The Crime Lab partners with dozens of government agencies and NGOs to analyze the data they gather as part of their routine operations and to collect new data. Much of the data Crime Lab receives includes confidential or sensitive information and so is subject to strict laws protecting people’s privacy, such as arrest records from police departments. The Crime Lab is required to protect each dataset according to the specific rules outlined in the data use agreement between that specific agency and the University of Chicago’s central research office.

We primarily use data to evaluate the impact of programs and interventions. These research projects are designed by leading academic experts to create generalizable knowledge about which interventions work and why. We also provide technical assistance to select partners in order to assist with the data mechanics of program implementation and to provide quick-turnaround descriptive insights into whom a program is serving.

The Crime Lab independently advises partners and evaluates relevant programs and policies to ensure that resources can be directed to where they will do the most good. We provide information that helps our partners make data-driven strategic decisions, but we do not make any operational decisions ourselves. We generate the insights; our partners apply them. Rather than charge our government or NGO partners for our work, the Crime Lab’s operations are supported by external grants and philanthropic gifts that ensure our partners can dedicate their resources to serving their communities.

Under extenuating circumstances, when an urgent crisis made it impossible to raise philanthropic and government funding fast enough to address immediate needs, the Crime Lab utilized small direct grants from government partners to jump-start projects and get them off the ground until external funding sources could be secured. The first of these helped to address a massive 60% surge in murders in Chicago in 2016 through the Strategic Decision Support Centers, and the second, prompted by the urgent goal to close Riker’s Island and reduce unnecessary pre-trial incarceration, funded initial efforts to update and revise New York City’s pre-trial release assessment tool.

The Crime Lab’s data use agreements with partners ensure that we retain the right to publish the anonymized, aggregated output of all research projects (see below for additional details about how a data use agreement works). We are dedicated to honest reporting of our research, no matter the results, because developing effective solutions requires a clear-eyed understanding of the nature and scope of our country’s challenges.

In addition to our research projects, we also partner with the public sector and NGOs to produce data analysis that informs day-to-day operational activities, such as helping our partners identify and prioritize at-risk populations, and that enables the rigorous research we perform. This data analysis is crucial to our partners’ operations, but it cannot be shared publicly because it often involves sensitive, confidential information about the people our partners serve. For example: Partners often need information about the people they serve who meet specific criteria—such as everyone eligible for their program in a specific neighborhood—but, depending on the size of the program, this may end up being a small group. One common provision of a data use agreement is that researchers cannot publish data based on groups of fewer than 10 people, due to concerns that data about such a small group might be traced back to the individuals involved. Whenever possible, however, we make the results of data analysis publicly available through reports, white papers, and two-pagers.

Anytime a researcher is embarking on a research project using data they have not gathered themselves, a data use agreement (DUA) is standard best practice to ensure both the data and the researcher’s independence are protected. As part of the University of Chicago, all data use agreements and other contracts are reviewed and executed through the University’s standard centralized University Research Administration process. That is, DUAs are not between the government agency and the Crime Lab specifically, but rather the University of Chicago itself. The terms in these agreements reflect national research standards and University requirements.

Every data use agreement includes:

1. Project scope: These are details about what data is being shared and how the Crime Lab will use the data in our analysis
2. Data ownership: The data partner always owns their original data, but once all parties agree to embark on a research project, the Crime Lab retains ownership of all the products of our research.
3. Privacy protections: The agreement notes which laws and policies apply to the particular type of data being shared. The agreement also stipulates that the Crime Lab may not share confidential data with any third party (unless specifically authorized in the agreement) and may not publish potentially identifiable information.
4. Publication rights: We reserve the right to publish any and all research analysis, but in accordance with data privacy protections, we only share non-identifiable aggregated outputs.

As is standard practice, partners providing the data have the ability to preview outputs before publication expressly for the narrow purpose of ensuring no individually identifiable information is disclosed and that no objectively incorrect factual statements are being made. Outside of this narrow review scope, and in line with standard University of Chicago DUAs, the partner is prohibited from editing or preventing the public release of research findings, including for reasons related to the specific substance of the findings.

The sensitive nature of much of the data with which the Crime Lab works necessitates the highest standard of data privacy protections. With support and oversight from the University of Chicago Information Technology Services Department, the Crime Lab maintains an industry-leading secure data environment accessible only to the Crime Lab staff.

We meet Federal Information Security Act (FISMA) standards, as defined by the National Institute of Standards and Technology SP 800-171. In alignment with the Federal Department of Defense guidance, the Crime Lab (scored 110 out of 110 possible points under DFARS 252.204-70121, 252.204-70192, and 252.204-70203. Our platforms and procedures are also compliant with the Health Insurance Portability and Accountability Act (HIPAA) standards for securing Protected Health Information, the Family Educational Rights and Privacy Act (FERPA) requirements for accessing educational records, and the Criminal Justice Information Standards (CJIS) Security Policy for protecting Criminal History Record Information.

The Crime Lab has several full-time staff members who work on data security and maintaining data systems. Designated data stewards are responsible for approving the data accessible to each staff member under the “minimum necessary” rule, which stipulates that each staff person can only access the data necessary to perform their jobs. We also have on staff a local Privacy Officer who liaises with the University of Chicago Chief Privacy Officer and other experts as well as a Data Compliance Manager dedicated to overseeing annual audits and staff trainings.