Access to secure data during the Covid-19 pandemic: A model for the future?

For the majority of organisations and data centres, the pandemic caused them to close their doors and ask staff to work from home. The Scottish Centre for Administrative Data Research (SCADR) (part of ADR Scotland) Safe Settings facility was no different. In this blog, researchers Ben Matthews and David Henderson, discuss with us what challenges occurred and how remote access changed their normal working arrangements, exploring whether remote access could become the norm in future.

Pre-Covid working environment

The Covid-19 pandemic has had far-reaching consequences for the way lots of people work. Administrative data research is no different. Prior to the national lockdown, researchers in this area could sometimes only access data via monitored computers in secure locations. Other projects could be accessed remotely via secure internet connections, technically Virtual Private Networks (VPNs) using their university network. The national lockdown caused by the pandemic resulted in changes being made to allow those with the correct approvals to access appropriate data for projects remotely. This has now been successfully been done from researcher's homes.

In some ways, remote access has allowed projects to progress faster than they would have otherwise. Ben's work on the National Safe Haven often required running statistical models which took four or more hours to complete. Ben mostly worked in a different part of the city to the campus where the Safe Settings facility was located, and so combining this time-intensive work in the BioQuarter with meetings several miles away was often not possible, delaying progress on analysis.

Fortunately for David, his projects prior to lockdown did not require access to a safe setting, although he needed to access the data from an Edinburgh Napier University computer. In normal circumstances, David would make fortnightly visits to Edinburgh, from his home in the Highlands to allow him to do that. This made it very difficult to juggle all work commitments around the short periods when he had access and analysis was possible. Sadly this sometimes resulted in delays, such as David not always having time fix to make slight changes to his outputs prior to leaving Edinburgh, meaning they would have to wait another fortnight.

Getting remote access

Fortunately, one positive change as a result of the pandemic, is that by gaining remote access as approved researchers, both Ben and David could work more efficiently:

Dr Ben Matthews, Research Fellow in Criminology at the University of Edinburgh, said: "Remote access means that I can fit analytical work in the safe settings seamlessly alongside other work commitments which previously would have slowed projects down." 

Dr David Henderson, Research Fellow at the Edinburgh Napier University, said: "Remote access has allowed me to complete work safely and quickly, as I was no longer restricted to only gaining access every fortnight, when I visited Napier. This has also greatly reduced the frustration I would feel, when I didn't get my scheduled work done within the specific time."

Ironically, in some ways, David felt working remotely from home was a safer way of accessing secure data. VPNs are a secure method of ensuring a direct link between a researcher’s computer and the data in the safe haven (essentially a tunnel between the two that no-one can break into). To access from home there are a minimum of five security steps to negotiate in order to get into the safe haven. These comprise a mix of home, university and safe haven security passwords or two-factor authentication steps. Whilst it won't be true for everyone, he feels fortunate that he could effectively set up a more secure setting at home than at a university location, as he can remove the risk of anyone else seeing his computer screens – something that is always minimized, but never completely eliminated, in a university setting.

Ben, also felt that the IT infrastructure is highly secure and so any risks are at the user-end. However, he was confident that his training ensured that he could work safely with data, before getting access to secure data in any setting. He really enjoyed setting up a secure setting at home, and being recognised as a responsible and trustworthy user.

Making it possible

Ben and David wanted to remind SCADR researchers that remote access would not be possible without the work of eDRIS research coordinators at Public Health Scotland (PHS) to amend data sharing agreements with data controllers. Access from home during the pandemic was granted via approvals from the information governance bodies that issued each project’s initial approval (one of the two Scottish Public Benefit and Privacy Panels). This meant requesting an amendment to the initial approval which would then be granted by the relevant panel. Some projects were granted this very quickly, while others took a little longer to process presumably due to the large volume of requests.

They wish to thank the approval bodies for reacting to the situation and working out solutions that kept the data safe but allowed the research to continue. They would also like to applaud PHS for their efforts in getting get remote access up and running in very difficult circumstances.

The Future?

Overall, they both feel remote access has allowed them to conduct their work during the pandemic even more effectively than they were previously able to.

Importantly, the crucial 'Five Safes' approach to secure data access was maintained with more emphasis on the “safe people” pillar. We believe this is a model that could be used more generally and hope the experience during the pandemic can serve as an example of how this can be done safely, in the future.

This blog was originally published on the Scottish Centre for Administrative Data Research (SCADR) website.