What Should Researchers Do When They Discover Possible Illegal Activity?

A Participant Tells You About Possible Illegal Activity. Do You Have to Report It?

Research routinely examines behavior that may itself be illegal or legally sensitive: illicit drug use, unauthorized migration, sex work where prohibited, cybercrime, unlicensed activity, violence, theft, or other conduct participants may be reluctant to disclose anywhere else.

Sometimes the illegality is central to the study. Sometimes it appears unexpectedly during an interview or in a dataset. Either way, researchers may suddenly wonder whether possessing the information makes them responsible for reporting it.

The answer is not simply “yes because it may be a crime” or “no because research is confidential.” Confidentiality is a substantial research obligation, and some legal protections are specifically designed to prevent sensitive research information from being used against participants. At the same time, particular laws can require disclosure in defined circumstances.

Possible Illegality Does Not Automatically Create a Duty to Report

Research Confidentiality Would Mean Little if Every Admission of Illegality Were Automatically Reported

Research can legitimately study illegal behavior

The fact that a study collects information about illegal conduct does not make the research improper. Many important public-health, behavioral, criminological, sociological, and policy questions require researchers to understand activities participants may not disclose if participation exposes them to prosecution or other legal consequences.

Confidentiality can therefore be integral to both participant protection and scientific validity. Participants who believe researchers function as extensions of law enforcement may reasonably withhold precisely the information the study is trying to understand.

U.S. research policy provides a particularly clear illustration. Certificates of Confidentiality were historically developed to protect participants in sensitive research, including research involving illegal drug use, and modern Certificates provide substantial protection for identifiable sensitive research information.

“Illegal” and “reportable” are not synonyms

A participant may describe conduct prohibited by law without any law requiring the researcher to report that conduct. Mandatory reporting obligations usually arise from specific statutes, regulations, professional duties, or other defined legal rules rather than from a general principle that researchers must report all suspected crimes.

The first category is much broader than the second. Researchers should therefore identify the actual legal basis for disclosure rather than reasoning from the seriousness or illegality of the conduct alone.

Past illegal activity can present a different problem from an ongoing safety threat

A participant admitting that they previously used an illegal drug is ethically different from a participant describing conduct suggesting an immediate serious threat to another person. The latter may activate a separate safety framework even if the conduct is also criminal.

Calling all of these “illegal activity” conceals the ethical distinctions that actually determine the response.

Certificates of Confidentiality can provide strong protection in U.S. research

Current NIH policy automatically provides Certificates of Confidentiality to qualifying NIH-funded research collecting or using identifiable sensitive information. A Certificate generally prohibits disclosure of covered identifiable sensitive research information to people outside the research except in specified circumstances. It also protects covered information against disclosure in civil, criminal, administrative, legislative, and other proceedings as specified by federal law.

These protections matter directly to research concerning illegal behavior. A subpoena or request from an investigator does not automatically mean that protected research information should be handed over. Institutions holding Certificates are expected to uphold and defend their protections.

A Certificate is not a magical “never disclose” document

Current NIH rules identify limited circumstances in which protected information may be disclosed. These include disclosure required by federal, state, or local law, disclosure made with the participant's consent, certain disclosures necessary for medical treatment with consent, and qualifying scientific research uses.

Importantly, a legal requirement to report particular information, such as certain public-health or abuse reports, is different from a demand to provide research information for use in a criminal or other legal proceeding. The modern Certificate framework treats these categories differently. Researchers should obtain institutional legal guidance rather than attempting to interpret the statute themselves.

Do not investigate whether a crime actually occurred

A participant's statement may be incomplete, ambiguous, exaggerated, mistaken, or legally mischaracterized. Researchers are usually neither required nor qualified to conduct an investigation to determine criminal liability.

Unless investigation is itself an approved research activity, the researcher's task is to collect the data required by the protocol, recognize any predefined safety or reporting trigger, and preserve confidentiality according to the governing framework.

Turning a research interview into an interrogation can increase participant risk, compromise the research relationship, create unnecessary identifiable information, and move the researcher beyond the approved study.

Do not collect identifying information you do not need

One of the strongest ways to protect legally sensitive information is to minimize unnecessary identifiability from the beginning.

Researchers should ask whether names, precise addresses, exact dates, identifiable third parties, or other direct identifiers are scientifically necessary. Data minimization cannot eliminate every legal or confidentiality issue, but it can reduce the consequences of a breach or demand for records.

NIH's current privacy best practices emphasize that researchers and institutions should understand the laws and policies governing their data and the protections associated with Certificates of Confidentiality.

The consent process should describe real confidentiality protections and real limits

Participants in sensitive research need an accurate account of what will happen to their information. Researchers should not imply that everything disclosed is automatically reported, but they should also avoid promising secrecy beyond what the law and protocol can provide.

If particular disclosures may trigger child-protection reporting, public-health reporting, or a defined safety response, those limits should be explained where reasonably foreseeable. NIH likewise requires investigators and institutions with Certificates to inform participants about Certificate protections.

Illegal activity involving immediate danger becomes a safety question too

Suppose a participant does not merely describe unlawful conduct but communicates a credible intention to seriously harm another person. The researcher now faces more than a confidentiality question.

The relevant pathway becomes the one for a participant who may pose a serious risk to someone else. Likewise, possible abuse may trigger the specialized safeguarding analysis described for participant disclosures of possible abuse.

The possible criminal character of the conduct does not replace those analyses. It is usually the independent safety or reporting obligation that matters.

Researchers should distinguish law enforcement from research oversight

A discovery may need to be reported internally to a principal investigator, safeguarding lead, ethics committee or IRB, institutional official, sponsor, or another research oversight body without being reported to police.

Internal escalation can be necessary to determine whether the protocol was followed, whether participant risk has changed, or whether a legal duty exists. Researchers should not treat every internal report as equivalent to external disclosure of participant identity.

Breaches of confidentiality can themselves become reportable research problems

OHRP gives the example of identifiable information about illicit drug use and other illegal behavior being stored unencrypted on a laptop that is then stolen. OHRP treats the breach as an unanticipated problem because it increases participants' risk of psychological and social harm.

This reverses the usual intuition nicely: in sensitive research, the ethically reportable event may be the researcher's failure to protect information about illegal behavior, not the participant's illegal behavior itself.

A Participant Admits to Illegal Drug Use During an Interview

The researcher can study illegal behavior without becoming responsible for enforcing the law against the participant. That separation is often essential to ethical and scientifically useful sensitive research.

Common Mistakes When Research Reveals Possible Illegal Activity

Protect Sensitive Information Unless a Defined Obligation Changes the Rule

If your study is likely to collect information about illegal or legally sensitive conduct, confidentiality should be engineered into the research design rather than left to researcher discretion during interviews.

The relevant question is not “Did someone admit something illegal?” It is “What confidentiality protections and specific disclosure obligations govern this information?”

Before Collecting Information About Illegal Activity

Questions About Illegal Activity Discovered During Research

Researchers Study Illegal Behavior; They Are Not Automatically Required to Police It

How to Cite This Guide

This guide is intended to be read, shared, and used in research, teaching, and academic work. If you draw on its ideas, explanations, or other content, please acknowledge the source by citing the guide. Doing so gives appropriate credit and helps your readers locate the original resource.