Special 

Mapping Crime: Understanding Hot Spots 

05 

U.S. Department of Justice 

Office of Justice Programs 

AUG. 

National Institute of Justice 

REPORT 

www.ojp.usdoj.gov/nij 
U.S. Department of Justice 

Office of Justice Programs 

810 Seventh Street N.W. 

Washington, DC 20531 

Alberto R. Gonzales 

Attorney General 

Regina B. Schofield 

Assistant Attorney General 

Sarah V. Hart 

Director, National Institute of Justice 

This and other publications and products of the National Institute 

of Justice can be found at: 

National Institute of Justice 

www.ojp.usdoj.gov/nij 

Office of Justice Programs 

Partnerships for Safer Communities 

www.ojp.usdoj.gov 
AUG. 05 

Mapping Crime: 

Understanding Hot Spots 

John E. Eck, Spencer Chainey, James G. Cameron, Michael Leitner, 

and Ronald E. Wilson 

NCJ 209393 
Sarah V. Hart 

Director 

This document is not intended to create, does not create, and may not be relied upon to 

create any rights, substantive or procedural, enforceable by law by any party in any matter 

civil or criminal. 

Findings and conclusions of the research reported here are those of the authors and do 

not necessarily reflect the official position or policies of the U.S. Department of Justice. The 

products, manufacturers, and organizations discussed in this document are presented for 

informational purposes only and do not constitute product approval or endorsement by the 

U.S. Department of Justice. 

The National Institute of Justice is a component of the Office of Justice Programs, which also 

includes the Bureau of Justice Assistance, the Bureau of Justice Statistics, the Office of 

Juvenile Justice and Delinquency Prevention, and the Office for Victims of Crime. 

Cover Credits 

(From left to right) 

Map by Jeff Stith and the Wilson, North Carolina, Police Department 

Map by Wilpen Gore, Heinz School of Public Policy and Management, Carnegie Mellon 

University, Pittsburgh, Pennsylvania 

Background map by Jeff Stith and the Wilson, North Carolina, Police Department 
About This Report 

Much of crime mapping is devoted to 

detecting high-crime-density areas known 

as hot spots. Hot spot analysis helps 

police identify high-crime areas, types of 

crime being committed, and the best way 

to respond. 

This report discusses hot spot analysis 

techniques and software and identifies 

when to use each one. The visual display 

of a crime pattern on a map should be 

consistent with the type of hot spot and 

possible police action. For example, when 

hot spots are at specific addresses, a dot 

map is more appropriate than an area 

map, which would be too imprecise. 

In this report, chapters progress in sophistication. Chapter 1 is for novices to crime 

mapping. Chapter 2 is more advanced, 

and chapter 3 is for highly experienced 

analysts. The report can be used as a companion to another crime mapping report 

published by the National Institute of 

Justice in 1999, Crime Mapping: Principle 

and Practice, by Keith Harries. 

What did the researchers 

find? 

■ Identifying hot spots requires multiple 

techniques; no single method is sufficient to analyze all types of crime. 

■ Current mapping technologies have significantly improved the ability of crime 

analysts and researchers to understand 

crime patterns and victimization. 

■ Crime hot spot maps can most effectively guide police action when production 

of the maps is guided by crime theories 

(place, victim, street, or neighborhood). 

Who should read this study? 

Crime analysts and researchers in police 

departments. 

iii 
Contents 

About This Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iii


Chapter 1. Crime Hot Spots: What They Are, 


Chapter 2. Methods and Techniques for 


Why We Have Them, and How to Map Them . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1


Understanding Crime Hot Spots . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15


Chapter 3. Spatial Analysis Tools for Identifying Hot Spots . . . . . . . . . . . . . . . 35


Chapter 4. Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65


v 
Chapter 1. Crime Hot Spots: What They Are,


Why We Have Them, and How to Map Them 


John E. Eck, University of Cincinnati 

Crime is not spread evenly across maps. 

It clumps in some areas and is absent in 

others. People use this knowledge in their 

daily activities. They avoid some places 

and seek out others. Their choices of 

neighborhoods, schools, stores, streets, 

and recreation are governed partially by 

the understanding that their chances of 

being a victim are greater in some of 

these places than in others. In some 

places people lock their cars and secure 

belongings. In other places they do not. 

Along some streets people walk swiftly 

and view approaching strangers with suspicion. Along other streets they casually 

stroll and welcome the next interesting 

person they might meet, and notice others 

making the same choices in the same 

areas. 

Some might argue that this behavior 

merely shows that people are unreasonably fearful of some areas but not of others. This may often be true, but the fact 

that people are not equally fearful of all 

places suggests that they understand that 

crime is not evenly distributed. People 

might be mistaken about the risks of 

some places, but they are not mistaken 

that their risk of being a victim of crime is 

not geographically constant. 

Police use this understanding every day. 

Decisions about how to allocate scarce 

resources are based partially on where the 

demands for police are highest and where 

they are lowest. Officers are told to be 

particularly attentive to some behavior in 

some areas, but are given no guidance 

about other areas where this behavior is 

scarce. Community policing is particularly 

attentive to high-crime neighborhoods, 

where residents have great difficulty exerting social controls. Problem-oriented policing pushes police officials to identify 

concentrations of crime or criminal activity, 

determine what causes these concentrations, and then implement responses to 

reduce these concentrations. Much of 

what is called crime analysis is dedicated 

to locating concentrations of crime—hot 

spots—and much of crime mapping is 

devoted to their detection. 

This chapter discusses how different interpretations of hot spots require different 

types of crime maps. The principal theme 

is that crime hot spot maps can most 

effectively guide police action when production of these maps is guided by theory. 

With the appropriate crime theory, crime 

maps can communicate vital information 

to police officials and community members efficiently and effectively. 

Many useful crime theories provide guidance for selecting mapping symbols. 

Which theory is most useful depends on 

the type of problem being mapped. Maps 

that are not based on theory will provide 

officers with inadequate and even misleading information. 

The term hot spot has a number of meanings. This chapter begins with a discussion 

of what the term means and how the 

meanings relate to the concept of levels of 

spatial analysis of crime. Different theories 

of crime explain crime at different levels, 

so this chapter briefly describes various 

1 
SPECIAL REPORT / AUG. 05 

levels of crime theories and explains how 

they can be depicted on maps. This chapter examines four types of crime theories 

in greater detail: place (point) theories; 

street (line) theories; area (polygon) theories; and repeat victim theories, which can 

operate on point, line, or polygon level. 

These theories describe the levels of hot 

spots and how these levels can be depicted on maps. This chapter examines why 

crime theory, crime mapping, and police 

actions need to be consistent. The end of 

the chapter examines how the map symbols implied by each theory communicate 

to users of crime maps. 

What is a hot spot? 

Areas of concentrated crime are often 

referred to as hot spots. Researchers and 

police use the term in many different ways. 

Some refer to hot spot addresses (Eck and 

Weisburd, 1995; Sherman, Gartin, and 

Buerger, 1989), others refer to hot spot 

blocks (Taylor, Gottfredson, and Brower, 

1984; Weisburd and Green, 1994), and others examine clusters of blocks (Block and 

Block, 1995). Like researchers, crime analysts look for concentrations of individual 

events that might indicate a series of related crimes. They also look at small areas 

that have a great deal of crime or disorder, 

even though there may be no common 

offender. Analysts also observe neighborhoods and neighborhood clusters with high 

crime and disorder levels and try to link 

these to underlying social conditions. 

Though no common definition of the term 

hot spot of crime1 exists, the common 

understanding is that a hot spot is an area 

that has a greater than average number of 

criminal or disorder events, or an area 

where people have a higher than average 

risk of victimization. This suggests the 

existence of cool spots—places or areas 

with less than the average amount of 

crime or disorder. It also suggests that 

some hot spots may be hotter than others; 

that is, they vary in how far above average 

they are. 

Levels of hot spot analysis 

If hot spots are merely areas with an 

above average amount of crime or disorder, why do practitioners and researchers 

use the term in such a variety of ways? In 

fact, with recent developments in crime 

mapping, one can find hot spots of any 

size—from hot spot places to hot regions. 

Although all of these perspectives on hot 

spots have something in common—concentrations of crime or disorder separated 

by areas with far less crime or disorder— 

they differ in the area covered by the hot 

spots. More importantly, the factors that 

give rise to hot spot places are different 

from the factors that give rise to hot spot 

streets, hot spot neighborhoods, or hot 

spot cities. Further, the actions one takes 

to deal with a hot spot place will be different from the actions needed to address a 

hot spot street, hot spot neighborhood, or 

hot spot city. 

These approaches differ on the level of 

analysis, or the size of the geographic area 

of crime about which one is concerned.2 

The level at which one examines crime or 

disorder is dictated by the question one 

asks, which will determine the usefulness 

of the results. Consider two related, but 

very distinct, questions: Where are drugs 

being sold? What is the market for drugs? 

The precise answer to the first question 

requires identifying specific drug-dealing 

locations or street segments (very small 

areas) where drug dealers and customers 

routinely meet. To answer the second 

question, the analyst needs to find out 

where the customers are coming from, 

just as he would if he asked the question, 

2 
MAPPING CRIME: UNDERSTANDING HOT SPOTS 

“What is the market for new cars?” The 

answer to the first question—specific 

locations or street segments—is not particularly useful for answering the second 

question. Rather, the analyst would be 

interested in larger areas with high concentrations of drug users. These areas 

might surround the locations and street 

segments identified when answering the 

first question, or they may be physically 

separated from the dealing sites (as would 

occur when suburban high school and college students drive into cities to find 

drugs). The types of police actions that 

might remove drug-dealing locations are 

likely to be different from the actions 

needed to dry up the market. So identifying the appropriate level of analysis is critical to understanding the problem and 

determining what action to take. 

Crime theories are critical for useful crime 

mapping because they aid in the interpretation of data (Eck, 1998) and provide 

guidance as to what actions are most 

appropriate. Therefore, understanding 

how crime theories account for hot spots 

is critical. Several theories of crime and 

disorder concentration (hot spots) exist. 

Some theories disagree, but often the 

theories do not contradict each other. 

Rather, they explain different types of 

crime phenomena that occur at different 

geographic levels. 

Each level has basic units of analysis—the 

things being examined. One can think of 

units as corresponding to the geographic 

areas being depicted on maps: points, 

lines, or polygons (Harries, 1999). Some 

theories help explain point concentrations 

of crime. Other theories help explain linear 

concentrations of crime or hot spot crime 

polygons. However, theories of crime are 

useful for helping to guide crime and disorder mapping only if one selects a theory 

appropriate for the level of analysis and 

action. 

Crime hot spot theories 

Place theories 

Place theories explain why crime events 

occur at specific locations. They deal with 

crimes that occur at the lowest level of 

analysis—specific places. They involve 

looking at specific incidents and asking 

such questions as, “At what places are 

burglaries occurring and at what places are 

they not occurring?” Crime phenomena at 

this level occur as points, so the appropriate units of analysis are addresses, street 

corners, and other very small places, 

which are typically represented on maps 

as dots. Police action, such as warrants, 

which specify exact addresses (not blocks 

or neighborhoods), is very precise at this 

level. Similarly, nuisance abatement focuses on specific locations. 

Street theories 

Street theories deal with crimes that occur 

at a slightly higher level than specific 

places; that is, over small, stretched areas 

such as streets or blocks. A prostitution 

stroll is an example. At this level of analysis analysts ask such questions as, “On 

which streets are prostitutes found and on 

which streets are they not found?” The 

appropriate units of analysis can be street 

segments, paths, and sections of highways, which would be represented on 

maps as straight, bent, or curved lines. 

Police action is still relatively precise, 

although not as precise as at the place 

level. Concentrated patrolling occurs at 

this level, for example, as well as efforts to 

change traffic and street patterns. 

Neighborhood theories 

Some theories of crime attempt to explain 

neighborhood differences.3 At a higher 

level than place or street, neighborhood 

3 
SPECIAL REPORT / AUG. 05 

theories deal with large areas. Here analysts are interested in such questions as, 

“What areas are claimed by gangs and 

what areas are not?” The appropriate units 

of analysis are quite varied and can include 

square blocks, communities, and census 

tracts, to name a few. Two-dimensional 

shapes such as ellipses, rectangles, and 

other polygons are used on maps to represent crime phenomena at this level. At this 

level police action is far less precise 

because the areas are typically too large 

for effective concentrated patrolling 

(Sherman, 1997). Nevertheless, depending 

on neighborhood characteristics, relevant 

action might include efforts to engage residents in collective action against crime 

and disorder. If offenders are mobile 

throughout an area, rather than concentrated at a few places, then efforts to 

deter them should occur at this level. 

Other large area theories 

Still other theories attempt to explain differences in crime patterns at much higher 

levels of aggregation. For example, theories of crime differ among cities and 

among regions. On the city level, suggested actions may include citywide changes 

in economic, transportation, education, 

welfare, and recreation policies, to name a 

few. On the multijurisdictional or multistate regional levels, suggested actions 

against concentrations of crime could 

include even broader scale policies or 

social change. Although these are interesting theories, they are far less useful for 

local police agencies. Thus, they are not 

examined here. 

Repeat victimization theories 

Finally, repeat victimization theories pertain 

to questions of why the same victims are 

targeted repeatedly. They can operate at 

any of the three levels discussed: points, 

lines, or polygons. However, not all repeat 

victimization can be shown on maps. 

Exhibit 1 organizes and summarizes the 

discussion of hot spot analysis so far and 

introduces what is to come. The first column describes the geographic concentration at various levels of interest. The 

second column describes the basic pattern formed by hot spots at each level. The 

third column lists the geometric dimension to be used on a crime map to depict 

each type of hot spot. Place theories suggest maps with dots, street theories suggest maps that emphasize lines, and area 

theories suggest the use of polygons on 

maps. Repeat victimization theories do not 

directly correspond to a single dimension 

or level. They can be depicted on maps by 

dots, lines, or polygons. The last three 

columns highlight points discussed next. 

Examined are four types of hot spots— 

places, victims, streets, and areas. 

Types of hot spots 

Repeat places hot spots 

The most basic form of a hot spot is a 

place that has many crimes. A place can 

be an address, street corner, store, house, 

or any other small location, most of which 

can be seen by a person standing at its 

center (Sherman et al., 1989). Places typically have a single owner and a specific 

function—residence, retail sales, recreation, school (Eck and Weisburd, 1995). 

Crime often is concentrated at a few 

places, even in high-crime areas. Although 

hot places often are concentrated within 

areas, they often are separated by other 

places with few or no crimes. Because 

such hot spots are best depicted by dots, 

they have a dimension of zero. 

Underlying causes. Routine activity theory helps to explain why crime often is concentrated at specific places. In particular, 

routine activity points to how behavior is 

regulated at the location by place managers—owners of places or people acting 

on an owner’s behalf. Behavior regulation 

4 
MAPPING CRIME: UNDERSTANDING HOT SPOTS 

falls under place management theory, a 

part of routine activity theory. For example, the difference between a bar that has 

few or no incidents or assaults and a bar 

with frequent assaults is likely to be that in 

the first instance the bar employees regulate the behavior of patrons to minimize 

the chances of an assault, and in the second instance, they do not. Such regulation 

has three effects. It directly prevents criminal activity through early intervention (e.g., 

controlling the number of drinks a patron 

can consume), it attracts place users who 

desire a well-regulated location over a 

weakly regulated place (such people are 

less likely to create problems), and it 

repels place users who desire a weakly 

regulated location over a well-regulated 

place (Brantingham and Brantingham, 

1995). Repeat places tend to be stable 

over time (Spelman, 1995a), and this is 

consistent with the routine activity theory 

that an absence of effective place management is at the heart of the problem. 

Maps for repeat places. Maps for repeat 

places include— 

■ Graduated symbols. When looking for 

hot places, dot maps are superior to 

other forms of mapping. The goal is to 

identify isolated high-crime locations, 

which can be done in a number of ways. 

One can use graduated dots, so that dot 

size is proportional to the number of 

crimes at the location. This method 

Exhibit 1. Hot spot concentrations, evidence, theory, and causes 

Map Geometric 

Concentration pattern dimension Theories Likely causes Examples 

Place—at Point concentration; Zero; concentration Routine activity Management of Bar fights, 

specific a few places with at points theory; place behavior at places convenience 

addresses, many crimes and many management store 

corners, or other places with few robberies, 

places or no crimes. Repeat ATM patron 

crime places are often robberies, 

concentrated. drug dealing 

locations 

Among Often confused with Zero, one, or two; Routine activity Victim routines Domestic 

victims repeat crime places concentration at theory; and lifestyle violence 

(above). Only visible points, lines, and lifestyles choices 

on maps if victims are areas 

concentrated at places, 

on streets, or in areas. 

Street—along Linear concentration One; concentration Offender search Offender movement Outside 

a street or block along major thorough- along lines theory patterns and target street 

face fares; a few blocks concentrations prostitution, 

with much crime and street drug 

many blocks with little dealing, 

crime robberies of 

pedestrians 

Area—neighbor- Concentration covering Two; concentration Disorganization Low collective Residential 

hood areas multiblock areas in areas theory and re- efficacy, social burglary, 

lated ecologic fragmentation, gang 

theories of concentrations violence 

crime; of youth, 

opportunity economic disinvesttheories ments; concentrations of crime 

targets 

5 
SPECIAL REPORT / AUG. 05 

allows the depiction of repeat and nonrepeat places on the same map and permits comparison among repeat places 

about the number of crimes. Graduated 

dots also allow one to find concentrations of hot places (e.g., an area that 

contains several repeat assault bars). 

Because graduated dots can obscure 

nearby features (e.g., a large dot may 

overlap nearby smaller dots), this technique is best used on large-scale maps. 

■ Color gradient dots. Two other 

approaches are useful on small-scale 

maps. One is to use a color gradient— 

yellow through red, for example—to 

depict the number of crimes at each 

location. A yellow dot may be used to 

represent places with a single crime, a 

light orange dot may represent locations 

with two crimes, and a deeper orange 

dot might represent places with three 

crimes. This approach has the advantage 

of the use of graduated symbols but 

overcomes the overlap problem. 

■ Repeat addresses. Another method is 

to select the most serious hot spot 

addresses. For example, one might want 

to find the worst 10 percent of the 

addresses. This is called repeat address 

mapping (RAM). The addresses would 

be the 10 percent of repeat addresses 

that have the most crimes. They would 

be plotted on a map using dots to represent hot spots. This method has two distinct advantages. First, the map is 

clearer because it has less clutter. 

Second, such maps are useful for clearly 

specifying police targets. The deficiency 

of RAM is that it leaves out information 

about the other locations. This deficiency 

can be overcome by producing supplementary maps that show all locations or 

by combining RAM with the use of a 

color gradient so that the targeted hot 

spots have a distinct color (Eck, Gersh, 

and Taylor, 2000). 

Repeat victimization hot spots 

Repeat victimization refers to the multiple 

attacks on the same individual, regardless 

of location. It often is confused with 

repeat crime places. A repeat place might 

have a number of different victims. 

Clearly one can have both repeat victimization and repeat crime places (Eck, 

2000). For example, a person could frequent a bar where he is assaulted on a 

number of different occasions. But if 

repeat victimization is distributed over 

many locations (as would occur if repeat 

victims are assaulted at different bars, 

but never the same bar twice), it will not 

show up on a map as a hot spot place 

(zero dimension). Repeat victimization 

could show up as lines (one dimension) if 

the victims are repeatedly attacked along 

the same thoroughfares, or as a polygon 

(two dimensions) if victims are repeatedly 

attacked in the same neighborhoods. 

Mapping repeat victimization is more likely 

to reveal patterns with vulnerable populations—potential victims who engage in 

similar activities. Consider taxicab robberies and homicides. These crimes are 

unlikely to be concentrated in places. One 

might find attacks on this victim group 

occurring along specific streets where the 

drivers are particularly vulnerable or where 

offenders have a better chance of escape. 

