Implementation - scenarios

Scenario 1 - Authoritarian government

W was a post-doctoral research associate focused on photonics research at a UK university. They had moved from their home country, an overseas country with an authoritarian government, to the UK for this role.

While employed by the UK university, they travelled overseas to their home country on university-related business. During the trip, they were instructed by the authoritarian government in their home country that they would not be returning to the UK.

W did not contact the UK university to formally end their employment. 

During a routine scan of the university network two weeks after W left the UK, the UK university IT team identified remote downloads from a server linked to the photonics department to an overseas server. The downloads involved significant amounts of sensitive research data that W had been working on. Further investigation identified that W’s credentials had been used to access the network at the time of the download.

It was later established that W now worked in direct collaboration with the military of their home country on similar research to that which they undertook in the UK.

Considerations

Universities should be aware of other countries’ legislation, which may require individuals to co-operate or compel them to share research data with foreign governments or intelligence services (e.g. export control or national security legislation which may have extra-territorial reach).

Universities should also consider the geopolitical climate associated with an overseas partner, for example involvement of the state in military action or strained diplomatic relations, that may heighten risks to individuals when travelling or the existence of an autocratic or authoritarian government.

Overseas legislation and political actions which may put the traveller at increased risk should be factored into insurance considerations and captured in a pre-travel risk assessment.

In this scenario, W may have:

• been placed under duress by an overseas government to cooperate
• willingly co-operated with an overseas government
• naively, but purposely, passed sensitive information to an overseas government
• been victim of a cyber attack in which their credentials and university network access were breached

The considerations and mitigations will vary depending on the circumstances, but the following may be applicable.

• Universities will include a range of conditions and undertakings in academic contracts, and in most cases will retain ownership of research conducted while employed by the university. While research associates may consider themselves the sole owner of any research that they undertake, the university at which they are employed may view themselves as the owner as they employed the academics involved and provide the resources to facilitate the research.
• Access to IT systems should be governed by clear policies that include considerations for overseas access, downloading materials from university systems and their onward dissemination and employee monitoring. 
• Access credentials, such as passwords, should always be unique and complex to prevent opportunistic guessing. They should always be stored safely.
• Unauthorised interference and theft of data without permission from a university network could constitute a criminal offense under the Computer Misuse Act (CMA).
• Depending on the circumstances, it is possible that the download of research data from a UK university to an overseas university could place the researcher in breach of export control, and in some cases the Data Protection Act 2018.
• Depending on the circumstances, the National Security Act 2023 could be relevant. For example, in the instance of sharing trade secrets.

Scenario 2 - Overseas presentation and government approach

B is a Professor of advanced materials at a UK university and receives funding from a UK defence industry partner.

Professor B has been corresponding with Professor Y for six months on an area of shared academic research interest. Professor Y is based at an overseas university in Country Z and invited Professor B there to give a lecture to a group of students and post-doctoral researchers on advanced materials. Professor B accepted the invite and travelled overseas to give the presentation.

Following the presentation, several additional people joined the question-and-answer session. The questions focused on potential aerospace applications of advanced materials and there were a few questions about Professor B’s work with the UK defence industry partner.

On the second day of the visit, Professor Y introduced Professor B to a member of the Science Ministry of the government for Country Z.

Although they were not able to discuss the specifics of Professor B’s research, due to the existence of a non-disclosure agreement (NDA) with the UK defence industry partner, the government representative discussed their desire to replicate the research facilities that Professor B used in the UK. 

B is a Professor of advanced materials at a UK university and receives funding from a UK defence industry partner. Professor B has been corresponding with Professor Y for six months on an area of shared academic research interest. Professor Y is based at an overseas university in Country Z and invited Professor B there to give a lecture to a group of students and post-doctoral researchers on advanced materials. Professor B accepted the invite and travelled overseas to give the presentation.

Following the presentation, several additional people joined the question-and-answer session.

The questions focused on potential aerospace applications of advanced materials and there were a few questions about Professor B’s work with the UK defence industry partner. On the second day of the visit, Professor Y introduced Professor B to a member of the Science Ministry of the government for Country Z.

