the control centre 2 now awaits a selection of an individual recording from a list to be provided and when the selection is received at step 1030 the file location is recovered from store 26 at step 1035 and transmitted to the facility CPU 17 at step 1040.

Finally, access details are recorded against the PIN and conversation record whether or not the access attempt was valid or not. It will be appreciated that the present system provides significant flexibility in managing and maintaining control of conversations from facilities and in managing and maintain access to recordings of conversations as well as selection of conversations which can or cannot be recorded as appropriate. In particular the system allows for a significant number of facilities to be handled by a single control centre and for the entire system to be set up without the need for any modification of the PSTN or any component parts thereof.

Claims

1. A communications system for controlling access to the PSTN from at least one facility, the system comprising a central control centre and at least one respective facility control centre, the or each facility control centre comprising switching means arranged to effect connections between telephones at the facility and the PSTN and messaging means for exchanging messages with the central control centre, the central control centre including a processor and a data store and respective messaging means, the data store storing data in respect of each of a plurality of users of telephones at the facility, said data being associated with each user by a respective personal identifier, said data including for each user respective parameters identifying respective permissions allocated to each user, processing means of the or each facility control centre transmitting a respective message to the central control centre for each call or attempted call from the facility said message identifying at least a plurality of said parameters, said processor at the central control centre determining from said plurality of parameters allowability of the respective call and, if the call is determined as allowable, the legality of recording conversation taking place during a connection, for each allowable call, providing a message to the facility control centre in respect of said call to cause the processing means of the facility control centre to connect the call to the PSTN and, if permissible, to cause connection of digitised conversation data to a mass storage device.

2. A communications system as claimed in Claim 1 in which the central control centre also determines the allowability of monitoring of conversation and, if permissible, returns signals to the facility control centre so that on connection of the call through the PSTN the call is also connected to a monitoring station.

3. A communications system as claimed in claim 1 or claim 2 in which the switching means at the facility control centre include analogue to digital conversion for connecting calls through a digital connection of the PSTN, the digital output being delivered to the PSTN being stored directly in the mass storage device.

4. A communications system as claimed in claim 3 in which the mass storage device is present at the or each facility.

5. A Communications system as claimed in claim 1 , claim 2 or claim 3 in which the mass storage device is connected to digitised conversation data by way of a conferencing connection set up in the PSTN.

6. A communications system as claimed in any preceding claim in which each conversation is allocated a file identifier and, on completion of a call the file identifier and location in a mass storage device is notified to the central control centre, the processor of the central control centre causing said file location data and call parameter data to be associated with the respective user identifier and stored in a data store of the central control centre.

7. A communications system as claimed in claim 5 in which access to recordings of conversations held in the mass storage device is controlled by the central control centre.

8. A facility control centre for use with a communications system as claimed in any one of claims 1 to 7, the facility control centre including at least one monitoring station, a switching unit for effecting connections between telephones at the facility and the PSTN, and a processor unit, the processor unit including means to transmit parameters relating to a call to a remote central control centre and to receive from said remote central control centre instructions for handling each attempted call, and, in respect of calls for which recording permissions are granted causing connection of digitised conversation data to a mass storage device and connecting said digitised conversation to a LAN connected to said monitoring station whereby the conversation may be monitored.