More likely, however, taxicab robberies 

and homicides will be spread over a neighborhood or in a multineighborhood area 

within a city. 

Underlying causes. Repeat crime places 

with different victims and repeat victimization with different places have different 

causes. Repeat crime places (with different victims) can be attributable to the 

behavior of place managers, but if the victimizations occur at different places, place 

managers have less of a role. In those 

cases, one should look at the occupations, 

6 
MAPPING CRIME: UNDERSTANDING HOT SPOTS 

commuting patterns, or lifestyles of the 

potential victims (Farrell and Pease, 1993; 

Spelman, 1995b; Stedman and Weisel, 

1999). The most obvious example comes 

from the increasing evidence that the people most likely to become victims of 

assault are those people most likely to be 

involved in deviant and criminal activity 

(e.g., drug dealing, drug use, heavy alcohol 

consumption, prostitution) (Menard, 

2000). Some occupations increase the 

chances of victimization, which can 

increase repeat victimization. Police officers, for example, have a greater rate of 

victimization than many other occupations 

(Block, Felson, and Block, 1985). However, 

the things that make a person a target for 

crime are sometimes difficult for that person to change. 

Repeat streets hot spots 

Repeat streets are those thoroughfares or 

streets with a high degree of victimization. 

Repeat places and some repeat victimization hot spots show up as dots on crime 

maps. If one increases the dimension of 

the hot spot from zero to one, hot spots 

that form lines appear. Linear hot spots 

are likely to be the results of the interaction of targets and offenders along thoroughfares. Brantingham and Brantingham 

(1981) describe the search behavior of 

offenders. Their offender search theory 

points to the importance of street patterns 

for how offenders look for targets. 

Underlying causes. Offenders find targets while going about their normal legitimate business—going to and from work, 

recreation, shopping, school, and other 

nodes of activity. Potential targets that are 

not along the routes or near nodes used 

by offenders will unlikely be victimized, but 

those close to offenders’ routes and nodes 

have elevated risks of victimization. Since 

major thoroughfares concentrate people 

(including offenders), targets situated 

along thoroughfares face higher crime 

risks than targets on side streets far from 

thoroughfares. Further, some types of targets concentrate along major streets. 

Convenience stores, fast food stores, gas 

stations, and other retail places are sited 

along major thoroughfares because that is 

where their customers concentrate. So for 

both reasons of offender movement patterns and target placement patterns, many 

crime hot spots are actually hot lines. 

Some offenses may be concentrated at 

points or along lines. Street drug dealing is 

one example. Many street drug dealers 

simultaneously work along streets but 

anchor their activities to a specific 

address. In such circumstances, one 

might find a concentration of drug dealing 

along a few street segments and concentrations of drug locations at anchor sites. 

Weisburd and Green (1995) used street 

segments to identify drug hot spots in 

Jersey City because of offender movement patterns. Eck (1994), however, identified drug-dealing places because they 

seemed to be the anchor points of the 

drug trade in the San Diego neighborhood 

he was studying. 

Distinguishing hot places from hot streets 

can be difficult. In fact, one can sometimes find both. Imagine robbers attacking 

pedestrians on a street leading from 

restaurants and bars to a parking area. The 

attack sites may form a line along this 

street. But even along this hot street, hot 

places where multiple attacks have 

occurred may exist. However, one should 

always be suspicious of such findings. It 

might be that the hot places are not actual 

robbery occurrence sites. Instead, they 

may be locations to which victims run for 

help, or they may be addresses that officers put in their reports when they cannot 

easily find the correct robbery address. 

7 
SPECIAL REPORT / AUG. 05 

Knowledge of offender, victim, and police 

behavior is critical to separating the underlying crime pattern from reporting and 

recording patterns. 

Maps for repeat streets. Commonly 

available mapping programs make it easy 

to identify hot spot places or hot spot 

areas, but do not make linear hot spots 

easy to identify. Simple dot maps can be 

used to identify hot street segments, and 

this may be the most straightforward 

method. Most clustering algorithms, 

unfortunately, will show areas of concentration even when a line is the most 

appropriate dimension. If high levels of 

precision are not required, such area 

maps may be adequate. 

Neighborhoods and other area 

hot spots 

More has been written about neighborhood concentrations of crime (hot spots) 

than about any other form of concentration of crime. In their pathbreaking book 

Social Factors in Juvenile Delinquency 

(1931), Shaw and McKay noted persistent 

concentrations of deviancy in the 1920s. 

They noted that some neighborhoods had 

high levels of juvenile delinquency, year in 

and year out, decade after decade, regardless of who lived in the areas (Shaw and 

McKay, 1969). Since that time, many 

explanations for differences in neighborhood crime levels have surfaced. Most of 

these theories focus on the ability of local 

residents to control deviancy (Bursik and 

Grasmick, 1993). 

Underlying causes. Explanations for differing neighborhood crime levels include 

the following: ■ Social disorganization theory. This theory suggests that the natural ability of 

people to control deviancy in their neighborhoods is impaired in some areas by 

constant residential turnover and net 

outmigration. These changes either disrupt social networks or prevent such 

networks from forming. Since these networks, according to disorganization theory, are responsible for most social 

control in neighborhoods, their absence 

leads to higher levels of deviancy. Other 

factors, such as poverty and racism, also 

have been identified as undermining 

social networks. 

■ Social efficacy. Recent evidence from 

Chicago points to the role of social efficacy, which is “the willingness of local 

residents to intervene for the common 

good.” It depends on “mutual trust and 

solidarity among neighbors” (Sampson, 

Raudenbush, and Earls, 1997, page 919). 

Neighborhoods that have a great deal of 

social efficacy have less crime and disorder than neighborhoods that have low 

levels. Social efficacy—like disorganization and social networks—is not a property of individual people or places, but a 

characteristic of groups of people. 

■ Broken windows theory. The broken 

windows theory also is an area theory of 

crime concentration. Wilson and Kelling 

(1982) claim that in most well-functioning neighborhoods, small transgressions 

of social norms (e.g., failure to keep 

one’s yard tidy) result in social pressures 

to bring the offending party into compliance. Once a place becomes untended, 

however, it undermines the willingness 

and ability of residents to enforce social 

order. Consequently, residents withdraw 

from enforcing neighborhood norms, 

which allows further deviancy to occur. 

This in turn results in additional withdrawal and fear and the neighborhood 

begins to spiral downward. Skogan 

(1990) found evidence in support of this 

basic thesis, although others suggest 

the evidence is weak (Harcourt, 1998) or 

show that the theory is seriously flawed 

(Taylor, 2000). 

8 
MAPPING CRIME: UNDERSTANDING HOT SPOTS 

■ Crime opportunity theories. Another 

explanation for neighborhood-level hot 

spots comes from routine activity theory 

and related theories that point to crime 

opportunities as the principle cause of 

crime. Rather than concentrations of 

offenders or the absence of social controls, opportunity theories suggest that 

analysts should look for concentrations 

of crime targets. For example, a dense 

urban neighborhood with no off-street 

parking will have many cars parked on 

the street. Such an area may become an 

area hot spot for thefts from vehicles. A 

suburban subdivision inhabited by dualincome families will have few people at 

home during weekdays. Since their 

property is unprotected, their neighborhood can become an area burglary hot 

spot. Note that in this type of situation, 

several layers of hot spots can exist 

simultaneously. Within area hot spots, 

defined by the subdivision in this example, might be streets with even greater 

numbers of burglaries, and some of the 

homes on these streets may be broken 

into multiple times. 

Maps for area hot spots. Problems 

arising from processes described by 

neighborhood-level theories are best 

depicted on maps by shaded areas, rather 

than dots or lines. Area hot spots on maps 

can be shown in a variety of ways: ellipses, 

shaded areas (choropleth maps), or crimefrequency gradients (e.g., isoline maps that 

depict crime frequency or risk as graduated contours, just as feet above sea level is 

depicted on topographical maps). 

Selecting the Appropriate 

Hot Spot Map 

Action level, hot spot level, 

and mapping 

The discussion so far has highlighted theories relevant to understanding different 

levels of hot spots. By now, it should be 

obvious that each form of concentration— 

place, victim, street, or neighborhood— 

requires its own form of mapping. It 

should also be apparent that the types of 

actions police should take correspond to 

the type of the concentration. These factors have important implications for how 

maps of hot spots are constructed and 

how the hot spots are depicted. 

Dot maps. When hot spots are at specific 

addresses, corners, and other places, the 

relevant depiction of the hot spot is a dot 

because mappers want to distinguish 

between the places with problems and 

very nearby places without problems. 

Such distinctions are critical for delivering 

effective and efficient action. A gas station 

with many robberies needs to be distinguished from the gas station across the 

street with no robberies. In this circumstance, a map highlighting a street or area 

is far less useful to police than a map highlighting the gas stations that are robbery 

hot spots. Dot maps of crime places can 

identify widely spread locations that are 

hot spots. Such places might be overlooked if lines or polygons are used to 

define hot spots. 

Line maps. When the hot spots are along 

streets, point maps and area maps are of 

far less utility than line maps. Point maps 

draw attention to the hot spot places along 

the street and imply that the intervening 

locations have low risk, when they may be 

future targets. Area maps include streets 

that have few or no crimes. Street robberies of people leaving bars and nightclubs are good examples of this. The bars 

and nightclubs are specific points, but the 

robberies do not occur there. These entertainment spots may be concentrated in 

one neighborhood, but even within this 

neighborhood, many streets do not have 

street robberies. The robberies may occur 

along streets leading from the entertainment spots to car parking locations. 

9 
SPECIAL REPORT / AUG. 05 

Knowing which streets have the robberies 

and which do not is critical for addressing 

such a concentration. So showing this 

form of hot spot requires lines—straight, 

jointed, curved, or intersecting. 

Ellipse, choropleth, and isoline maps. 

When hot spots cover broader areas and 

coincide with neighborhoods, they need to 

be depicted in another way. Ellipse and 

choropleth maps imply that the areas within the designated hot spots share the 

same risk level, so a specific street or location within the area is irrelevant. Isoline 

maps imply a continuous gradient of risk 

within a hot spot, so a particular place has 

risks similar to but not the same as an 

adjacent place or street. A gang-related 

robbery problem can be an example. If 

gang members commit robberies throughout specific neighborhoods (i.e., do not 

focus on specific streets or around specific sites), but refuse to commit robberies 

outside their territories, and their territorial 

boundaries are streets, then a choropleth 

map might be useful. One could create a 

map of the gang areas and shade the 

areas according to the robbery frequency 

within each. If the likelihood of a gangrelated robbery diminishes the farther one 

goes from the center of gang activity, then 

an isoline map depicting gradients of robbery frequency does a better job of showing the problem. 

Ellipses may be far less useful. They suggest a firm boundary between crime on 

the inside and no crime on the outside, 

but they frequently do not follow natural 

movement patterns of people. Using an 

ellipse to define an area hot spot is like 

saying, “Look in this general area,” 

because neither its shape nor its boundary 

are likely to conform to the nature of the 

underlying problem. Consequently, 

ellipses provide police officers with far 

less information than other ways of depicting area hot spots. 

Limitations of hot spot maps 

Concentrations of victimization sometimes 

can be shown with maps, but often they 

cannot. If victimization risk is in part geographical, then maps are useful. A citywide dot map of gas stations with two or 

more robberies within the last 6 months 

shows concentration at two levels. The 

dots depict concentrations of robbery at 

specific places. Groupings of dots depict 

streets or neighborhoods with concentrations of repeat robbery gas stations. Dot 

maps for this type of victimization makes 

some sense, but they do not work for all 

forms of victimization concentration. If victims are mobile, street or area maps might 

be more useful. However, the use of maps 

is limited for some forms of victimization 

analysis. If the population of potential victims is spread throughout an area (not 

concentrating at places, along streets, or 

within neighborhoods), the analyst would 

be better off using an analytical technique 

other than maps to convey the concentration. For example, taxicab robberies may 

be spread quite thinly across a city. The 

relevant features of the robbery victims 

might be related to the cab companies, 

the drivers’ ages, hours of operation, 

installed security within cabs, or a host of 

factors that cannot be shown on a map. 

Police officers trying to investigate or prevent such robberies would find maps less 

useful than bar charts showing the characteristics of victims and nonvictims. 

Exhibit 2 links the major points discussed 

thus far. The first two columns are from 

exhibit 1. The third column shows where 

the police action needs to be focused. If 

the concentration level, action level, and 

form of hot spot depiction are not aligned, 

then the map will be useless at best and 

suggest inappropriate action at worst. A 

map depicting hot streets or areas does 

not help identify places where nuisance 

abatement would be useful. Alternatively, 

a point map is too specific for implement10 
MAPPING CRIME: UNDERSTANDING HOT SPOTS 

ing street reconfigurations or neighborhood redevelopment efforts. 

The consequences of using the wrong 

type of map are not equal. Point maps are 

more forgiving than street or areas maps. 

Dot maps allow the user to see the underlying pattern of crime and determine 

whether to go up a level. However, maps 

of hot streets or hot areas often do not 

show the hot places, thus place concentration can remain hidden. This suggests 

that crime mapping should start at the 

lowest level and work upward to avoid 

overlooking low-level concentrations 

where effective action can be taken. 

Conclusion 

Different kinds of hot spots, which develop from different causes, require different 

kinds of police action. For crime mappers, 

this means that the visual display of the 

crime pattern on the map should be consistent with the type of hot spot and possible 

police action. Plotting area maps when the 

hot spots are addresses is not useful to the 

police officers using the map because the 

map is imprecise. It directs their attention 

to large areas where little effort needs to be 

expended and away from the places where 

attention is needed. At the other extreme, 

focusing attention on point locations when 

the problem is at the area level focuses 

attention at too precise an area and suggests action that is too focused. 

Maps convey powerful messages to their 

readers, most of whom are not knowledgeable about the technicalities of crime mapping. These messages are conveyed in 

symbols, as shown in exhibit 3. Dots (A) 

draw attention to specific places and suggest that places without dots can be 

ignored. A point conveys the message that 

the hot spot is located at this exact location 

and should be the focus of police efforts. A 

shaded street segment (B) suggests that 

the chances of crime are roughly equal 

along the entire segment and police efforts 

should focus along this line, but not along 

other lines. A shaded area (C), such as one 

used in a choropleth map, also suggests 

equivalent risks of crime throughout the 

area with a dramatic reduction in risk at the 

border. It suggests that police activity 

throughout the area is appropriate. An area 

covered by a gradient (D), such as that 

depicted in isoline maps, implies that a center of high-crime activity exists and that 

criminal activity tapers off gradually from 

that center. It directs police attention to the 

center and its surroundings. Each way of 

Exhibit 2. Concentration, mapping, and action 

Concentration Hot spot depiction Action level Action examples 

Place—at specific Points Place, corner Nuisance abatement, hot 

addresses, corners or spot patrols 

other places 

Among victims Points, lines, and areas High-risk targets and Developing networks 

depending on the nature potential victims among potential victims, 

of concentration repeat victimization 

programs 

Street—along streets Lines Streets, highways Concentrated patrolling of 

or block faces specific streets, traffic 

reengineering 

Area—neighborhood Ellipses, shaded areas, Large areas Community partnerships, 

areas and gradients neighborhood redevelopment 

11 
SPECIAL REPORT / AUG. 05 

depicting hot spots is connected with useful theories, each of which suggests different types of police action. Recognition of 

these links in mapping practice will lead to 

better use of crime maps. 

Notes 

1. Although one could have hot spots of anything that 

can be geographically distributed—a hot spot of automobile dealerships, for example—usage of this term 

is restricted to crime or disorder. So unless otherwise specified, hot spots means hot spots of crime 

or disorder. 

2. Level does not indicate superiority or rank in this 

instance. A high-level hot spot is not better or worse 

than a low-level hot spot. Rather, higher level hot spots 

can be composed of groups of lower level hot spots. 

In this sense, level refers to level of aggregation. 

Exhibit 3. Messages in crime maps 

3. Some disagreement exists over the geographic 

scope of neighborhood theories of crime. Most 

researchers refer to areas covering several square 

blocks, although Taylor (1997, 1984) makes a strong 

case for the relevant area being about the size of a 

single block. Clearly, the difference between a large 

place and a small neighborhood is blurry. 

References 

Block, R., and C. Block. 1995. “Space, Place and 

Crime: Hot Spot Areas and Hot Place of LiquorRelated Crime.” In J.E. Eck and D. Weisburd (eds.), 

Crime and Place (vol. 4, pp. 145–184). Monsey, NY: 

Criminal Justice Press. 

Block, R., M. Felson, and C.R. Block. 1985. “Crime 

Victimization Rates for Incumbents of 246 

Occupations.” Sociology and Social Research, 69, 

442–451. 

D

Everywhere inside is

equally likely to be a

crime site that is part

of the pattern.

Everywhere outside

the chance of being a

crime site that is part

of the pattern is zero.

Chance of a site being part

of the pattern changes

radically at the edge.

Gradient indicates that the

probability of being a crime

site that is part of the pattern

varies from low near the edge

to high near the center.

A

Chance of a crime site

being part of the pattern is

equal anywhere along

street segments, and zero

elsewhere.

Chance of crime being

part of pattern is high

at site, but zero at 

other places.

C

12 
MAPPING CRIME: UNDERSTANDING HOT SPOTS 

Brantingham, P.L., and P.J. Brantingham. 1981. “Notes 

on the Geometry of Crime.” In P.J. Brantingham and 

P. L. Brantingham (eds.), Environmental Criminology 

(pp. 27–54). Beverly Hills, CA: Sage Publications. 

Brantingham, P.L., and P.J. Brantingham. 1995. 

“Criminality of Place: Crime Generators and Crime 

Attractors.” European Journal of Criminal Justice 

Policy and Research, 3, 5–26. 

Bursik, R.J., and H.G. Grasmick. 1993. Neighborhoods 

and Crime: The Dimensions of Effective Community 

Control. New York, NY: Lexington Books. 

Eck, J. 2000. “Policing and Crime Event Concentration.” 

In L.W. Kennedy, R.F. Meier, and V.F. Sacco (eds.), 

The Process and Structure of Crime: Criminal Events 

and Crime Analysis. New Brunswick, NJ: Transaction 

Press. 

Eck, J.E. 1994. Drug Markets and Drug Places: A 

Case-Control Study of the Spatial Structure of Illicit 

Drug Dealing. Unpublished Ph.D. dissertation, 

University of Maryland. 

Eck, J.E. 1998. “What Do Those Dots Mean? 

Mapping Theories With Data.” In D. Weisburd and 

T. McEwen (eds.), Crime Mapping and Crime 

Prevention (vol. 8, pp. 379–406). Monsey, NY: 

Criminal Justice Press. 

Eck, J.E., J.S. Gersh, and C. Taylor. 2000. “Finding 

Crime Hot Spots Through Repeat Address Mapping.” 

In V. Goldsmith, P.G. McGuire, J.H. Mollenkopf, and 

T.A. Ross (eds.), Analyzing Crime Patterns: Frontiers 

of Practice (pp. 49–64). Thousand Oaks, CA: Sage 

Publications. 

Eck, J.E., and D. Weisburd. 1995. “Crime Places in 

Crime Theory.” In J. E. Eck and D. Weisburd (eds.), 

Crime and Place (vol. 4, pp. 1–33). Monsey, NY: 

Criminal Justice Press. 

Farrell, G., and K. Pease. 1993. Once Bitten, Twice 

Bitten: Repeat Victimization and Its Implications for 

Crime Prevention (vol. 46). London: Her Majesty’s 

Stationery Office. 

Harcourt, B.E. 1998. “Reflecting on the Subject: A 

Critique of the Social Influence Conception of 

Deterrence, the Broken Windows Theory and Order 

Maintenance Policing New York Style.” University 

Michigan Law Review, 97, 291–389. 

Harries, K. 1999. Mapping Crime: Principle and 

Practice. Washington, DC: U.S. Department of 

Justice, National Institute of Justice. 

Menard, S. 2000. “The ‘Normality’ of Repeat 

Victimization From Adolescence Through Early 

Adulthood.” Justice Quarterly, 17(3), 543–574. 

Sampson, R.J., S.W. Raudenbush, and F. Earls. 1997. 

“Neighborhoods and Violent Crime: A Multilevel 

Study of Collective Efficacy.” Science, 227, 918–924. 

Shaw, C.R., and H.D. McKay. 1931. Social Factors in 

Juvenile Delinquency (vol. 2, no. 13). Washington, 

DC: U.S. Government Printing Office. 

Shaw, C.R., and H.D. McKay. 1969. Juvenile 

Delinquency and Urban Areas (revision of 1942 ed.). 

Chicago, IL: University of Chicago. 

Sherman, L.W. 1997. “Policing for Crime Prevention.” 

In L.W. Sherman, D. Gottfredson, D. MacKenzie, J. 

Eck, P. Reuter, and S. Bushway (eds.), Preventing 

Crime: What Works, What Doesn’t, What’s Promising 

(pp. 8-1–8-58). Washington, DC: U.S. Department of 

Justice, National Institute of Justice. 

Sherman, L.W., P.R. Gartin, and M.E. Buerger. 1989. 

“Hot Spots of Predatory Crime: Routine Activities 

and the Criminology of Place.” Criminology, 27(1), 

27–55. 

Skogan, W.G. 1990. Disorder and Decline: Crime 

and the Spiral of Decay in American Neighborhoods. 

New York, NY: Free Press. 

Spelman, W. 1995a. “Criminal Careers of Public 

Places.” In J.E. Eck and D. Weisburd (eds.), Crime 

and Place (vol. 4, pp. 115–144). Monsey, NY: Criminal 

Justice Press. 

Spelman, W. 1995b. “Once Bitten, Then What? 

Cross-Sectional and Time-Course Explanations of 

Repeat Victimization.” British Journal of Criminology, 

35, 366–383. 

Stedman, J., and D.L. Weisel. 1999. “Finding and 

Addressing Repeat Burglaries.” In C.S. Brito and 

T. Allen (eds.), Problem-Oriented Policing: CrimeSpecific Problems, Critical Issues and Making POP 

Work (vol. 2, pp. 3–28). Washington, DC: Police 

Executive Research Forum. 

Taylor, R.B. 1997. “Social Order and Disorder of Street 

Blocks and Neighborhoods: Ecology, Microecology 

and the Systematic Model of Social Disorganization.” 

Journal of Research in Crime and Delinquency, 34(1), 

113–155. 

13 
SPECIAL REPORT / AUG. 05 

Taylor, R.B. 2000. Breaking Away from Broken 

Windows: Baltimore Neighborhoods and the 

Nationwide Fight Against Crime, Grime, Fear, and 

Decline. Boulder, CO: Westview Press. 

Taylor, R.B., S.D. Gottfredson, and S. Brower. 1984. 

“Block Crime and Fear: Defensible Space, Local 

Social Ties, and Territorial Functioning.” Journal of 

Research in Crime and Delinquency, 21, 303–31. 

Weisburd, D., and L. Green. 1994. “Defining the 

Street Level Drug Market.” In D.L. MacKenzie and C. 

Uchida (eds.), Drugs and Crime: Evaluating Public 

Policy Initiatives. Thousand Oaks, CA: Sage 

Publications. 

Weisburd, D., and L. Green. 1995. “Policing Drug Hot 

Spots: The Jersey City Drug Market Analysis 

Experiment.” Justice Quarterly, 12(4), 711–736. 

Wilson, J.Q., and G.L. Kelling. 1982. “Broken 

Windows: The Police and Neighborhood Safety.” 

Atlantic Monthly, March, 29–38. 

14 
Chapter 2. Methods and Techniques for 

Understanding Crime Hot Spots 

Spencer Chainey, Jill Dando Institute of Crime Science, University College London 

This chapter presents a number of methods and techniques to understand and 

describe patterns of hot spots in crime 

data. It explains the advantages and disadvantages of certain techniques, focusing 

on methods that are easy to understand 

and practical to apply. Four data sets are 

used to test the methods. The results help 

evaluate how the methods improve understanding of crime patterns. This chapter 

does not attempt to find the optimal 

method. Rather, it presents a procedure 

for applying a number of complementary 

methods that can help analysts understand hot spots in the data. 

The four data sets are from the London 

Metropolitan Police Force’s Crime Report 

Information System for Hackney Borough 

Police for the period June 1999 through 

August 1999. This chapter contains tests 

developed and conducted to help analysts 

understand hot spots in representative 

samples of crime data sets of— 

■ All crime (9,972 records) and three 

subsets. 

■ Street robbery (588 records). 

■ Residential burglary (1,068 records). 

■ Vehicle crime (1,747 records). 

The geographic area for these data is 

insignificant to explain the different methods for trying to understand crime hot 

spots. The data should be treated merely 

as point events of crime within a geographical boundary area. In some cases, 

these points will be aggregated to small 

area geographies such as beats or census 

blocks to demonstrate the applicability of 

certain techniques. The methods discussed and tested on these data are perfectly applicable to analysts’ own data. 

Preliminary global 

statistical tests 

A number of simple-to-use global statistical tests can be used to help analysts 

understand general patterns in the crime 

data presented here. These tests 

include— 

■ Mean center. 

■ Standard deviation distance. 

■ Standard deviation ellipse. 

■ Tests for clustering. 

Mean center 

The mean center point can be used as a 

relative measure to compare spatial distributions between different crime types or 

against the same crime type for different 

periods of time (i.e., for measuring spatial 

shifts in the same crime type). For example, exhibit 1 shows the mean center 

points for all crime, street robbery, residential burglary, and vehicle crime. The allcrime mean center can be used as a 

control to compare against crime type 

subsets. Residential burglary has a mean 

center that is more north than all crime 

15 
SPECIAL REPORT / AUG. 05 

and the two other crime subsets. The 

mean center for vehicle crime is the farthest south of all the crime types, and 

street robbery is nearly as far north as that 

for residential burglary but slightly farther 

west. These mean centers can be used to 

generally indicate that residential burglary 

and robbery offenses show a greater tendency to occur in the northern part of the 

borough and that vehicle crime affects the 

southern areas of the borough more. 

Standard deviation distance 

Measures of standard deviation distance 

help explain the level and alignment of dispersion in the crime data. These statistics 

are best used as relative measures, comparing crime types against each other or 

the same crime types for different periods 

of time. Exhibit 2 shows the standard deviation distances for the four crime types. 

The greater the standard deviation distance, the more dispersed are the crime 

data. These results show that vehicle 

crime is the most dispersed; robbery is 

the least. 

Standard deviation ellipses 

Levels of dispersion also can be presented 

using standard deviation ellipses. The size 

and shape of the ellipse help explain the 

degree of dispersion, and its alignment 

helps to explain the crime type’s orientation. Exhibit 3 shows standard deviation 

ellipses for the four crime types. The subtle differences between the ellipses help 

describe the relative differences in dispersion and alignment of the four crime 

types’ patterns. The ellipse with the smallest area (robbery) is the least dispersed of 

the crime types. The position of the robbery ellipse farther north of all crime and 

vehicle crime, but slightly farther south of 

the residential burglary ellipse, reflects its 

Exhibit 1. Mean center points for the four crime categories 

All crime 

Street robbery 

Residential burglary 

Vehicle crime 

Borough boundary 

16 
MAPPING CRIME: UNDERSTANDING HOT SPOTS 

Exhibit 2. Standard deviation distance results for 

the four crime categories 

Standard deviation distance 

Crime type (meters) 

All crime 1,807.94 

Robbery 1,749.94 

Residential burglary 1,806.28 

Vehicle crime 1,820.85 

mean center. Its north-west, south-east 

orientation also helps to describe the general direction toward which robbery crimes 

have a tendency to be patterned. 

Tests for clustering 

The fourth and probably most useful of the 

preliminary global statistics are those that 

test for clustering. Crime analysts often 

assume that crime distributions are clustered, and whether clusters exist or not, 

some can be identified from random crime 

distributions. Testing for clustering is the 

first step in revealing whether data has hot 

spots of crime. 

Several approaches can be applied to test 

for clustering in crime distributions. Most 

methods incorporate the basic principles 

of hypothesis testing and classical statistics, in which the initial assumption is that 

the crime distribution is one of complete 

spatial randomness (CSR). By setting the 

CSR assumption as the null hypothesis, 

the crime distribution can be compared 

against a set significance level to accept or 

reject the null hypothesis. Some tests for 

clustering are the nearest neighbor index 

and the spatial auto correlation tests. 

Nearest neighbor index (NNI). The NNI 

is a simple and quick method to test for 

Exhibit 3. Standard deviation ellipses for the four crime categories 

All crime


Robbery


Residential burglary


Vehicle crime


17 
SPECIAL REPORT / AUG. 05 

evidence of clustering. The NNI test compares the actual distribution of crime data 

against a data set of the same sample 

size, with random distribution. It can be 

applied when the user has access to data 

in which each point relates to individual 

crime events (irrespective of whether 

some of these events are mapped on top 

of each other at exactly the same location). The NNI method is explained in the 

following steps: 

■ For each point, calculate the distance to 

the nearest neighbor point. 

■ Sum the nearest neighbor distance for 

all points and divide by the number of 

points in the data. This value is the 

observed average nearest neighbor 

distance. 

■ Create a random distribution of the 

same number of crime points covering 

the same geographic area, and for each 

point calculate the distance to each 

nearest neighbor point. 

■ Calculate the sum of the nearest neighbor distances for all these randomly 

distributed points and divide by the 

number of points in the data. This value 

is the average random nearest neighbor 

distance. 

■ The NNI is then the ratio of the 

observed average nearest neighbor distance against the average random nearest neighbor distance. 

If the result generated from the NNI test is 

1, then the crime data are randomly distributed. If the NNI result is less than 1, 

then the crime data show evidence of 

clustering. An NNI result that is greater 

than 1 reveals evidence of a uniform pattern in crime data. 

Exhibit 4 shows the NNI results for the 

four crime data sets. All four sets show 

evidence of clustering in their distribution. 

The results also show the differences 

between the NNI results for a minimum 

bounding rectangle area and the actual 

catchment area of the crime points. When 

the actual catchment area is known or can 

easily be calculated, it should be used in 

the calculation of the NNI. If the area is 

not known, a minimum bounding rectangle around the crime distribution often is 

used to calculate the area representing 

the crime data’s catchment zone. 

However, minimum bounding rectangle 

areas used for NNI tests often can create 

misleading results for describing point distributions. To test and show evidence of 

this, analysts purposely designed a regular 

distribution of points and applied three different types of bounding areas: minimum 

bounding rectangle, bounding convex hull, 

and true boundary area. After applying NNI 

tests, the bounding convex hull method 

and true boundary area revealed similar 

results, correctly describing the point 

Exhibit 4. Nearest neighbor analysis results for the 

four crime data sets 

Crime type and 

bounding area* NNI Z-score 

All crime 

Bounding rectangle area 0.32 –129.11 

True boundary area 0.46 –103.14 

Robbery 

Bounding rectangle area 0.59 –19.14 

True boundary area 0.80 –9.20 

Residential burglary 

Bounding rectangle area 0.57 –27.14 

True boundary area 0.74 –16.46 

Vehicle crime 

Bounding rectangle area 0.52 –38.73 

True boundary area 0.72 –22.16 

*Crime distribution is clustered for all areas. 

18 
MAPPING CRIME: UNDERSTANDING HOT SPOTS 

data’s distribution to be regular. The result 

from the minimum bounding area suggested the same distribution to be random. 

Where the true boundary area is not available, a convex hull that bounds the limits 

of the point distribution will return a more 

accurate result for evidence of clustering 

than a minimum bounding rectangle. 

A z-score test statistic can be applied to 

help place confidence in the NNI result. 

This test for statistical significance 

describes how different the actual average 

nearest neighbor distance is from the 

average random nearest neighbor distance. The significance of the z-score can 

be found in any table of standard normal 

deviations. The general rule to follow is 

that the more negative the z-score, the 

more confidence can be placed in the NNI 

result, bearing in mind that for smaller 

sample sizes the z-score will be less than 

that for larger samples of crime points. 

Test for spatial auto correlation. Spatial 

autocorrelation techniques test whether 

the distributions of point events are related to each other. Positive spatial autocorrelation is said to exist where events are 

clustered or where events that are close 

together have similar values than those 

that are farther apart. 

Spatial autocorrelation tests, of which 

Moran’s I is one commonly applied 

method, have been used previously to test 

for evidence of crime event clustering 

(Chakravorty, 1995). Spatial autocorrelation 

techniques require an intensity value, be it 

a weighting linked to the event or a count 

of crimes where the crime point relates to 

the coordinate of an area to which crime 

events have been aggregated (e.g., the 

centroid of the area). If the original crime 

event data exist as accurate point georeferenced data, aggregating this data to a 

common point will lose spatial detail. With 

the increased availability of accurate and 

precise geocoded records of crime, it 

would seem more important to use methods that do not require an intensity value 

but retain and perform tests on the original 

crime event point data. 

Spatial autocorrelation methods include 

the following: ■ Moran’s I. If analysts have access only 

to crime point data that are aggregate 

counts (representing the number of 

crime events within a certain geographic 

area, e.g., census blocks), an appropriate 

method to apply to test for clustering is 

the spatial autocorrelation technique, 

Moran’s I. (See exhibit 5.) Moran’s I statistic works by comparing the value at 

any one location with the value at all 

other locations (Levine, 2002; Bailey and 

Gatrell, 1995; Anselin, 1992; Ebdon, 

1985). Moran’s I requires an intensity 

value for the crime point, which is often 

represented as the centroid of the geographic boundary area. This point is then 

assigned an intensity value. For crime 

applications, this most often is the count 

of crimes within that geographic area. 

The Moran’s I result varies between 

–1.0 and +1.0. Where points that are 

close together have similar values, the 

Moran’s I result is high. The significance 

of the result can be tested against a theoretical distribution (one that is normally 

distributed) by dividing by its theoretical 

standard deviation. (For more details on 

this test, see Levine, 2002.) 

■ Geary’s C statistic. A second spatial 

autocorrelation method is Geary’s C 

statistic. (See exhibit 5.) This method is 

best applied to describe differences in 

small neighborhoods. (Moran’s I gives 

more of a global indicator of spatial relationships; Levine, 2002). Geary’s C statistic is a measure of the deviations in 

intensity values of each point with one 

another. The values of C typically vary 

between 0 and 2, where values less 

than 1 indicate evidence of positive 

19 
SPECIAL REPORT / AUG. 05 

spatial autocorrelation and values 

greater than 1 indicate evidence of negative spatial autocorrelation. Similar to 

Moran’s I, the Geary coefficient can be 

tested for significance against a theoretical distribution (one that is normally distributed) by dividing by its theoretical 

standard deviation. 

The differences in the sensitivities of the 

two spatial autocorrelation tests are noted 

in the results on the four crime categories. 

For example, evidence exists of positive 

spatial autocorrelation for robbery at a 

more global level. However, the Geary 

coefficient reveals that at the smaller 

neighborhood level, areas that have a high 

number of robberies are surrounded by 

areas with a low number of robberies. 

The preliminary global statistics reveal a 

wealth of knowledge about the crime data 

even before the mapped distributions are 

explored in detail. The analysts have generated an understanding of the global patterns in the crime data and shown that 

evidence of clustering exists in all of the 

four crime categories. This clustering 

does, however, vary at different scales. 

The dispersion tests have revealed that 

although clustering exists in the data, the 

crime hot spots for vehicle crime are more 

dispersed than any of the other crime categories. These tests, therefore, begin to 

reveal a picture of what the hot spot maps 

may look like. For example, when the robbery data are mapped, analysts can expect 

hot spots of crime to exist and to be concentrated together more than any other 

crime category. 

The following sections explore various 

techniques for mapping crime. These sections mainly use the vehicle crime data set 

to explore the different applications of 

these techniques to help in understanding 

hot spots of crime. 

Crime mapping techniques 

Point mapping 

The most common approach for displaying geographic patterns of crime is point 

mapping (Jefferis, 1999). Point mapping is 

popular mainly because it is a simple digital version of a familiar and traditional 

method of placing pins representing crime 

events onto a wall map. In a digital application, if these individual geographic point 

objects are suitably attributed with information, such as the code describing the 

type, date, and time of offense, sets of 

points meeting particular conditions can 

be simply and quickly selected. These 

selections can then be displayed using 

suitable symbology representing the 

crime category displayed. However, trying 

to interpret spatial patterns and hot spots 

in the crime point data can be difficult, 

particularly if the data sets are large. 

Exhibit 6 shows the 1,747 events of vehicle crime. The large volume of points 

shown on map A makes it difficult to feel 

Exhibit 5. Spatial autocorrelation results for the four crime categories 

Crime type Moran’s I Z-score Geary’s C Z-score 

All crime 0.003116 2.161428 0.979587 –1.635861 

Robbery 0.000660 1.185983 1.022821 3.585178 

Residential burglary 0.002996 2.113746 0.987718 –1.929432 

Vehicle crime 0.006658 3.568309 0.918423 –12.815473 

20 
MAPPING CRIME: UNDERSTANDING HOT SPOTS 

completely confident in identifying the hot 

spots of this particular crime. The preliminary global tests revealed that clusters of 

vehicle crime were evident, but that these 

hot spots were more dispersed than any 

of the other crime types. To demonstrate 

the ambiguity in trying to identify the hot 

spots of crime from this particular data 

set, the analysts asked three crime analysts who were not familiar with the study 

area to draw the location of the top three 

hot spots of vehicle crime on map B. The 

three analysts identified two common 

areas as being hot spots of crime, but the 

areas drawn at these locations differed in 

size and shape. Two hot spots identified by 

analyst 1 are completely different from 

those identified by analysts 2 and 3. 

Which analyst is correct? At this stage it is 

difficult to tell because each hot spot 

drawn is plausible. Not all of those drawn 

will be completely correct. This example 

demonstrates the difficulty in trying to consistently identify crime hot spots from 

point data. Also, at certain locations, what 

appears to be a single crime point may be 

more than one crime point. These points at 

coincident locations are impossible to identify using the point map in exhibit 6. Point 

maps do have their application for mapping 

individual events of crime, small volumes 

of crime, and repeat locations through the 

use of graduating symbol sizes (see exhibit 

7), but they can become less effective for 

identifying hot spots of crime, particularly 

from large data volumes. 

Spatial ellipses 

The application of spatial ellipses for 

attempting to identify crime hot spots 

has a long tradition in crime mapping. 

The Spatial and Temporal Analysis of 

Crime (STAC) software distributed by 

the Illinois Criminal Justice Information 

Exhibit 6. A: Point map of vehicle crime 

B: Three sets of hot spots identified by different analysts

Crime analyst 1


Crime analyst 2


Crime analyst 3


Point hot spots 

A B 

21 
SPECIAL REPORT / AUG. 05 

Authority is one type of available software used for spatial ellipses. The Space 

Analyzer component of STAC works by 

creating standard deviational ellipses 

around crime point clusters. Other spatial 

ellipse techniques include hierarchical clustering and the K-means clustering routine. 

Hierarchical clustering. This method uses 

a nearest neighbor analysis technique to 

identify groups of a minimum number of 

user-defined points. The nearest neighbor 

analysis technique used identifies only 

those points that are closer than expected 

under spatial randomness. The first set of 

ellipses generated through this process is 

referred to as first-order clusters. Grouping 

the first-order clusters can then generate 

second-order ellipses. This process can 

then be repeated until all crime points fall 

into a single cluster or when the grouping 

criteria fails (Levine, 2002). 

K-means clustering. The K-means technique creates a user-defined number (K) of 

ellipses by partitioning the crime point 

data into groupings. The routine finds the 

best positioning of the K centers and then 

assigns each point to the center that is 

nearest. Exhibit 8 shows five ellipses created using the K-means method. The 

method demonstrates how spatial ellipse 

techniques are useful for grouping crime 

point clusters and revealing areas for closer inspection. However, the ellipse outputs 

also demonstrate certain weaknesses in 

these types of techniques if analysts are 

trying to accurately identify the location of 

crime hot spots. Crime hot spots do not 

naturally form spatial ellipses. These 

Exhibit 7. Properties with multiple breakins (January 1996–July 1997) 

6 to 10


4 to 6


3


2


22 
MAPPING CRIME: UNDERSTANDING HOT SPOTS 

methods, therefore, do not represent the 

actual spatial distribution of crime and can 

often mislead the analyst to focus on 

areas of low crime importance within an 

ellipse. Also, all of these techniques 

require a thorough understanding of the 

routines at work because each method 

requires a number of parameters to be 

entered. Users with a vague understanding of the actual methods are given few 

rules to enter appropriate parameters, 

thus introducing ambiguity and influencing 

variability in the final output. For example, 

different crime analysts investigating crime 

hot spots from the same data may produce different results because of the different parameters they have chosen to 

enter into the routine. Grouping events 

into elliptical clusters also excludes from 

any visual result those events that do not 

belong to a cluster. 

Four of the five ellipses drawn using the 

K-means method partially overlap the hot 

spot areas drawn by the three crime analysts from the point map. One ellipse differs completely from an area identified by 

analyst 1. At this stage it is difficult to 

understand which one is correct or which 

method returns more accurate results. 

Both methods are plausible and importantly present the opportunity to explore the 

nature of crime in these areas in more 

detail. However, neither method presents 

the immediate opportunity to prioritize the 

main crime hot spots to assist in prevention targeting. 

Thematic mapping of 

geographic boundaries 

A popular technique for representing any 

spatial distribution is geographic boundary 

thematic mapping. These geographic 

boundaries usually are defined administrative or political areas such as beats, census blocks, polling districts, wards, or 

borough boundaries. Crime events 

mapped as points can be aggregated to 

these geographic region areas. These 

counts of events by their geographic areas 

can then be thematically mapped to display the spatial pattern of crime across the 

area of interest (see exhibit 9). 

When thematic maps of this type are created, the user is required to identify the 

type of range to represent the distribution 

Exhibit 8. K-means elliptical clusters for vehicle crime 

23 
SPECIAL REPORT / AUG. 05 

of crime (e.g., equal count, equal ranges, 

natural break, standard deviation, quantile, 

or custom range; for a good review of 

these different types of range settings, 

see Harries, 1999). This freedom to choose 

a range of any type creates variability in 

any thematic map produced for identifying 

crime hot spots. Different range types 

structure the groupings of geographic 

boundary crime counts into differing 

threshold categories. At what range 

threshold can the crime analyst confidently conclude that geographic boundaries in 

that range and above represent hot spots 

of crime? In other words, when is a hot 

spot a hot spot? 

Considering the theory and application 

behind the map the user is trying to produce and the target audience is important 

at this stage. If the application is to identify the hot spots of crime, the range 

thresholds should be structured to focus 

on revealing the locations of these highvolume crime areas. The analysts also 

should consider structuring the thematic 

ranges in a manner that is easy for the 

audience to understand. The map should 

be the central message and the thematic 

ranges should follow in a logical sequence. 

If the thematic ranges require explanation 

or confuse the audience, the analysts have 

lost the opportunity to present their central message: mapping and displaying 

crime hot spots. Mapping is an iterative 

process. The first map a user produces is 

unlikely to be the one printed or included 

in a report. Decide on the message and 

follow through with this message by testing different settings available for the thematic thresholds. 

Exhibit 9 shows the vehicle crime data 

thematically mapped by census blocks. 

The range created is a custom one that 

follows in a logical and easy-to-understand 

sequence. It identifies those census 

blocks that are grouped in the highest 

crime count categories. From this map, a 

crime analyst was asked to identify those 

areas he believed to be the three main hot 

spots of crime. These are the three hot 

spot areas drawn on the map. Notice how 

these interpreted hot spot areas differ 

from those drawn directly from the point 

data and those identified by spatial 

ellipses. Which map is correct? 

Thematic maps such as the one in exhibit 

9 tend to attract the audience to the 

largest areas shaded in the top threshold 

color range. Therefore, the single census 

block A has been selected as a hot spot as 

it stands out boldly. Census block B has 

not been selected as a hot spot, yet its 

area is one-eighth of that of census block 

A and it has a similar crime count, as it 

features in the top threshold range. This 

reveals a problem with using geographic 

boundary thematic maps to identify hot 

spots of crime. Due to the varying size 

and shape of the census blocks (and most 

Exhibit 9. Vehicle crimes mapped by census tract 

Greater than 15

10 to 15 

5 to 10 

1 to 5 

0 

24 
MAPPING CRIME: UNDERSTANDING HOT SPOTS 

geographic boundaries), thematic shading 

can mislead the audience in identifying 

where the spatial cluster of crime may 

exist. Census block A may contain an area 

with a cluster of crime events. These 

crime events, however, may be evenly 

spread across the whole area of this large 

census block. Thus an actual hot spot in 

this area may not exist. If this was the 

case, the map in exhibit 9 may misinform 

any targeting initiative to hot spots of 

crime identified by this method. 

An additional problem with mapping by 

defined boundaries is that presented by 

the Modifiable Area Unit Problem (MAUP) 

(Bailey and Gatrell, 1995; Openshaw, 

1984), in which changes in the geographic 

boundary areas used to thematically represent the distribution of crime can affect 

and further mislead map interpretation. 

However, the geographic boundary thematic mapping method should not be 

completely discounted. Boundary thematic maps are important map outputs, as the 

areas they represent often are geographic 

regions used for political and administrative purposes. For example, a police 

inspector may have management responsibility for combating crime in a group of 

geographic areas. This inspector will want 

to be informed with general information 

such as the thematic map shown in exhibit 

9. The inspector will also most likely be 

interested in receiving summarized information of patterns that exist in neighboring geographic areas (e.g., a geographic 

boundary thematic map, with a table of 

crime counts by categories for these areas 

of interest). These methods do, therefore, 

have an important application for providing 

summarized management information 

across areas of accountability, but may 

mislead focused crime prevention targeting because of failing to reveal patterns 

within and across the geographic division 

of boundary areas. 

Quadrat thematic mapping 

To get over the problem of varying sizes 

and shapes of geographic administrative 

boundary areas, uniform grids (or 

quadrats) can be drawn across the study 

area and thematically shaded. The unit to 

thematically map could be a count of 

crimes per grid cell or a density value calculated from the count and cell area. If the 

grids are small enough, the analysts can 

then expose if hot spots of crime actually 

exist within large geographic boundary 

areas, while retaining and displaying high 

crime volumes in the smaller geographic 

areas. Exhibit 10 shows a 250-meter (m) 

quadrat thematic map of vehicle crime. 

Similar to the other mapping outputs, a 

crime analyst has drawn areas on the map 

that he interprets as being the three main 

hot spots (shown in blue). Interestingly, 

the quadrat hot spots identified fit closely 

Exhibit 10. 250-m quadrat thematic map 

Greater than 15 

10 to 15 

5 to 10 

1 to 5 

No crime 

Vehicle crimes by 250-m quadrats 

25 
SPECIAL REPORT / AUG. 05 

with a number of the hot spots identified 

from the point map. In addition, notice 

that the census block A identified as a hot 

spot in the geographic boundary thematic 

map (exhibit 9) is not revealed as a hot 

spot using this method. The crimes that 

contributed to the high count in this large 

census block are generally spread across 

the whole geographic region. The quadrat 

method, therefore, appears to offer a 

more accurate method for identifying hot 

spots of crime, particularly where applications for crime prevention targeting are 

required. 

However, the quadrat method still restricts 

analysts to using a defined geographic 

area to represent the size and shape of 

crime hot spots. The restriction of using 

thematically shaded, defined geographic 

grid cells often results in loss of spatial 

detail within each quadrat and across 

quadrat boundaries. This can lead to problems of inaccurate interpretation. The map 

also looks blocky and does not entirely 

invoke interest. A common request to 

address this problem is to reduce the grid 

cell size. All this does is produce a speckled map of small, thematically shaded grid 

cells that fail to draw the user to any firm 

conclusions as to the size, shape, or location of crime hot spots for resource targeting. Also, issues with thematic range 

settings still exist with this method, including those that relate to the MAUP. 

Interpolation and continuous 

surface smoothing methods 

Interpolation. Interpolation is an increasingly popular method for visualizing the 

distribution of crime and identifying hot 

spots. It aggregates points within a specified search radius and creates a smooth, 

continuous surface that represents the 

density or volume of crime events distributed across the area. Common interpolation techniques, such as inverse distance 

weighting, triangulation with smoothing, 

kriging, and splining are all designed to 

use an intensity, population, or ‘z’ value 

taken from sample locations to estimate 

values for all locations between sample 

sites. For example, interpolation techniques are commonly used to create surfaces representing the distribution of 

rainfall, where the values between rain 

gauges are estimated from a function that 

considers the rainfall readings and the distribution of sample sites (i.e., rain gauges). 

With crime data, sample sites with an 

intensity value do not necessarily exist. 

Neither would it make sense to apply one 

of these techniques to estimate the number of crimes that may have occurred 

between the existing crime point locations. No crimes have been recorded in 

the areas between crime points, so the 

analysts should avoid methods that aim to 

create estimated intensity values in the 

gaps between the points. Instead, surfaces that the analysts wish to create that 

represent the distribution of crime should 

act as visualizations for helping them 

understand crime patterns. Methods that 

suit the analysts’ application should therefore represent, as a continuous surface, 

the relationships or densities between 

crime point distributions. 

Quartic kernel density estimation. The 

most suitable method for visualizing crime 

data as a continuous surface is quartic kernel density estimation (Chainey et al., 

2002; McGuire and Williamson, 1999). The 

quartic kernel density method creates a 

smooth surface of the variation in the density of point events across an area. The 

method is explained in the following steps: 

1. A fine grid is generated over the point 

distribution (see exhibit 11). In most 

cases, the user has the option to specify 

the grid cell size. 

2.A moving three-dimensional function of 

a specified radius visits each cell and calculates weights for each point within the 

kernel’s radius (see exhibit 12). Points 

26 
MAPPING CRIME: UNDERSTANDING HOT SPOTS 

closer to the center receive a higher 

weight and therefore contribute more to 

the cell’s total density value. 

3.Final grid cell values are calculated by 

summing the values of all circle surfaces 

for each location (see exhibit 13). 

The quartic kernel estimation method 

requires two parameters to be set prior to 

running. These are the grid cell size and 

bandwidth (search radius). Bandwidth is 

the parameter that will lead to most differences in output when varied. Guidelines 

exist for working out suitable values for 

these two parameters. For crime mapping 

applications, a suitable method to follow 

for choosing bandwidth is that suggested 

by Williamson et al. (1999), where the 

bandwidth relates to the mean nearest 

neighbor distance for different orders of K. 

These nearest neighbor distances for different orders of K usually are calculated as 

Exhibit 11. A fine grid is placed over the area 

covered by the crime points 

Source: Ratcliffe, 1999a. 

Exhibit 12. A search radius (or bandwidth) is 

then selected 

Source: Ratcliffe, 1999a. 

Note: Within the bandwidth, intensity values for each point are 

calculated. Points are weighted, so that incidents closer to the 

center contribute a higher value to the cell’s intensity value. 

Exhibit 13. Grid cell values are calculated 

Kernel Density Estimates 

Summing of Quartic Kernel Function 

Density 

0.18 

0.16 

Kernal density estimate 0.14 

0.12 

0.10	 Quartic functions 

over individual points 0.08 

0.06 

0.04 

0.02 

0 

0 1 2 3 4 5 6 7 8 9 1011121314151617181920 

Relative location 

Source: Levine, 2002.


Note: Each grid cell value is the sum of values of all circle surfaces for each location.


27 
SPECIAL REPORT / AUG. 05 

part of the nearest neighbor analysis test 

for clustering. If this method is adopted, 

the user is still required to choose which K 

order to apply. This can be regarded as an 

advantage of the technique because users 

are prompted to think about the data they 

are mapping and apply the K order’s mean 

nearest neighbor distance as the bandwidth relevant to their crime mapping 

application. For example, a smaller bandwidth would be used for an application 

that requires output for focused police 

patrolling than for one that requires a more 

strategic view of crime hot spots. 

Users also are required to specify a grid 

cell size. This can be regarded as a positive 

feature in kernel estimation because users 

have the flexibility to set sizes relevant to 

the scale at which the output will be 

viewed. Large cell sizes will result in more 

coarse or blocky-looking maps but are fine 

for large-scale output, while smaller cell 

sizes add to the visual appeal of the continuous surface produced but may create 

large file sizes. When unsure of the cell 

size, the user can follow the methodology 

of Ratcliffe (1999b), who divides the shorter side of the minimum bounding rectangle (or the shortest of the two extents 

between minimum X/maximum X or minimum Y/maximum Y) by 150. Cell size for 

the area that the data cover has been set 

to 30 m. The cell values generated from 

quartic kernel estimation also are in meaningful units for describing crime distributions (e.g., the number of crimes per 

square kilometer). Exhibit 14 shows the 

quartic kernel density estimation surface 

generated from the vehicle crime point 

data, where the bandwidth chosen was a 

K order of 16 (220 m). 

The quartic kernel density estimation 

method creates understandable grid cell 

value outputs that relate to crime and 

requires fewer parameters to be set than 

those required for many other methods. 

The parameters entered can relate to the 

spatial distribution of the points being analyzed. The method also has the advantage 

of deriving crime density estimates based 

on calculations performed at all locations 

(Levine, 2002), and retains some practical 

flexibility in map design. 

The increased application of this type of 

continuous surface smoothing method is 

due largely to its more common availability 

and visual appeal. Continuous surface hot 

spot maps allow for easier interpretation 

of crime clusters and reflect more accurately the location and spatial distribution 

of crime hot spots. The quartic kernel density estimation method also considers 

concentrations of crime at all event levels, 

rather than cluster grouping some and discounting others. As their appeal has 

increased, however, few questions are 

Exhibit 14. Quartic kernel density estimation 

surface for vehicle crime using a bandwidth of 

220 m (K16) 

Highest intensity 

Lowest intensity 

28 
MAPPING CRIME: UNDERSTANDING HOT SPOTS 

being asked of the outputs generated. The 

issue over which thematic range to choose 

to represent the different thematic thresholds remains a problem. Many agencies 

often fail to question this validity or statistical robustness of the map produced, 

being caught instead in the visual lure of 

their sophisticated looking geo-graphic. 

Thus, little regard is given to the legend 

thresholds that are set to help the analyst 

decide when a cluster of crimes can be 

defined as a hot spot. For example, the 

number of hot spots on a map showing 

the distribution of crime as a kernel density surface depends on the ranges selected 

by the map designer to show spatial concentrations of these point events. Careful 

selection of range settings is therefore 

required, but this opens the opportunity 

for crime analysts to create different kernel density estimation hot spot maps of 

crime from the same data. 

One method that has been suggested to 

help standardize the thematic threshold 

settings of kernel density estimation hot 

spot maps is the application of incremental multiples of the grid cells’ mean 

(Chainey et al., 2002). Calculations for the 

mean are applied only to grid cells that 

have a value of greater than 0 and that are 

within the study area boundary. From this 

grid cell set, the mean can easily be calculated within a geographic information system (GIS) with grid cell thematic 

thresholds set at— 

■ 0 to mean. 

■ Mean to 2 mean. 

■ 2 mean to 3 mean. 

■ 3 mean to 4 mean. 

■ 4 mean to 5 mean. 

■ Greater than 5 mean. 

Exhibit 15 shows the application of this 

incremental mean threshold approach for 

vehicle crime. The method is visually 

appealing and structures the thematic 

thresholds to clearly identify areas of highest crime concentration. It is simple to 

apply because it requires only the calculation of the grid cell mean; it uses K order 

mean nearest neighbor distances to 

define bandwidths; it retains flexibility in 

map design by allowing the user to apply 

different K order bandwidths and grid cell 

sizes to the suited application; and it uses 

a consistent methodology to separate thematic thresholds. 

As a statistic, the mean is an easy value 

for novice map readers to understand. 

Increments of the mean would be more 

obviously linked to increasing values and 

their relative significance. This makes the 

incremental mean threshold approach 

immediately appealing as a method to 

define crime hot spot legend thresholds. 

Exhibit 16 shows the results of applying 

this hot spot threshold approach, based on 

quartic kernel density estimation surfaces, 

to the robbery and residential burglary 

data. The incremental mean legend threshold approach consistently defines mapped 

crime hot spots. In addition, the analysts 

can now observe the global descriptions 

calculated earlier and see that they match 

the crime hot spot mapping output. The 

kernel surface hot spot maps for vehicle 

crime, robbery, and residential burglary 

display areas of crime clustering, and 

when compared against each other show 

relative levels of dispersal. For example, 

the hot spot maps of vehicle crime show a 

greater degree of dispersion compared to 

that of robbery. 

Local indicators of spatial 

association statistics 

A more advanced method to help understand hot spots of crime is the application 

of local indicators of spatial association 

(LISA) statistics (Anselin, 1995; Getis and 

29 
SPECIAL REPORT / AUG. 05 

Ord, 1996). LISA statistics assess the local 

association between data by comparing 

local averages to global averages. For this 

reason they are useful in adding definition 

to crime hot spots and placing a spatial 

limit on those areas of highest crime event 

concentration (Ratcliffe and McCullagh, 

1998). One of the more applied LISA statistics on crime point events is the Gi* statistic (see Ratcliffe and McCullagh, 1998, 

for more details). 

The Gi* statistic is applied to a grid cell 

output, such as a quartic kernel density 

estimation map, from which local associations are compared against the global 

average. The user typically is required to 

enter a search distance within which local 

associations are explored and a significance level is related to the confidence in 

the final output. The search distance usually is set to three times the grid cell size of 

the original kernel estimation surface (i.e., 

for data in this chapter, the search distance was set to 90 m). Although levels in 

significance can often range between 99.9 

percent, 99 percent, and 95 percent, this 

range has far less effect over eventual hot 

spot areas than parameters set for grid 

cell size or bandwidth (Ratcliffe, 1999b). 

The most common significance level to 

apply is 99.9 percent. 

Exhibit 17 shows the result of the Gi* 

LISA statistic (mapped as grey areas) for 

robbery. This LISA output has been 

Exhibit 15. Crime hot spot thresholds for vehicle crime 

A: Bandwidth 62 m (K2)

B: Bandwidth 138 m (K7)

Greater than 5 mean 

4 mean to 5 mean 

3 mean to 4 mean 

2 mean to 3 mean 

Mean to 2 mean 

0 to mean 

A B 

30 
MAPPING CRIME: UNDERSTANDING HOT SPOTS 

mapped with the quartic kernel density 

estimation surface generated using a 

bandwidth of 117 m (K2). The map shows 

the matching between this LISA output 

and kernel value results above the 3-mean 

threshold. This LISA output adds definition 

to the quartic kernel density estimation, 

indicating the level at which hot spots can 

be more clearly distinguished from other 

levels of crime concentration. 

Additional elements 

to consider 

All the methods described above consider 

volume crime patterns and do not consider 

any underlying population distribution. 

Therefore, in certain cases, such as hot 

spot maps for residential burglary, the 

crime hot spots may simply be displaying 

locations of high housing density. Rate 

maps can be created to take account of 

the underlying population distribution. For 

residential burglary, maps that consider 

the underlying housing distribution can be 

generated by calculating a rate of burglaries per certain number of households 

(e.g., burglaries per 1,000 households). 

The most reliable housing counts available 

usually are those sourced from the population census. The household counts usually 

are collected at the census block level, 

thus allowing the analysts to generate 

maps representing the distribution of residential burglary by their rates. However, 

Exhibit 16. Quartic kernel density estimation hot spot maps for robbery and residential burglary using the 

incremental mean approach 

A: Robbery: Bandwidth 207 m (K6)

B: Residential burglary: Bandwidth 161 m (K6)

Greater than 5 mean 

4 mean to 5 mean 

3 mean to 4 mean 

2 mean to 3 mean 

Mean to 2 mean 

0 to mean 

A B 

31 
SPECIAL REPORT / AUG. 05 

although the underlying spatial distribution 

of housing is considered, the hot spot 

maps generated still suffer from the problems described in the section on geographic boundary thematic maps. 

Also, suitable denominators for calculating 

rates rarely are available for other crime 

types, such as robbery and vehicle crime. 

Analysts often use population counts as 

denominators for calculating rates for 

these other crime types. This approach, 

however, may merely create hot spot mapping output that misleads by exaggerating 

the crime problem in town centers that 

have few residents but a concentration of 

crimes such as robbery and vehicle crime. 

Ideally, it is preferable to use denominators that are directly relevant to the crime 

type for which the analysts wish to create 

a rate. In the case of residential burglary, 

analysts usually have this with census 

tract household counts. 

Suitable denominators for calculating rates 

for other types of crime are rarely available. For robbery, a suitable denominator 

for calculating rates would be pedestrian 

counts for the area; for vehicle crime, a 

suitable denominator would be vehicle 

counts. The analysts would also wish to 

access these counts at a more precise 

source, such as point sample locations 

from which estimations at unsampled 

locations could be interpolated. This would 

then allow the analysts to be more flexible 

in the area rate calculation by not restricting them to counts aggregated to geographic boundary areas of varying sizes 

and shapes. 

Exhibit 17. Robbery quartic kernel density estimation surface (117 m (K2) bandwidth) and Gi* LISA statistic 

output (grey areas) derived from this robbery surface 

Greater than 5 mean 

4 mean to 5 mean 

3 mean to 4 mean 

2 mean to 3 mean 

Mean to 2 mean 

0 to mean 

32 
MAPPING CRIME: UNDERSTANDING HOT SPOTS 

In the United Kingdom, several local 

authority and police forces have access to 

local property gazetteers. These are pointspecific geographic records of all properties across the local authority area. Every 

property across the local authority area 

has a unique record that can be mapped 

exactly (within 1 meter) to the property 

location. These records often also describe 

property use (e.g., residential or nonresidential). When a local property gazetteer 

such as this exists, crime analysts can use 

accurate point-based records of the distribution of residential properties to create 

continuous surface crime rate hot spot 

maps that consider both the point-based 

distribution of crime and the point-based 

underlying residential property distribution. 

Variations in time 

Each hot spot map considered in this 

chapter accounts only for a specific snapshot period in time. New areas of research 

are beginning to explore space-time interaction (Ratcliffe and McCullagh, 1998) and 

the use of test statistics such as those 

devised by Knox and Mantel (see Bailey 

and Gatrell, 1995). These methods aim to 

reveal whether certain types of crime display temporal hot spots in particular areas 

(e.g., crime hot spots that emerge only on 

certain days of the week). A step that 

many crime analysts already have taken in 

this direction is the creation of crime hot 

spot animations to visualize space and 

time interaction. Each frame produced for 

the animation is itself a hot spot map that 

is then knitted to a time sequence of other 

hot spot maps to produce a series that 

can be displayed as an animation. (For an 

example of a hot spot map animation, visit 

http://www.crimereduction.co.uk/toolkits/ 

fa020405.htm). Animated hot spot maps 

are very alluring, but require direct application if they are not to be merely gimmicks 

of the crime mapping trade. 

Conclusion 

The methods and techniques in this chapter have indicated how crime analysts can 

examine crime-related data to visualize 

and understand crime hot spots. 

Preliminary global statistics have shown 

how simple-to-apply tests can reveal an 

understanding of what is to be expected 

in a hot spot map, even before the map 

has been created. Tests for clustering are 

particularly important. Analysts may waste 

valuable resource time in their attempts to 

create a crime hot spot map if a test such 

as the NNI quickly reveals that no clusters, 

and thus no hot spots, exist in their data. 

The different mapping techniques have 

revealed the different applications to which 

they are suited and demonstrated the 

advantages and disadvantages in their 

underlying routines and the mapping outputs they generate. The kernel density 

estimation method in particular has been 

demonstrated as being more than just a 

method that presents an attractive map of 

crime, but is a more robust technique suited to understanding spatial patterns of 

crime hot spots. 

Also important to remember is that map 

production is an iterative process. The first 

map produced is very rarely the one presented to the target audience. The intended message should also be seen as the 

driving force behind what the map should 

look like. Map creation and design requires 

flexibility. Methods and techniques 

described in this chapter retain this flexibility but suggest some simple-to-apply operations that help to understand crime hot 

spots. 

References 

Anselin, L. 1992. SpaceStat: A Program for the 

Statistical Analysis of Spatial Data. Santa Barbara, 

CA: National Center for Geographic Information and 

Analysis, University of California. 

33 
SPECIAL REPORT / AUG. 05 

Anselin, L. 1995. “Local Indicators of Spatial 

Association—LISA.” Geographical Analysis, 27(2), 

93-115. 

Bailey, T.C., and A.C. Gatrell. 1995. Interactive Spatial 

Data Analysis. Harlow, England: Longman Publishers. 

Chainey, S.P., S. Reid, and N. Stuart. 2002. “When Is 

a Hotspot a Hotspot? A Procedure for Creating 

Statistically Robust Hotspot Maps of Crime.” In 

Innovations in GIS 9. London: Taylor & Francis. 

Chakravorty, S. 1995. “Identifying Crime Clusters: 

The Spatial Principles.” Middle States Geographer, 

28, 53–58. 

Ebdon, D. 1985. Statistics in Geography. Oxford, 

England: Blackwell Publishers. 

Getis, A., and J.K. Ord. 1996. “Local Spatial 

Statistics: An Overview.” In P. Longley and 

M. Batty (eds.), Spatial Analysis: Modelling in 

a GIS Environment. Cambridge, England: 

GeoInformation International, 261–277. 

Harries, K. 1999. Mapping Crime: Principle and 

Practice. Washington, DC: U.S. Department of 

Justice, National Institute of Justice. 

Jefferis, E. (ed.) 1999. A Multi-Method Exploration 

of Crime Hot Spots: A Summary of Findings. 

Washington, DC: U.S. Department of Justice, 

National Institute of Justice, Crime Mapping 

Research Center. 

Levine, N. 2002. CrimeStat 2.0, A Spatial Statistics 

Program for the Analysis of Crime Incident Locations. 

Houston, TX: Ned Levine & Associates and 

Washington: DC: U.S. Department of Justice, 

National Institute of Justice. http://www.icpsr.umich. 

edu/NACJD/crimestat.html 

McGuire, P.G., and D. Williamson. 1999. “Mapping 

Tools for Management and Accountability.” Paper presented to the Third International Crime Mapping 

Research Center Conference, Orlando, Florida, 

December 11–14, 1999. 

Openshaw, S. 1984. “The Modifiable Areal Unit 

Problem.” Concepts and Techniques in Modern 

Geography, 38, 41. 

Ratcliffe, J. 1999a. “Spatial Pattern Analysis Machine 

Version 1.2 Users Guide.” http://jratcliffe.net/ware 

/index.htm 

Ratcliffe, J. 1999b. “Hotspot Detective for MapInfo 

Helpfile Version 1.0.” http://jratcliffe.net/ware/ 

index.htm 

Ratcliffe, J., and M.J. McCullagh. 1998. “Hotbeds of 

Crime and the Search for Spatial Accuracy.” Paper 

presented to the Second Crime Mapping Research 

Center Conference: Mapping Out Crime, Arlington, 

Virginia, December 10–12, 1998. 

Williamson, D., S. McLafferty, V. Goldsmith, J. 

Mallenkopf, and P. McGuire. 1999. “A Better Method 

to Smooth Crime Incident Data.” ESRI ArcUser 

Magazine, January–March, 1–5. http://www.esri.com/ 

news/arcuser/0199/crimedata.html 

34 
Chapter 3. Spatial Analysis Tools for 

Identifying Hot Spots 

James G. Cameron, Merkle Direct Marketing, and Michael Leitner, Assistant Professor, 

Department of Geography and Anthropology, Louisiana State University 

Recent developments in geographic information systems (GIS) and spatial analysis 

applications have significantly improved 

the ability of researchers and analysts to 

look more closely at the spatial patterns 

and locational contexts of crime. As a visualization tool, GIS can be used to integrate 

data from diverse sources into a single 

georeferenced database that contains 

observations from neighboring locations. 

Spatial patterns can then be represented 

and visualized across locations, providing 

insight into potential spatial clustering, 

heterogeneity, and spread over time. As 

an exploratory data analysis tool, GIS spatial analysis applications can be used to 

examine data more rigorously as a way of 

generating new hypotheses from the data 

or identifying unexpected spatial patterns. 

A central concern of hot spot analyses of 

crime is assessing the degree of spatial 

randomness observed in the data. Most of 

the available tools provide different ways 

of determining whether the underlying 

pattern is uniform over space or whether 

significant clusters or other spatial patterns exist, which are not compatible with 

spatial randomness. Thus, simple mapping 

techniques can now be supplemented 

with new methods and applications to 

detect meaningful patterns and associations either as part of an inductive 

approach to visualizing and exploring data 

or as a deductive approach to model building and hypothesis testing. 

This chapter focuses on four of the available tools that can be used to identify 

crime hot spots: ArcView® choropleth 

mapping, ArcView Spatial Analyst, 

CrimeStat®, and GeoDaTM. Each software 

package has particular strengths and 

weaknesses as well as different types of 

applications. This chapter provides an 

overview of these applications and discusses advantages and disadvantages 

encountered in using these tools for different purposes. 

Visualization applications 

Moving beyond the manual pin-mapping 

approaches of the past, desktop GIS technologies have introduced crime analysts to 

new ways of visualizing and mapping 

crime. Specifically, tools for dynamic visualization and mapping in a GIS environment 

make it possible to inductively describe 

and visualize spatial distributions, identify 

unusual observations or spatial outliers, 

and discover patterns of spatial association, including clusters or hot spots. 

This section deals primarily with the application of ArcView choropleth mapping and 

ArcView Spatial Analyst for visualizing hot 

spots and clusters of crime (see Harries, 

1999, for a more extensive look at specific 

issues related to crime mapping in a GIS 

environment). ArcView choropleth mapping 

applications are used for the analysis of 

vector data; Spatial Analyst allows for the 

use and analysis of raster data. Vector data 

represent geographic features as point, 

line, or area features, which are defined 

and processed in terms of discrete X,Y 

coordinates. Raster data represent geographic features as a grid of cells on a continuous surface. Vector data usually can 

represent irregular object boundaries with 

35 
SPECIAL REPORT / AUG. 05 

more precision, but raster data can generally model geographic patterns across continuous space with greater efficiency. 

Choropleth mapping with 

ArcView 

The data for the examples used in this 

chapter consist of burglary incidents from 

the city of Boston for 1999. These crime 

incidents are represented as point locations and have been aggregated up to the 

census tract level to demonstrate different 

types of analyses. 

Choropleth mapping is a common technique for representing data summarized 

by statistical or administrative areas and is 

particularly useful for obtaining a general 

picture of the overall spatial distribution of 

crime. Choropleth maps are primarily used 

in crime mapping applications to show the 

relative density or amount of crime occurring in different areas. This is done by 

assigning graduated colors or varying 

shades across the range of value categories, going from lowest to highest. 

As a first step, examine the general statistical distribution of the data. This can be 

done by plotting a scattergram or histogram of the data and employing basic 

descriptive statistics such as the mean, 

median, range, and standard deviation to 

explore its distribution. Knowing the distribution of the data will help the analyst figure out the best classification scheme to 

use for creating class groupings with similar values. Ideally, the classification 

scheme used should minimize the inner 

class variance as much as possible and 

maximize the variance between classes as 

much as possible. In other words, the 

range of values within each class should 

be more similar to one another, while the 

difference in values between classes 

should be as far apart as possible. 

In addition to user-defined ranges for class 

categories, ArcView provides several 

standard classification scheme options. 

The four most common classification 

methods are natural breaks, quantile, 

equal interval, and standard deviation. The 

default classification option in ArcView is 

natural breaks. In this approach, class categories are identified based on natural 

groupings in the data. Arcview uses a statistical procedure to identify optimal 

groupings so that values within each 

class are more similar and values 

between classes are farther apart. 

Usually, class breaks are set to correspond with relatively large jumps in the 

distribution of values. The quantile classification method assigns an equal number 

of areas to each class. Thus, if 160 census tracts and four classes exist, then 

each class grouping contains 40 census 

tracts, with the lowest 40 in the first 

group and the highest 40 in the last 

group. The equal interval approach divides 

the distribution of values so that the 

range of values within each class is identical. In other words, the difference 

between the highest and lowest value is 

the same for each class grouping. With 

the standard deviation approach, class 

breaks are defined by standard deviational distances from the mean. 

Exhibit 1 illustrates the distribution of burglary rates (per 100,000 population) for 

Boston census tracts in 1999. In this 

example, burglary rates are plotted along 

the horizontal axis and the number of census tracts having burglary rates within 

each category of values is shown on the 

vertical axis. With this data, analysts can 

experiment with different classification 

schemes and see what happens with a 

distribution that is positively skewed (as 

most crime data are). 

Exhibit 2 is a map of burglary rates for 

Boston based on natural break classifications. This method places extreme outliers 

in a category of their own and emphasizes 

the differences between census tracts 

with the highest burglary rates and those 

36 
MAPPING CRIME: UNDERSTANDING HOT SPOTS 

with the lowest rates. With this data, 

using natural breaks appears to be a good 

method for highlighting hot spot clusters 

and outliers in the data. 

Using natural breaks to classify data tends 

to be useful when mapping data values 

that are not evenly distributed, since it 

places value clusters in the same class. 

The disadvantage of using this approach is 

that it is often difficult to make comparisons between maps since the classification scheme used is unique to each data 

set. 

Exhibit 3 is a map of burglary rates for 

Boston based on quantile classifications. 

This method arranges all observations 

from low to high and assigns equal numbers of observations to each classification 

category. This approach is useful when the 

data values are fairly evenly distributed or 

when a need exists to highlight a proportion of the observations. For example, if 

the objective is to show which census 

tracts are in the top 20 percent for burglary 

rates, then the analyst would apply the 

quantile method of classification and 

select five classes. The disadvantage in 

using this approach, especially with positively skewed data, is that differences 

between classes may be exaggerated 

since a few widely ranging adjacent values 

may be grouped together in one class 

while an equal number of relatively homogeneous values may be grouped together 

in another class. 

Exhibit 4 is a map of burglary rates for 

Boston based on equal interval classifications. Using this method, the range of values is the same for each class. This 

approach is useful when data are normally 

distributed and the analyst is interested in 

emphasizing observations around the 

mean. The disadvantage in using this 

method with positively skewed data is that 

most observations will be assigned to the 

lower value categories and only a few 

observations will be assigned to the higher 

Exhibit 1. Burglary rates for Boston census tracts, 1999 

0

20

40

60

80

100

Burglaries per 100,000 population

Rate

0.0500.0 1000.0 1500.0 2000.0 2500.0 3000.0 3500.0 4000.0 4500.0 5000.0 5500.0 6000.0 6500.0 7000.0 7500.0 8000.0 8500.0 9000.0 9500.0

Note: Standard deviation = 875.10; Mean = 812.7; N = 166. 

37 
SPECIAL REPORT / AUG. 05 

value categories. However, when the 

objective is to emphasize outliers with 

high crime rates or hot spot clusters, this 

could be a useful approach to classifying 

and mapping the data. 

Exhibit 5 is a map of burglary rates for 

Boston based on standard deviation classifications. With this method, each class is 

defined by its standard deviational distance from the mean. Again, with positively skewed distributions, outliers and hot 

spot clusters can easily be isolated and 

identified. The disadvantage in using this 

Exhibit 2. Classification using natural breaks 

approach is that the map does not show 

the actual values in each class, only how 

far each class category is from the mean. 

To know which classification scheme to 

use, an analyst needs to know how the 

data are distributed and the mapping 

objective. If the data are unevenly distributed, with large jumps in values or 

extreme outliers, and the analyst wants to 

emphasize clusters of observations that 

house similar values, use the natural 

breaks classification approach. If the data 

are evenly distributed and the analyst 

Burglary rates per 100,000 population

0–420.46

420.46–837.7

837.7–1,726.34

1,726.34–4,605.26

4,605.26–9,578.54

38 
MAPPING CRIME: UNDERSTANDING HOT SPOTS 

wants to emphasize the percentage of 

observations in a given classification category or group of categories, use the quantile classification approach. If the data are 

normally distributed and the analyst wants 

to represent the density of observations 

around the mean, use the equal interval 

approach. If the data are skewed and the 

analyst wants to identify extreme outliers 

or clusters of very high or low values, use 

the standard deviation classification 

approach. 

Exhibit 3. Classification using quantiles 

In the final analysis, although choropleth 

maps are very useful for visualizing spatial 

distributions, using them for hot spot 

analyses of crime has certain disadvantages. First, attention is often focused on 

the relative size of an area, so large areas 

tend to dominate the map. Second, choropleth maps involve the aggregation of data 

within statistical or administrative areas 

that may not correspond to the actual 

underlying spatial distribution of the data. 

In other words, incidents of crime are usually not evenly distributed throughout a 

Burglary rates per 100,000 population

0–429.47

429.47–582.57

582.57–731.71

731.71–957.75

957.75–9578.54

39 
SPECIAL REPORT / AUG. 05 

given administrative area. Consequently, 

the actual distribution of crime incidents 

may be difficult to identify when mapping 

aggregated data. 

ArcView Spatial Analyst 

Although choropleth mapping is a useful 

tool for representing the spatial distribution of aggregated crime data, ArcView 

Spatial Analyst is useful for mapping the 

density of individual crime incidents on a 

continuous surface. Using a raster data 

Exhibit 4. Classification using equal intervals 

structure, Spatial Analyst represents geographic space as a continuous surface that 

is divided into a grid of equally sized 

square cells. Continuous surfaces are created from existing data observations 

through a process called interpolation. In 

the case of crime mapping, this means 

that known crime locations are used to 

estimate the density of crime across a 

continuous surface. Mapping crime density on a continuous surface thus allows the 

analyst to identify where the highest concentrations of crime are taking place. 

Burglary rates per 100,000 population

0–1,915.708

1,915.708–3,831.416

3,831.416–5,747.124

5,747.124–7,662.832

7,662.832–9,578.54

40 
MAPPING CRIME: UNDERSTANDING HOT SPOTS 

Concentrations of crime can sometimes 

be seen simply by mapping the location of 

individual crime incidents. In areas with a 

large amount of criminal activity, however, 

identifying which locations have higher 

concentrations than others may be difficult. To alleviate this problem, Spatial 

Analyst can create density maps, which 

measure the number of crimes occurring 

within a uniform areal unit, such as the 

number of crimes per square mile. This 

makes it easier to see the overall distribution of crime across space so that the 

Exhibit 5. Classification using standard deviations 

analyst can more clearly identify hot spots 

and high-crime clusters. 

To create a density map with Spatial 

Analyst, first calculate a density grid from 

the ArcView point theme containing locations of individual crime incidents. Each 

cell in the grid is assigned a specific size 

and has a circular search area applied to it, 

both of which are defined by the user. Cell 

size determines how coarse or smooth 

the patterns will appear. The smaller the 

cell size, the smoother the density surface 

Burglary rates per 100,000 population

-1–0 Standard deviation

0–1 Standard deviation

1–2 Standard deviation

2–3 Standard deviation

>3 Standard deviation

41 
SPECIAL REPORT / AUG. 05 

will be. However, very small cells also 

require considerably more processing 

time and computer storage space. The 

size of the search radius will determine 

how generalized the density patterns will 

appear. A smaller search radius will show 

more local variation, while a larger search 

radius will show broader patterns in the 

data. Specifying either simple or kernel 

density calculations also is possible. 

Simple density calculations total the number of crime incidents that fall within the 

search area parameter for each cell and 

then divide this number by the search 

area size to get each grid cell’s density 

value. Kernel density calculations, however, give more weight to points near the 

center of the search area than to those 

near the perimeter. This results in a 

smoother distribution of density values 

across cells. 

Thus, the first step is to create a density 

surface map as a raster layer using the 

Spatial Analyst menu interface in ArcView. 

In this way, each grid cell in the raster 

layer will have a density value assigned to 

it based on the number of crime incidents 

within the specified search radius of the 

cell. The map in exhibit 6 represents the 

Exhibit 6. Density map of burglary locations per square mile 

0–29.139

29.139–58.279

58.279–87.418

87.418–116.557

116.557–145.697

145.697–174.836

174.836–203.975

203.975–233.115

233.115–262.254

42 
MAPPING CRIME: UNDERSTANDING HOT SPOTS 

density surface of burglary locations in 

Boston for 1999 and shows burglary incidents per square mile based on kernel 

density calculations. 

The density surface map in exhibit 6 

shows three burglary hot spot locations, 

signified by the darker patterns on the 

map. The analyst might notice a few discrepancies between the hot spot clusters 

identified by the density surface map and 

the hot spot locations identified by the 

choropleth map applications. As noted 

earlier, choropleth maps involve the aggregation of data within statistical or administrative areas that may not correspond to 

the actual underlying spatial distribution of 

the data. This means that any variations in 

the distribution of crime within the aggregated areas are lost during the aggregation process. In contrast to the aggregated 

area patterns represented on choropleth 

maps, the patterns in a density surface 

map are based on the distribution of individual crime events. A density surface is 

therefore able to show with greater spatial 

detail how crime varies across a region. 

Keep in mind, however, that the values in 

the areas between points are estimated 

interpolations. Thus, the more data points 

and the more dispersed they are, the 

more valid the resulting density patterns 

will be. 

Exploratory spatial data 

analysis applications 

Visualization and mapping applications are 

perhaps currently the most familiar use of 

GIS for many crime analysts. Recently, 

however, several tools have been introduced to facilitate more rigorous analyses 

of spatial patterns through the use of 

exploratory spatial data analysis (ESDA) 

procedures. A central feature of ESDA is 

the use of formal statistical tests to 

determine whether crime locations show 

evidence of clustering or are randomly distributed. These include nearest neighbor 

analysis tests for point pattern data and 

spatial autocorrelation tests for aggregated 

data or event data that have intensity values applied to them. 

This section examines two of the available 

software applications for exploratory spatial data analysis: CrimeStat (Levine, 1999) 

and GeoDa. The primary difference 

between the two applications is that 

CrimeStat is used to analyze crime incident location data (point patterns) and 

GeoDa is used to analyze aggregated 

crime data (area patterns). In addition, 

GeoDa has a spatial regression package 

included, but CrimeStat does not have a 

regression module available for modeling 

correlates or determinants of crime. 

CrimeStat 

As a Windows® based program, 

CrimeStat uses a graphical interface for 

database management operations as well 

as for the implementation of a number of 

statistical procedures that can be linked to 

a GIS. The procedures vary from descriptive centrographic applications to more 

sophisticated nearest neighbor and spatial 

autocorrelation statistics. 

The spatial statistics package provided 

with CrimeStat is divided into four 

categories: 

1. Spatial distribution or centrographic statistics: mean center, center of minimum 

distance, standard deviational ellipse, 

and Moran’s I spatial autocorrelation 

index. 

2.Distance statistics: nearest neighbor 

analysis and Ripley’s K statistic. 

3.Hot spot analysis routines: hierarchical 

nearest neighbor clustering, K-means 

clustering, and local Moran statistics. 

43 
SPECIAL REPORT / AUG. 05 

4.Interpolation statistics: kernel density 

estimation routines (see Spatial Analyst 

application discussion earlier in this 

chapter). 

Data files used with CrimeStat are point 

files with X,Y coordinates. These can be 

ASCII, dBase .dbf, or ArcView .shp files. 

Also, intensity values can be associated 

with each point location for spatial autocorrelation tests. 

Centrographic statistics. The first group 

of statistical routines available with 

CrimeStat are centrographic statistics for 

finding the central tendency and overall 

spatial distribution of crime incidents. The 

ones examined here are the mean center 

and the standard deviational ellipse for 

measures of central tendency and dispersion. The mean center identifies central 

location as the arithmetic mean of all incident locations. The standard deviational 

ellipse identifies dispersion as the standard deviation of the distance of each incident location from the mean center as 

well as the direction or orientation of that 

dispersion. The output produced by 

CrimeStat includes tabular summaries 

containing a number of descriptive statistics and graphical objects, which can be 

saved and imported as ArcView shape 

files (or as MapInfo® .mif or AtlasGIS .bna 

files). 

Exhibits 7 and 8 show the mean center 

and standard deviational ellipse for burglary and homicide locations in Boston for 

Exhibit 7. Mean center and standard deviational ellipse for burglaries 

#

1 0 1 2 Miles

44 
MAPPING CRIME: UNDERSTANDING HOT SPOTS 

1999. The mean center for burglary incidents is slightly northwest of the mean 

center for homicides. This indicates that 

homicides are slightly more likely to occur 

in the southeastern part of Boston, while 

burglaries are somewhat more likely to 

occur in the northwest part of the city. 

While the standard deviational ellipses for 

both burglaries and homicides fall essentially along a north-south axis, burglaries 

show a much wider dispersion along the 

east-west axis than homicides. This indicates that homicides tend to occur in a relatively circumscribed area compared with 

burglaries. 

Centrographic statistics can be very useful 

tools for examining general spatial patterns 

of central tendency, spread, and direction 

of dispersion. They represent a first step in 

exploratory spatial data analysis, providing 

a more rigorous feel for the overall distribution of crime. In addition to comparing different types of crime, these tools are 

useful for comparing different groups. For 

example, they may be used to compare 

the spatial distribution of gang and nongang-related homicides. Centrographic 

statistics also are useful for comparing 

spatial shifts, which may occur for the 

same crime across different time periods, 

such as month-to-month comparisons. 

Centrographic statistics, which are used to 

describe global spatial properties and patterns in the data, are known as first-order 

statistics. Second-order statistics describe 

local or neighborhood patterns within the 

Exhibit 8. Mean center and standard deviational ellipse for homicides 

#

101 2 Miles

45 
SPECIAL REPORT / AUG. 05 

overall distribution. In CrimeStat, secondorder statistical tools for identifying characteristics of the distances between 

crime incidents include the nearest neighbor index for point patterns and Ripley’s 

K statistic. 

Distance statistics. The nearest neighbor 

index compares the observed distance 

between each point and its nearest neighbor with the expected distance if the distribution of points were completely 

random. More formally, it is the ratio of 

the observed nearest neighbor distance to 

the mean random distance. In other 

words, the index compares the average 

distance between nearest neighboring 

points with the average distance that 

would be expected on the basis of chance 

alone. If the average distance between 

nearest neighbors is the same as the 

mean random distance, then the ratio is 

equal to 1.0. If the average distance 

between nearest neighbors is smaller than 

the mean random distance, then the index 

is less than 1.0. Nearest neighbor index 

values less than 1.0 would thus provide 

statistical evidence of clustering. 

Exhibit 9 contains the nearest neighbor 

statistics for all burglary locations in 

Boston during 1999. The sample size 

(N=3,851) indicates that 3,851 burglary 

incidents were reported in 1999. The nearest neighbor index is 0.36, thus suggesting a shorter distance between nearest 

neighbors than that expected under randomness, and hence spatial clustering. 

Exhibit 9. Nearest neighbor statistics for burglaries 

in Boston, 1999 (N=3,851) 

Mean nearest neighbor distance 0.02862 miles 

Mean random distance 0.07968 miles 

Nearest neighbor index 0.35913 

Standard error 0.00067 miles 

Test statistic (Z) –76.0831 

This deviation from randomness also is 

significant, as indicated by a Z-value of 

–76.08. 

Ripley’s K function is a higher order nearest neighbor statistic that compares the 

number of points within any given distance to the expected number for a spatially random distribution. It thus provides 

a test of randomness for every distance, 

from the smallest up to the size of the 

study area. CrimeStat calculates 100 distance intervals (called bins) around each 

point location, counts the number of 

crime incidents within each interval, and 

compares this to the expected number for 

a spatially random distribution. If the average number of point locations found within a given distance band is greater than 

that expected under randomness, this 

points to clustering. This empirical count 

is then transformed into a square root 

function called L and is calculated for each 

of the 100 distance intervals (bins). Values 

of L that are greater than the upper limit of 

a simulated random distribution confidence interval indicate clustering. 

Hot spot analysis routines. In addition to 

nearest neighbor applications, CrimeStat 

provides several statistical tools for identifying clusters or hot spots of crime. These 

include hierarchical spatial clustering, Kmeans clustering, and local Moran statistics. Each of these techniques represents 

a slightly different approach to grouping 

crime incident locations into relatively 

coherent spatial clusters. 

Hierarchical clustering is based on a nearest neighbor analysis technique, in which 

crime incident locations are first grouped 

into nearest neighbor clusters containing 

a minimum number of point locations 

specified by the user. These first-order 

clusters are further grouped into larger, 

second-order clusters, and this process 

continues until no more clustering is possible. As with nearest neighbor approaches 

in general, only clusters that are closer 

46 
MAPPING CRIME: UNDERSTANDING HOT SPOTS 

than expected under randomness are 

included at each step. Thus, the criterion 

used for clustering points together is the 

user-specified lower confidence interval 

for a random distribution. 

Exhibit 10 shows a map of burglary hot 

spots for Boston in 1999 (n=3,851) identified by the hierarchical clustering routine in 

CrimeStat. A one-tailed probability level of 

.05 was selected and each cluster was 

required to contain a minimum of 10 burglary incident locations. CrimeStat 

returned 56 first-order clusters and 4 second-order clusters. The locations of the 

second-order clusters coincide with two of 

the three hot spot locations identified on 

the density surface map in exhibit 6. While 

the first-order clusters tend to be more 

scattered, the second-order clusters show 

a clear pattern in the north and western 

parts of the city. 

K-means clustering is a partitioning technique for grouping crime incidents into a 

specific number (K) of clusters specified 

by the user. The default number of clusters 

assigned by CrimeStat is five. The routine 

tries to find the best center (seed location) 

for each K number of clusters specified 

and then assigns each crime incident to 

the client seed location. 

Exhibit 11 shows a map of burglary hot 

spots for Boston in 1999 identified by the 

K-means clustering routine. The map 

shows three relatively concentrated clusters and two that are more dispersed. The 

more concentrated clusters, especially the 

one located in the western arm of the city, 

Exhibit 10. Burglary hot spots using hierarchical clustering 

0 1 2 Miles

47 
SPECIAL REPORT / AUG. 05 

are closer to the hot spot locations identified by other methods. This example highlights one of the disadvantages to using 

the K-means clustering procedure. 

Whether the clusters make any sense will 

depend on how carefully the user has 

selected the criteria to be used in grouping crime locations. Choosing too many 

clusters may result in the identification of 

patterns that do not really exist; choosing 

too few may diminish significant differences that actually do exist between 

neighborhoods. Thus, while the K-means 

procedure provides a great deal of user 

control, this same flexibility can make the 

technique prone to misuse and the results 

difficult to interpret. 

A local Moran procedure approach is 

based on the concept of local indicators of 

spatial association (LISA), in which each 

observation is assigned a score based on 

the extent to which significant clustering 

of similar values around that observation 

exists. In this case, the score assigned to 

each observation is the Moran’s I statistic 

for spatial autocorrelation. Locations with 

high Moran’s I scores have intensity values 

higher than the average value intensity for 

all other observations, while locations with 

low Moran’s I scores have intensity values 

Exhibit 11. Burglary hot spots using K-means clustering 

1 0 1 2 Miles

48 
MAPPING CRIME: UNDERSTANDING HOT SPOTS 

lower than the average value intensity for 

all other observations. The local Moran 

procedure thus provides information about 

the degree of value similarity between 

near neighbors. 

Two conditions must be met in order to 

calculate Moran’s I. First, each observation 

must have a value attached to it. This 

means that an intensity variable must be 

specified in CrimeStat’s primary file menu. 

In this case, the point location is the centroid of each census tract in Boston, and 

the intensity variable is the burglary rate 

(number of burglaries per 100,000 people). 

Second, the neighborhood must be 

defined either as adjacent locations or 

according to distance-based weights. 

Adjacency specifications, in which adjacent locations are given a weight of 1 and 

nonadjacent locations are given a weight 

of 0, are useful for defining near neighborhoods. Distance specifications, in which 

weights are assigned that decrease with 

distance between locations, are useful for 

defining spatial interaction across larger 

areas. The default in CrimeStat is an adjacency specification. 

Exhibit 12 maps the distribution of standardized local Moran Z-values for the spatial autocorrelation of burglary rates across 

Exhibit 12. Spatial autocorrelation of burglary rates: local Moran Z-value 

of census tracts 

LMoran Z-value

Z <= -1.96

Z > -1.96 and Z <= 0

Z > 0 and Z <= 1.96

Z > 1.96

49 
SPECIAL REPORT / AUG. 05 

Boston census tracts in 1999. The pattern 

shows a concentration of high values 

toward the center of the city (shaded in 

darker red). Also, the northwestern part of 

the city contains an outlier (shaded in darker blue). This census tract has a much 

higher burglary rate than its neighbors and 

therefore has a large negative I score, indicating dissimilarity (i.e., negative spatial 

autocorrelation). This example highlights 

the usefulness of the local Moran statistic 

for identifying locations, which are dissimilar from their neighbors. In fact, it is the 

only statistic available in CrimeStat that 

can be used to identify spatial dissimilarity. 

The three clustering techniques available in 

CrimeStat have both advantages and disadvantages. The advantages to using the 

hierarchical clustering technique include 

the ability to identify small geographic 

areas that may have higher concentrations 

of crime activity. This technique also is useful for identifying the linkages between 

several small clusters into second-order 

and higher clusters. The limitations of hierarchical clustering include a certain arbitrariness based on what constitutes a 

meaningful cluster size. Also, the size of 

the grouping area is dependent on the 

sample size. This means that crime distributions with many incident locations (e.g., 

burglaries) will have smaller grouping 

areas, while crime distributions with few 

incident locations (e.g., homicides) will 

have larger grouping areas. 

The advantages of using the K-means 

clustering routine include the ability of the 

user to specify the number of spatial clusters in the data. This feature provides a 

great deal of control and flexibility for the 

user and can be used as an exploratory 

tool to identify different sizes and numbers 

of crime clusters. Yet, this same flexibility 

also can result in a certain arbitrariness, 

which may make the results difficult to 

interpret meaningfully. 

In addition to identifying clusters with high 

concentrations of crime, the local Moran 

procedure is the only clustering tool in 

CrimeStat that also can identify outliers 

(locations that are dissimilar to neighboring 

locations) and clusters with low concentrations of crime. The disadvantage of using 

the local Moran procedure and mapping 

the results is that it requires the data to be 

summarized into zones in order to produce 

the necessary intensity values and then 

linked with comparable zonal boundaries 

in a GIS for mapping. 

GeoDa 

Similar to CrimeStat, GeoDa is a Windowsbased application that is practically a reinvention of the original SpaceStatTM 

package and its ArcView extension, 

DynESDA. GeoDa is a freestanding software that does not require a specific GIS 

and runs under any Microsoft Windows 

operating system. The current version can 

“only” input (output) Environmental 

Systems Research Institute (ESRI) shape 

files. It can analyze objects characterized 

by their location in space as either points 

(point coordinates) or polygons (polygon 

boundary coordinates). 

The program can be downloaded free 

from the University of Illinois at UrbanaChampagne, Spatial Analysis Laboratory 

Web site (http://sal.uiuc.edu/default.php). 

This Web site also includes tutorials and 

other useful information related to the 

software (Anselin et al., forthcoming; 

Anselin, 2004a; Anselin, 2004b). 

GeoDa functions are executed through 

menu items or directly by clicking toolbar 

buttons and can be classified into six 

categories: 

■ Spatial data manipulation and utilities: 

data input, output, and conversion. 

■ Data transformation: variable transformation and creation of new variables. 

50 
MAPPING CRIME: UNDERSTANDING HOT SPOTS 

■ Mapping: choropleth maps, cartogram, 

and map animation. 

■ Exploratory Data Analysis (EDA): statistical graphics. 

■ Spatial autocorrelation: global and local 

spatial autocorrelation with inference 

and visualization. 

■ Spatial regression: diagnostics and maximum likelihood estimation of linear spatial regression models. 

GeoDa was developed around the central 

concept of dynamically linked windows 

(graphics), with different views of the data 

represented as graphs, maps, or tables. 

The map and associated graphs are 

dynamically linked in the sense that when 

observations are highlighted in one view, 

the corresponding observations in the 

other views are highlighted as well. This 

can be combined with GeoDa’s data 

brushing capabilities, together referred to 

as brushing and linking. For example, the 

same observations that are selected in a 

scatter plot by means of a rectangle 

(brush) also are highlighted in a map or 

box plot that are dynamically linked to the 

scatter plot. Similarly, the brush can also 

Exhibit 13. GeoDa simplified menu and toolbar 

be initiated in the map with corresponding 

observations being highlighted in the scatter plot or box plot. This flexibility makes 

both brushing and linking powerful tools 

for interactive exploratory spatial data 

analysis. 

GeoDa provides several statistical applications for doing both exploratory and confirmatory spatial data analysis. Exploratory 

spatial analysis tools include box plot 

maps and percentile maps for outlier 

analysis, global and local indicators of spatial association, LISA local Moran maps, 

and Moran significance maps. Confirmatory spatial analysis tools include OLS 

regression with diagnostics for spatial 

effects, spatial regression residual mapping, and a variety of spatial regression 

applications. This section will examine only 

the exploratory spatial analysis applications provided with GeoDa. 

After the program is launched, the initial 

(simplified) menu appears on the screen in 

addition to a toolbar with only two items 

being active. The first active item opens a 

project (opens an ESRI shape file); the 

second active item closes a project (see 

exhibit 13). 

51 
SPECIAL REPORT / AUG. 05 

After opening the project, a Windows dialog requests the file name of a shape file 

and the Key variable. The Key variable 

uniquely identifies each observation. It is 

typically an integer value such as a Federal 

Information Processing Standards (FIPS) 

code, a census tract number, or a unique 

ID number. Next, a map window is 

opened, showing the base map for the 

analyses. Now the complete menu and all 

toolbars are active, as shown in exhibit 14. 

The full menu bar contains 12 items. Four 

are standard Windows menus: File (open 

and close files), View (select which toolbars to show), Window (select or 

rearrange windows) and Help (not yet 

implemented). Specific to GeoDa are Edit 

(manipulate map windows and layers), 

Tools (spatial data manipulation), Table 

(data table manipulation), Map (choropleth 

mapping and map smoothing), Explore 

(statistical graphics), Space (spatial autoExhibit 14. GeoDa complete menu and toolbar 

correlation analysis), Regress (spatial 

regression), and Options (applicationspecific options). The toolbar consists of 

six groups of icons, from left to right: 

project open and close; spatial weights 

construction; edit functions; exploratory 

data analysis; spatial autocorrelation; and 

rate smoothing and mapping. Some functions can be executed by either clicking 

on one of the toolbar buttons or by 

selecting the matching item in the menu. 

For initial exploratory analyses, box plots 

(exhibit 15), box plot maps (exhibit 16), and 

percentile maps (exhibit 17) can be used 

to describe the overall distribution of crime 

and to identify outliers. With the base map 

shown on the screen in exhibit 14, a box 

plot can be drawn by using Explore ➞ Box 

Plot and selecting the variable to be 

mapped (burglary rates) from the 

Windows dialog. This will display a box 

plot with the census tract burglary rates in 

52 
MAPPING CRIME: UNDERSTANDING HOT SPOTS 

Boston for 1999 (shown as blue dots) sorted from the lowest (bottom of the plot) to 

the highest (top of the plot) value (exhibit 

15). The lowest 25 percent of all burglary 

rates make up the first quartile, followed 

by the next 25 percent of all rates that 

make up the second quartile, and so on. 

The second and the third quartiles are separated by the median (the red bar in the 

middle), which is the middle value of the 

sorted burglary rates. 

In this box plot, an observation is classified as an outlier when it lies more than a 

given multiple of the interquartile range 

(IQR) (the difference in value between the 

75 percent and 25 percent observation) 

above or below respectively for the 75th 

percentile and 25th percentile. The standard multiples used are 1.5 (mild outlier) 

and 3 (extreme outlier) times the IQR. In 

the box plot, the IQR is shown with the 

dark red band around the median. Using a 

Exhibit 15. Box plot of burglary rates 

Upper outliers 

Fourth quartile

Third quartile

Second quartile 

First quartile 

standard multiple of 1.5, the box plot identifies 12 census tracts with very high values of burglary rates (mild, upper outliers). 

There are no mild, lower outliers (very low 

values of burglary rates). 

The corresponding box plot map can be 

drawn by using Map ➞ Box Map ➞ 

Hinge=1.5 and selecting the variable to be 

mapped (burglary rates) from the Windows 

dialog. In the box plot map, the 12 census 

tracts with very high values of burglary 

rates are shown in dark red with a pattern 

that shows a concentration toward the 

center of the city, along with an additional 

outlier in the northwestern part of the city. 

Exhibit 17 contains a percentile map of 

1999 burglary rates at the census tract 

level in Boston. This is accomplished by 

using Map ➞ Percentile and selecting the 

variable to be mapped (burglary rates) 

from the Windows dialog. Two census 

tracts qualify as outliers using the upper 

99th percentile criterion. Compare the 

location of these outliers with those identified by the standard deviational choropleth map in exhibit 5. The additional 

census tract in the standard deviational 

map is due to a 95-percent cut-off point 

for two standard deviations as opposed to 

the 99-percent cut-off point used for the 

percentile map. 

For more rigorous analyses of hot spot and 

clustering patterns, GeoDa provides tools 

for constructing spatial weights and tests 

for the presence of global and local spatial 

autocorrelation. In using a global measure 

of spatial autocorrelation, the overall pattern of spatial dependence or clustering in 

the data is summarized with a single indicator such as Moran’s I. As a global measure of spatial autocorrelation, Moran’s I is 

positive when values for locations in spatial proximity tend to be more similar than 

what is normally expected based on randomness, negative when they tend to be 

more dissimilar than what is normally 

expected, and approximately zero when 

53 
SPECIAL REPORT / AUG. 05 

the attribute values are randomly spread 

over space. 

To calculate the Moran’s I indicator of spatial autocorrelation, the analyst must first 

construct a spatial weights matrix. Spatial 

weights can be defined either by contiguity (where neighbors are identified according to boundary relationships, in which 

1 = adjacent and 0 = nonadjacent) or by 

distance (where neighbors are identified 

according to a distance-based metric 

around centroid locations which decreases 

with distance between locations). In the 

examples presented here, spatial weights 

are calculated based on rook contiguity, in 

Exhibit 16. Box plot map of burglary rates 

First quartile 

Second quartile 

Third quartile 

Fourth quartile 

Upper outliers 

which neighbors are defined as sharing a 

common border. In contrast, queen contiguity defines neighbors that share common borders and/or common corners. 

Creating a rook-based contiguity matrix is 

accomplished by either selecting Tools ➞ 

Create ➞ Weights from the menu or by 

clicking on the matching toolbar button. 

This opens a Windows dialog, in which the 

name of the input file (a polygon shape 

file), the name for the weights file, an ID 

variable for the weights file (a Key variable 

from the input file that uniquely identifies 

each observation), and the type of spatial 

weights matrix (rook contiguity) need to 

54 
MAPPING CRIME: UNDERSTANDING HOT SPOTS 

be specified (see exhibit 18). The resulting 

spatial weights file is stored with the file 

extension GAL. It is a simple text file that 

can be edited with any text editor or word 

processor. 

Once the spatial weights matrix has been 

created, a spatially lagged variable can be 

computed. A spatially lagged variable (or 

spatial lag) is derived as the spatially 

weighted average of its neighboring values. 

A spatial lag is an essential part of the computation of spatial autocorrelation tests and 

the specification of spatial regression models. The spatial lag computation is part of 

the Table functionality in GeoDa. In the 

Exhibit 17. Percentile map of burglary rates 

1–10% 

>10–50% 

>50–90% 

>90–99% 

>99% 

example presented here, a spatially lagged 

variable for 1999 burglary rates in Boston 

will be created. This requires first loading a 

base map and opening a corresponding 

spatial weights file by selecting Tools ➞ 

Weights ➞ Open from the menu or by 

clicking on the matching toolbar button. 

Next, clicking on the Table toolbar button 

and right clicking to select Field 

Calculation from the menu will open a 

Windows dialog. In this Windows dialog, 

select the Lag Operations tab and enter 

the information as shown in exhibit 19. The 

name for the new spatially lagged variable 

(W_BURGRT) is entered into the left most 

text box. The spatial weights file (same as 

55 
SPECIAL REPORT / AUG. 05 

above) is selected for the text box in the 

middle and the variable to be lagged (1999 

burglary rates in Boston) is selected for 

the right most text box (exhibit 19). This 

will add the new spatially lagged variable 

(W_BURGRT) as a new column to the end 

of the Table in GeoDa. 

To briefly illustrate how GeoDa calculates 

the spatially lagged variable for the 1999 

burglary rates in Boston, consider the census tract in the center of the city previously identified as one of two outliers using 

the upper 99th percentile criterion (exhibit 

17). This census tract has a burglary rate of 

9578.54, which is the highest rate among 

all census tracts in Boston in 1999. Eight 

rook neighbors with the following burglary 

rates surround this census tract: (1) 

738.92, (2) 886.77, (3) 937.77, (4) 971.46, (5) 

1622.72, (6) 1952.04, (7) 2434.78, and (8) 

2636.20. The spatially lagged variable is 

simply the average of these eight burglary 

rates, namely 1522.58. 

Positive spatial autocorrelation would indicate cases where the original and the spatially lagged variable have similar values. 

This would point to clustering of high values (hot spots), low values (cold spots), 

and medium values. On the other hand, 

contrasting values between the original 

and its spatial lag indicate negative spatial 

autocorrelation, or the presence of spatial 

outliers. Locations of negative spatial association may indicate areas of high crime 

surrounded by low-crime neighbors (similar 

to the example above), or low crime surrounded by high-crime neighbors. 

Exhibit 18. Windows dialog to create a spatial weights matrix 

56 
MAPPING CRIME: UNDERSTANDING HOT SPOTS 

Global indicators of spatial autocorrelation 

are used to assess the presence and 

range of spatial association. A global 

measure of spatial autocorrelation can be 

calculated in GeoDa by selecting Explore 

➞ Scatterplot from the menu or by clicking 

on the matching toolbar button. In the 

Windows dialog, choose the spatial lag 

variable (W_BURGRT) as the first variable 

(Y) and the original variable (BURGRT) as 

the second variable (X). The slope of the 

regression line in the scatter plot is the 

global Moran’s I (see exhibit 20). In the 

present example, the global Moran’s I for 

burglary rates is 0.184, indicating positive 

spatial autocorrelation across census 

tracts. 

As a measure of global spatial autocorrelation, the global Moran’s I, can be divided 

into four categories, corresponding with 

four quadrants in a Moran scatter plot 

(see exhibit 21). A Moran scatter plot can 

be computed by selecting Space ➞ 

Univariate Moran from the menu or by 

clicking on the matching toolbar button. In 

the first Windows dialog, choose the original variable (BURGRT) as the first variable 

(Y). In the second dialog, select a spatial 

weights matrix. 

The four quadrants in a Moran scatter plot 

identify four types of spatial association 

between a location and its neighbors. Two 

of these categories imply positive spatial 

association: (Quadrant I) where a location 

with an above-average value is surrounded 

by neighbors whose values are also above 

average (high-high), or (Quadrant III) where 

a location with a below-average value is 

Exhibit 19. Creating a spatially lagged variable of burglary rates 

57 
SPECIAL REPORT / AUG. 05 

Exhibit 20. Scatter plot and global Moran’s I of burglary rates 

Exhibit 21. Moran scatter plot of burglary rates 

Quadrant II Quadrant I

Quadrant III Quadrant IV

58 
MAPPING CRIME: UNDERSTANDING HOT SPOTS 

surrounded by neighbors whose values 

are also below average (low-low). The 

other two categories imply negative spatial association: (Quadrant IV) where a 

location with an above-average value is 

surrounded by neighbors with belowaverage values (high-low), or (Quadrant II) 

where a location with a below-average 

value is surrounded by neighbors with 

above-average values (low-high) (see 

exhibit 21). The observations from each 

quadrant could easily be selected and 

visualized using a GIS. The resulting Moran 

scatter plot map would provide a visual 

representation of spatial clustering (hot 

spots and cold spots) and the location of 

spatial outliers. Unfortunately, Moran scatter plot maps cannot be directly compiled 

within GeoDa. 

With larger data sets, the assessment of 

global spatial autocorrelation needs to be 

supplemented by local measures of spatial dependence as well. According to 

Anselin (1995), local indicators of spatial 

association (LISAs) achieve two objectives: (1) they can be used to identify significant patterns of spatial association 

around individual locations, such as hot 

spots or spatial outliers; and (2) they can 

be used to assess the extent to which the 

global pattern of spatial association is 

spread uniformly throughout the data or 

whether there are significant types of 

locations affecting the computation of 

Moran’s I. 

Measures of local spatial autocorrelation 

can be visualized by LISA local Moran 

maps and Moran significance maps. Local 

Moran LISA statistics can be computed by 

selecting Space ➞ Univariate LISA from 

the menu or by clicking on the matching 

toolbar button. In the first Windows dialog, 

choose the original variable (BURGRT) as 

the first variable (Y). In the second dialog, 

select a spatial weights matrix, and in the 

third dialog, check the boxes next to “The 

Significance Map” and “The Cluster Map.” 

The local Moran map in exhibit 22 shows 

that a significant “local” cluster of high 

burglary rates (census tracts in red) is 

present in the central part of the city. The 

significance of this cluster is 0.01 (census 

tracts in dark green) or 0.05 (census tracts 

in light green) as shown in the Moran significance map in exhibit 23. The census 

tracts in this “local” cluster would fall into 

the first quadrant of the Moran scatter plot 

(exhibit 21) where locations with an aboveaverage value are surrounded by neighbors whose values are also above average 

(high-high). The local Moran map also identifies one larger significant pocket of low 

burglary rates in the southwestern and 

two smaller significant pockets in the 

western and northern parts of Boston. 

These census tracts with a below-average 

value have neighbors whose values are 

also below average (third quadrant in 

exhibit 21). Finally, two individual census 

tracts that can be identified as spatial outliers are located adjacent in the east and 

southeast of the “local” cluster of high 

burglary rates. Both census tracts have 

below-average values and neighbors 

whose values are above average (second 

quadrant in exhibit 21). 

As a Windows-based application, GeoDa is 

much more user friendly than the original 

SpaceStat package and its ArcView 

Extension, DynESDA. It provides some 

useful tools for doing exploratory spatial 

data analysis, including dynamically linked 

windows and data brushing. As a standalone program it has a variety of options 

for data manipulation and transformation, 

mapping, exploratory spatial data analysis, 

spatial weights construction, descriptive 

statistics, spatial autocorrelation statistics, 

OLS regression with spatial diagnostics, 

and spatial regression modeling. To learn 

more about GeoDa, consider attending 

one of Luc Anselin’s ICPSR training courses or GeoDa workshops. For more information visit Luc Anselin’s homepage 

(http://agec144.agecon.uiuc.edu/ 

users/anselin/). 

59 
SPECIAL REPORT / AUG. 05 

Summary 

As seen throughout this demonstration 

chapter, each of these packages has its 

own particular strengths and weaknesses 

as well as unique and overlapping analytical applications. Exhibits 24 through 27 

summarize the strengths, weaknesses, 

and applications for each of the four hot 

spot software packages examined. 

References 

Anselin, Luc. 1995. “Local Indicators of Spatial 

Association—LISA” Geographical Analysis 27:93–115. 

Anselin, Luc, Ibnu Syabri, and Youngihn Kho. (forthcoming). “GeoDa: An Introduction to Spatial Data 

Analysis.” Geographical Analysis. 

Anselin, Luc. 2004a. GeoDa 0.9.5-I Release Notes. 

Spatial Analysis Laboratory and Center for Spatially 

Integrated Social Sciences (CSISS), Department of 

Agriculture and Consumer Economics, University of 

Illinois, Urbana-Champagne. 

Exhibit 22. LISA local Moran map for burglary rates 

Not significant 

High-high 

Low-low 

Low-high 

60 
MAPPING CRIME: UNDERSTANDING HOT SPOTS 

Anselin, Luc. 2004b. Exploring Spatial Data with 

GeoDa: A Workbook. Spatial Analysis Laboratory and 

Center for Spatially Integrated Social Sciences 

(CSISS), Department of Agriculture and Consumer 

Economics, University of Illinois, Urbana-Champagne. 

Harries, Keith. 1999. Mapping Crime: Principle and 

Practice. Washington, DC: U.S. Department of 

Justice, National Institute of Justice. 

Levine, Ned. 1999. CrimeStat 1.0, A Spatial Statistics 

Program for the Analysis of Crime Incident Locations. 

Washington, DC: U.S. Department of Justice, 

National Institute of Justice. 

Exhibit 23. LISA local Moran significance map for burglary rates 

Not significant 

p = 0.05 

p = 0.01 

61 
SPECIAL REPORT / AUG. 05 

Exhibit 24. ArcView Choropleth Mapping 

Strengths •	 Useful for visualizing aggregated crime patterns in and across defined boundary areas. 

•	 Useful for obtaining a general picture of the overall spatial distribution of crime across areas. 

Weaknesses •	 Attention often is focused on the relative size of an area so that large areas tend to dominate the map. 

•	 The actual distribution of crime incidents may be difficult to identify since incidents of crime usually are 

not evenly distributed throughout a given boundary area. 

Applications •	 Used with vector data that represents geographic features according to predefined political or 

administrative boundaries. 

•	 Often used with crime rates to standardize for population. 

Exhibit 25. ArcView Spatial Analyst 

Strengths •	 Useful for visualizing geographic patterns of crime across a continuous surface. 

•	 Density surface maps are based on the distribution of individual crime incidents and are therefore able to 

show with greater detail how crime is spatially distributed. 

Weaknesses •	 Because the values in the areas between crime incident locations are estimated interpolations, the 

validity of the resulting density patterns is highly dependent on the quantity and relative distribution of 

the available data points. 

•	 The interpolation process used to create a density surface generalizes and smooths the data so that 

extreme high and low values may disappear. 

Applications •	 Used with raster data that represents geographic features as a grid of cells on a continuous surface. 

•	 Individual crime incidents are used to interpolate the relative density of crime across a continuous surface. 

62 
MAPPING CRIME: UNDERSTANDING HOT SPOTS 

Exhibit 26. CrimeStat 

Strengths •	 Useful for doing exploratory spatial data analyses with crime incident locations (point pattern data). 

•	 Provides a number of statistical routines that vary from descriptive centrographic applications to more 

sophisticated nearest neighbor and spatial autocorrelation functions. 

Weaknesses • While a number of useful exploratory features are provided, no applications are available for modeling 

correlates or determinants of crime. 

Applications •	 Used with point data that represents crime incidents as point locations. 

•	 Statistical routines include: spatial distribution or centrographic statistics, distance statistics for nearest 

neighbor analyses, hot spot and clustering routines, and kernal density interpolation functions. 

Exhibit 27. GeoDa 

Strengths •	 Useful for doing exploratory and confirmatory spatial data analyses with either points (point coordinates) 

or aggregated crime data (area patterns). 

•	 Provides statistical routines with dynamically linked graphing, data brushing, and mapping applications for 

doing interactive exploratory data analyses as a stand-alone program. 

•	 Provides confirmatory spatial analyses tools for modeling correlates of crime using a variety of spatial 

regression applications. 

Weaknesses •	 Only uses ESRI shapefiles as input and output coverages. 

•	 Most statistical applications are for the analysis of area patterns; the application of point patterns 

is limited. 

Applications •	 Mostly used with areal data in which crime incidents are aggregated according to defined boundary areas 

(usually standardized as rates). 

•	 Analytical applications provided with GeoDa include (1) applications for the input, manipulation, and 

transformation of data; (2) applications for the construction of spatial weights; (3) applications for 

exploratory spatial data analysis (ESDA) using descriptive statistics, global and local measures of spatial 

autocorrelation, and dynamically linked graphing, data brushing, and mapping capabilities; and (4) 

applications for confirmatory spatial data analysis (CSDA) using OLS regression modeling with spatial 

diagnostics, spatial regression residual mapping, and a variety of spatial regression modeling options. 

63 
Chapter 4. Conclusion 

Ronald E. Wilson, Inter-University Consortium for Political and Social Research, Mapping and 

Analysis for Public Safety Program, National Institute of Justice 

Approaching hot spot 

analysis 

As seen throughout the previous chapters, 

conducting hot spot analysis depends on 

several factors, varying from theory selection, to type of crime being analyzed, to 

the display of output results. Carrying out 

analysis must have a logical and systematic approach. Analysis cannot proceed arbitrarily, depending solely on human intuition 

and visual inspection for identifying hot 

spots. Nor can analysts depend solely on 

the software algorithms to provide meaningful output. Such activities may result in 

a subjectively perceived hot spot that may 

or may not actually be a cluster of criminal 

activity. 

Visually identifying a hot spot can inappropriately affect input parameters, such as 

the size of the search radius, because, for 

example, an analyst might be looking at 

too many observations at one time. As a 

result, the presence of clusters could be 

exaggerated or could remain undetected if 

too few observations are used. Conversely, a statistical approach can only examine 

the observations that are selected without 

considering environmental factors, and 

thus requires human interpretation to 

make sense of the results of analysis. 

Analysts should use statistical tools in 

conjunction with human understanding 

of an area to give the analysis a solid foundation for stating where hot spots actually 

are occurring. They must scientifically 

determine that a hot spot is indeed an 

actual cluster of events that are not occurring at random. 

Gesler and Albert (2000) point out that 

with availability of geographic information 

systems (GIS) and other spatial data analysis software an analyst might, and often 

does, side-step an important element of 

analysis. That element in hot spot analysis 

is the understanding of the underlying spatial and social processes contributing to 

the presence or absence of criminal activity in an environment. Places have unique 

characteristics that affect the distribution 

of criminal activity over space (i.e., spatial 

processes) and temporal distributions. 

Social and spatial processes are nonstationary—criminal activity is affected by the 

variation of demographics, the built environment, economics, and other social 

aspects that change across space (Haining, 

2003). This leads to a premise that has 

long been championed in geography— 

place matters. 

Place matters because every location has 

a different environment, such as levels of 

socioeconomic status, laws governing 

space management, influence of informal 

social controls, condition of surroundings, 

and arrangements of the buildings. A number of confounders may also contribute to 

the clustering of criminal activity. As a 

result, the spatial arrangement of crime 

incidents will be different from place to 

place and will not lend itself to a uniform 

approach to hot spot analysis. Haining 

(2003) and Gesler and Albert (2000) note 

that observations change from place to 

place, which is an indication that the 

underlying spatial and social processes are 

different, and thus the method used for 

carrying out analysis will need to be 

65 
SPECIAL REPORT / AUG. 05 

adjusted to detect those processes (i.e., 

hot spots). Further, the fact that people 

and their environment are not evenly distributed across space also requires adjustment in the analysis approach. 

Elements to consider 

Analysis focus 

Gesler and Albert (2000) point out that 

two different goals apply when it comes to 

cluster, or hot spot, analysis. These 

approaches are general and focused analysis. With general analysis, an examination 

is done to discover whether phenomenon 

is clustered within the study area (i.e., an 

analyst is looking for the presence of hot 

spots). For example, in a National Institute 

of Justice (NIJ) study of homicides in 

Philadelphia, Pennsylvania (Zahn et al., 

2003), a hot spot analysis was performed 

over the entire city to identify places with 

a clustering of homicides. Subsequently, 

those hot spots were examined in conjunction with the presence of religious 

institutions and what influence they might 

have on homicide. In this case, the 

authors were trying to identify places with 

concentrations of homicide and then ask, 

“What is it about this place that might be 

causing so many homicides?” 

With focused analysis, the purpose is to 

identify phenomena that are clustered 

around a particular place of interest within 

a study area. For example, in another 

study (Wilson and Everett, 2004), a 

focused analysis was done because the 

primary hypothesis was, “Is there more 

violent crime activity clustering in, and 

around, public housing communities?” 

The authors selected specific locations 

(public housing communities) within a 

study area to determine if there were 

clusters of violent crime at specific 

places, not the entire city. In this case, 

the authors already knew that there was 

“something about those places” and 

were trying to prove or disprove the 

hypothesis that violent crime was clustered in and around those communities. 

Spatial dependence 

Criminal activity is not the same in every 

place, as chapter 1 points out in the first 

sentence. Therefore, to detect the presence of a hot spot, the strength of spatial 

relationships between incidents must be 

established. This strength is known as spatial dependence and is based on Waldo 

Tobler’s “First Law of Geography,” whereby everything is related to everything else, 

but closer things are more related. Spatial 

dependence must be measured to establish a distance relationship limit between 

crime incidents where an incident is related to a set of nearby incidents. This 

dependency will likely change over the 

study area as the environmental factors 

change (Haining, 2003). This is known as a 

spatial process, and when it changes 

across space it will be nonstationary. An 

analyst will have to determine the threshold distance of influence between incidents to guide the selection of bandwidth 

type and size when analyzing for clusters. 

This cannot be measured just by visually 

determining what that threshold distance 

might be because it is too subjective and 

thus must be done with a scientific 

approach. 

Currently, most hot spot analysis software 

only analyzes points in space without factoring in environmental variables. 

CrimeStat® and SaTScanTM are two of the 

available exceptions whereby a minimal 

set of environmental factors can be 

included in the analysis (Levine, 2002 and 

Kulldorff, 2004). Consulting the literature 

for theory or empirical evidence for the 

spatial dependence of criminal activity can 

provide a scientific base for selecting 

input parameters. Previous research will 

likely have considered the spatial relationships of criminal activity in combination 

with demographic, socioeconomic, and 

66 
MAPPING CRIME: UNDERSTANDING HOT SPOTS 

environmental variables and their distribution over space. 

For example, it has been demonstrated 

with empirical findings (Roncek, Bell, and 

Francik, 1996 and Holtzman, 2004) that 

one-eighth of a mile is a reasonable distance to measure the diffusion of crime in 

places that have strong neighborhood 

structures that are self-contained, such as 

Philadelphia, Pennsylvania, or Chicago, 

Illinois. Residents can often meet their 

needs without leaving these neighborhoods. However, places like Las Vegas, 

Nevada, or Fort Lauderdale, Florida, have 

completely different spatial structures 

because the neighborhoods are spread out 

and require residents to drive everywhere 

to get anything. One-eighth of a mile for 

measuring the clustering of crime might 

not make sense in these neighborhoods 

because this distance would likely be too 

small for measuring clustering and would 

likely not yield significant results. Even if 

the same crime type is examined in these 

places, the structure of the spatial relationships of the observations will be different 

because the environments are different. 

Absent of theory or empirical evidence, 

statistical techniques can be used to find 

spatial dependence based on the distribution of points, such as variograms or nearest neighbor indexes. These formulas 

measure the spatial distribution of points 

against a set of randomly distributed 

points to determine if clustering is by 

chance or not. Using formulas such as 

these, however, are only statistical exercises that assume that an area has no physical or social barriers, the shape of the 

study area has no relevancy, spatial and 

social processes are stationary (they do 

not change over space), and environmental factors are not considered to have influence. If these tools are not available, 

formulas exist for determining spatial 

dependency based on the presumed density of a study area, which is the number 

of observations divided by area. This, however, further dilutes the significance of the 

measure because not only are environmental or demographic factors not considered; the distribution of incidents 

themselves are not considered. These formulas simply state that given a number of 

incidents, clustering would occur based on 

the amount of area in which they are present. Should a bulk of the observations be 

located in a small portion of the study area 

(i.e., they are concentrated and are not 

evenly distributed), then the formula might 

give a value that is too large and detect all 

of those observations as a cluster. The 

area with the bulk of the observations 

could be used for analysis, but this returns 

the subjective selecting of parameters for 

analysis because some delimiting boundary must be specified. 

Crime type 

Consideration of crime type plays an 

important role as the spatial distribution of 

incidents varies in and between violent 

and property crime types. Different types 

of crime have different spatial relationships, dependencies, structures, and distributions, which are the result of different 

social and spatial processes over an area. 

These processes are affected by, and 

affect, other social and spatial processes 

occurring at nearby places. If all criminal 

activity was evenly distributed and was the 

result of the same social and spatial 

processes, then hot spot analysis would 

not be needed. If crime is analyzed in this 

fashion, a blanket statement is being made 

about criminal activity that assumes each 

type is caused by the same set of factors. 

For example, in an NIJ study of public 

housing and violent crime (Wilson and 

Everett, 2004) an analysis was first conducted with all crime types classified as 

violent crime. The result was the impression that violent crime was clustered 

mostly in public housing communities. 

However, when broken down into individual crime types, the authors found that 

67 
SPECIAL REPORT / AUG. 05 

murder, assault, rape, robbery, and 

weapons violations were not clustered in 

public housing communities but assault on 

females and domestic violence were. The 

identification of which crime type was 

actually clustered in the communities 

might allow police to address problems 

focused on violence against women rather 

than trying to provide solutions and 

resources for all other violent crime types. 

Exploration of crime type distributions is 

fundamentally important to determine 

which type of hot spot method should be 

used. Analyzing crime in general, such as 

violent, drug, or property crime could yield 

misleading or incorrect results. Breaking 

down crime types from general categories 

can allow for focused analysis or meaningful results. 

Time intervals 

Time further complicates the process 

of hot spot analysis because varying 

intervals can affect cluster detection of 

criminal activity. Certain crimes occur at 

particular times of day, months (seasons), 

or over special events. For example, 

assaults may occur more frequently at 

night in areas with nightclubs. Since 

these clubs are not open in the day, 

crimes occurring during daylight hours 

might lack a spatial relationship that is 

present during nighttime hours of operation. This is especially true if the analysis 

is trying to link an increase in crime to 

the presence of the establishment. 

Depending on how many incidents are 

within a given period of time, the accumulation of crime incidents over too long of a 

time interval can indicate the presence of 

a hot spot when one really does not exist. 

Conversely, too short of a time interval can 

obscure a cluster of criminal activity 

because not enough observations were 

captured in relation to the actual time 

interval of the spatial process. During this 

cross-section of time, a major event might 

have occurred or a crime-prone establishment might have been introduced or 

removed that had a sudden or lagged 

impact on the cumulative amount of 

crime. Consequently, the temporal relationship does not correspond with the spatial relationship. 

To counter this, select time periods that 

synchronize the temporal dependency 

with the spatial dependencies under 

analysis, such as separation of times of 

day, seasons, events, policy implementations, or the introduction or removal of 

establishments. A series of hot spot maps 

may need to be generated instead of just 

one. An incorrect temporal measurement, 

even if at a location that has a true clustering of crime, may lead to false negatives 

or positives. 

Barriers 

Physical and social barriers between 

places must be factored into analysis, 

since they will have an effect on the directional significance of spatial relationships. 

These barriers have a separation effect 

that can drastically change whether a hot 

spot exists and the shape and size of that 

hot spot. Many algorithms for determining 

hot spots currently do not have the capability to detect a barrier such as a river or a 

shopping area that separates two places. 

Natural and manmade physical barriers 

can impede spatial relationships and create the illusion of hot spots where it is 

unlikely that crime incidents are related. 

For example, rivers, regardless of size, 

provide a severe break in spatial relationships, as access to each side is limited. 

Kernel density smoothing routines, for 

example, should be used on each side of 

these barriers independently, which 

allows observations to be measured on 

each side independently. Conversely, 

measuring incidents in relation to each 

68 
MAPPING CRIME: UNDERSTANDING HOT SPOTS 

other could cause a hot spot to be detected that crosses a barrier when actually no 

relationship is present. This same principal 

holds true for manmade barriers such as 

major limited access highways or large 

parks. 

Social barriers consist of environments 

that make it difficult for an offender to 

travel through undetected. Upscale neighborhoods with high-end shopping, restaurants, or clubs provide an environment in 

which would-be criminals might stand out 

and draw attention. For example, private 

security is often present in affluent neighborhoods and increased surveillance, such 

as neighborhood watches, might provide a 

record of identification. Social barriers will 

likely be less of a consideration than physical barriers, as spatial relationships will be 

accounted for during analysis. A disruption 

will occur between observations on each 

side of a neighborhood, for example, that 

will likely cause a diminishing amount of 

observations from one side of the barrier 

to the other. 

Output display 

As demonstrated in chapter 2, the results 

of hot spot analysis can be displayed in 

several ways. Primarily this is done as a 

continuous surface or as delineated 

boundaries depending on the output of 

the analysis software. Some software programs output a grid of continuous surface 

values while others output a set of values 

within the original unit of analysis, such as 

a census block group. Either method 

requires categorizing data with an associated color. 

When displaying output as a continuous 

surface, the underlying values will often 

have statistical significance. Therefore, it is 

important to understand the ranges of 

those levels of significance, such as zscores, in order to show the significant 

breaks of criminal activity. Chapter 2 

points out that distribution and density 

must be understood because categorization can make a difference on how hot 

spots look or even if one is present. 

Arbitrarily selecting categorical ranges may 

misrepresent the size and shape of the 

hot spot. 

Software 

Software for hot spot analysis is becoming 

more available in both GIS software and 

custom software programs. Much has 

been written about using software for hot 

spot analysis, but little about the development of hot spot analysis tools. In particular, these issues revolve around design of 

tools for conducting spatial data analysis 

that includes environmental and demographic factors. In this respect, any analysis software requires a variety of tools that 

allows for full and indepth investigations. 

There are not enough robust statistical 

tools within, or that interact with, GIS software. Software programs for spatial analysis, to date, do not contain all of the tools 

needed to do a full analysis of data. For 

example, many custom software packages 

do not have the ability to visually display 

hot spot analysis results. If any further 

analysis needs to be done, the analyst 

must manipulate the data in a GIS for display and then import that work back into 

the statistical analysis software. As a 

result, analysts may use several software 

programs to carry out their research and 

analysis. For example, a hot spot analysis 

of public housing and violent crime 

(Wilson and Everett, 2004) required the 

use of ARC/INFO®, SPSS, Microsoft® 

Excel, and CrimeStat to conduct the analysis. While progress has been made in 

bringing spatial data analysis and GIS software together, such as GeoDaTM (Anselin, 

2004), it is still not to the level that allows 

the flexibility and interactivity that the 

crime analysis community needs. 

69 
SPECIAL REPORT / AUG. 05 

Theory and practice 

Establishing a stronger link between theory and practice will help avoid the arbitrary 

approaches to hot spot analysis and give 

an analyst a scientific foundation from 

which to work. The literature often encourages experimentation with analysis results 

until the outcomes make sense, but that 

can be time consuming and confusing 

because nothing exists to substantiate 

that the analysis approach was appropriate. There should be solid and grounded 

reasons for identifying clusters, parameter 

selection, analysis techniques, and output 

display categories. 

What this means for researchers 

To improve hot spot analysis, researchers 

must do two important tasks. The first is 

to further develop theories to provide scientific reasons for depicting spatial relationships and the strength of the 

dependencies between criminal incidents, 

environmental and socio-demographic variables, and the interpretation of results. The 

second is to conduct more empirical studies that test theories of spatial relationships and crime to guide parameter 

selection, appropriate time intervals, crime 

types, and barriers. Researchers, therefore, must work to build models that are 

flexible and incorporate both compositional (demographic) and contextual (ecological) variables. These models must perform 

spatial data analysis as well as statistical 

analysis. 

Researchers must also do more to get 

their theories or empirical results into the 

hands of practitioners through more outreach to crime analysts or policymakers. 

Publishing in peer-reviewed journals, such 

as Criminology or The Professional 

Geographer, will not reach an audience 

that wants to use theory and empirical evidence but has little recourse in doing so. 

These journals are expensive to obtain and 

are often filled with other articles that may 

not be relevant to the analyst. 

What this means for 

practitioners 

Practitioners must first and foremost 

develop strategies for conducting hot spot 

analyses that have a scientific foundation. 

Analysts must think about and organize 

the many elements and options that go 

into analysis. That is, practitioners must 

use a scientific approach to carrying out 

analysis that is logical, systematic, and 

critically examined. This will give strong 

credibility to the statistical output and 

interpretation of the results. Further, analysts must provide feedback to researchers 

on analysis that tested a particular theory 

or whether the use of empirical evidence 

worked in their jurisdiction. 

Practitioners must understand that their 

approach to hot spot analysis will be different every time they conduct analysis. Their 

approach will change based on place, purpose of analysis, spatial dependence 

between crime and environment, crime 

type, time, barriers, and the visual display 

of results. This will subsequently determine which software programs they use 

and how they will use them. 

Full circle 

Researchers and practitioners must work 

more closely together. Researchers often 

will make contact with law enforcement 

agencies to get data needed to conduct 

research with little or no further contact. 

Although exceptions exist and the problem 

is decreasing as crime analysis progresses, minimum contact is still largely the 

norm. One way to bring these two groups 

together is to develop software tools that 

can provide an opportunity for instant 

feedback between the groups. Such timely 

feedback could lead to the development of 

software that more closely models ground 

70 
MAPPING CRIME: UNDERSTANDING HOT SPOTS 

truth. More so, researchers and practitioners should continue to attend events such 

as NIJ’s Crime Mapping Research 

Conference or the Jill Dando Institute of 

Crime Science Crime Mapping Conference 

to maintain the discourse about what 

works and what does not. 

References 

Anselin, L. 2004. GeoDa version 0.9.5-i, An 

Exploratory Spatial Data Analysis (ESDA) software 

application. http://sal.agecon.uiuc.edu/geoda_main. 

php 

Gesler, W.M. and D.P. Albert. 2000. “How Spatial 

Analysis Can be Used in Medical Geography.” In D.P. 

Albert, W.M. Gesler, and B. Levergood (eds.), Spatial 

Analysis, GIS, and Remote Sensing Applications in 

the Heath Sciences. Chelsea, MI: Ann Arbor Press. 

Haining, R. 2003. Spatial Data Analysis: Theory and 

Practice. New York: Cambridge University Press. 

Holtzman, H. 2004. Personal communications at the 

National Institute of Justice. 

Kulldorff, M. and Information Management Services 

Inc. 2004. SaTScan v4.0: Software for the spatial and 

space-time scan statistics. http://www.satscan.org 

Levine, N. 2002. CrimeStat 2.0, A Spatial Statistics 

Program for the Analysis of Crime Incident Locations. 

Houston, TX: Ned Levine & Associates and 

Washington, DC: U.S. Department of Justice, 

National Institute of Justice. 

Roncek, D.W., R. Bell, and J.M.A. Francik. 1981. 

“Housing Projects and Crime: Testing a Proximity 

Hypothesis.” Social Problems 29 (2): 151–166. 

Wilson, R.E. and R.S. Everett. 2004. Targeting Violent 

Crime in Small Communities: A Spatial Data Analysis. 

Unpublished research. Washington, DC: U.S. 

Department of Justice, National Institute of Justice. 

Zahn, M.S., R.J. Kaminski, R.E. Wilson, and D.M. 

Campos. 2003. Religious Institutions and Homicide in 

Philadelphia Neighborhoods. Unpublished research. 

Washington, DC: U.S. Department of Justice, 

National Institute of Justice. 

71 
SPECIAL REPORT / AUG. 05 

72 
About the National Institute of Justice 

NIJ is the research, development, and evaluation agency of the U.S. Department of Justice. 

NIJ’s mission is to advance scientific research, development, and evaluation to enhance the 

administration of justice and public safety. NIJ’s principal authorities are derived from the 

Omnibus Crime Control and Safe Streets Act of 1968, as amended (see 42 U.S.C. §§ 3721–3723). 

The NIJ Director is appointed by the President and confirmed by the Senate. The Director establishes the Institute’s objectives, guided by the priorities of the Office of Justice Programs, the 

U.S. Department of Justice, and the needs of the field. The Institute actively solicits the views of 

criminal justice and other professionals and researchers to inform its search for the knowledge 

and tools to guide policy and practice. 

Strategic Goals 

NIJ has seven strategic goals grouped into three categories: 

Creating relevant knowledge and tools 

1. Partner with State and local practitioners and policymakers to identify social science research 

and technology needs. 

2. Create scientific, relevant, and reliable knowledge—with a particular emphasis on terrorism, 

violent crime, drugs and crime, cost-effectiveness, and community-based efforts—to enhance 

the administration of justice and public safety. 

3. Develop affordable and effective tools and technologies to enhance the administration of 

justice and public safety. 

Dissemination 

4. Disseminate relevant knowledge and information to practitioners and policymakers in an 

understandable, timely, and concise manner. 

5. Act as an honest broker to identify the information, tools, and technologies that respond to 

the needs of stakeholders. 

Agency management 

6. Practice fairness and openness in the research and development process. 

7. Ensure professionalism, excellence, accountability, cost-effectiveness, and integrity in the 

management and conduct of NIJ activities and programs. 

Program Areas 

In addressing these strategic challenges, the Institute is involved in the following program areas: 

crime control and prevention, including policing; drugs and crime; justice systems and offender 

behavior, including corrections; violence and victimization; communications and information 

technologies; critical incident response; investigative and forensic sciences, including DNA; lessthan-lethal technologies; officer protection; education and training technologies; testing and 

standards; technology assistance to law enforcement and corrections agencies; field testing of 

promising programs; and international crime control. 

In addition to sponsoring research and development and technology assistance, NIJ evaluates 

programs, policies, and technologies. NIJ communicates its research and evaluation findings 

through conferences and print and electronic media. 

To find out more about the National 

Institute of Justice, please visit: 

http://www.ojp.usdoj.gov/nij 

or contact: 

National Criminal Justice 

Reference Service 

P.O. Box 6000

Rockville, MD 20849–6000 

800–851–3420 

e-mail: askncjrs@ncjrs.org 
DOJ/NIJ *NCJ~209393* 

NCJ 209393 

U.S. Department of Justice 

Office of Justice Programs 

National Institute of Justice 

Washington, DC 20531 

Official Business 

Penalty for Private Use $300 

AUG. 05 

MAILING LABEL AREA (5” x 2”) 

DO NOT PRINT THIS AREA 

(INK NOR VARNISH) 

PRESORTED STANDARD 

POSTAGE & FEES PAID 

PERMIT NO. G–91