Although they were not able to discuss the specifics of Professor B’s research, due to the existence of a non-disclosure agreement (NDA) with the UK defence industry partner, the government representative discussed their desire to replicate the research facilities that Professor B used in the UK.

Considerations

Considerations may vary slightly depending on which overseas country is involved in this type of scenario.

Presentations and lectures given overseas, or online in the UK to an overseas audience, may be subject to export control.¹ Given that Professor B was undertaking defence related research, their work was likely to be considered sensitive research. 

When travelling overseas with devices, individuals must consider all the information held on their devices and whether any of it is subject to export control – this is necessary regardless of whether you plan to share the information with individuals while overseas. In many instances, it is easier to take a ‘clean’ device which contains only the information required for the trip. 

Disentangling export controlled and non-controlled materials can be particularly difficult if your institution promotes a ‘bring your own device’ culture, in which your device is both your personal and work device.

In ‘bring your own device’ situations, consideration regarding export control will need to be taken for all overseas trips, including travel for leisure and holidays.

The funding from the UK defence industry partner was likely subject to terms and conditions, or contractual obligations. For example, there may have been a requirement to alert the partner of other engagements which may impact on their research area. In addition, accepting payment from an overseas government to replicate the work was likely a conflict of interest/commitment.

If accepting payment or expenses from an additional organisation, you should consider whether you need to declare them to your institution, existing partners/funders and/or HMRC.

The Trusted Research Countries and Conferences Guidance² provides additional advice on overseas travel.

Scenario 3 - Hosting sensitive data overseas

G is a post doctorate researcher specialising in artificial intelligence (AI) and has been corresponding with Professor B at an overseas university for six months on a shared area of research interest.

G is being funded by a UK police force to undertake research into the use of AI for the identification of criminality and terrorism based on CCTV coverage. Professor B has been undertaking similar research with a police force in their own country. Subsequently, G and Professor B agree to share research developments and data.

Professor B suggests that the research is hosted on a new IT platform developed by the overseas university. G is impressed by the functionality of the IT platform and agrees to hosting the research on the platform, which includes bulk personal data provided by the UK police force.

A few weeks later, a national newspaper in the UK publishes an article about the collaboration between the UK and overseas university. The article alleges that the overseas university provided the overseas police force with AI technology, developed in collaboration with the UK university, to conduct widescale surveillance on a minority group to support a regime of repression and ill treatment.

As a result of the collaboration, the UK university’s reputation is damaged and they face widespread criticism. G attempts to access the overseas university’s IT platform to remove the bulk personal data provided by the UK police force but is denied access. G consults their institutional data security policy and reports the incident to the internal IT team.

Due to the breach of data security, the UK police force withdraw funding from multiple projects with the UK university.

Considerations

Considerations may vary slightly depending on which overseas country is involved in this type of scenario.

Under the National Security and Investment Act 2021 (NSI Act), the UK government may call in a qualifying acquisition of an asset³ if they have reasonable suspicion that it has given rise to, or may give rise to, a risk to national security. Universities and other research-intensive organisations may make a voluntary NSI notification about an acquisition if they wish to be certain whether the acquisition will be called in.

This power is more likely to be used for qualifying acquisitions of assets that are, or could be, used in connection with the activities set out under the 17 sensitive areas of the economy⁴ or closely linked activities. This is because these acquisitions are more likely to pose a risk to national security. In this instance, as AI is one of the 17 sensitive areas of the UK economy and databases are included as qualifying assets, a voluntary notification could have been submitted to the UK government.

Given the sensitive nature of the research and the use of bulk personal data, there are implications to consider in relation to the Data Protection Act 2018, particularly due to the use of an IT platform hosted outside of the UK. If personal data collected by visual surveillance technology is sent to another jurisdiction, the Data Protection Act 2018 requires assurances that data protection legislation in that jurisdiction is essentially equivalent to that in the UK.

The transfer of knowledge overseas may be subject to export control. As the research was focused on AI and has a clear dual-use application, it is essential to secure the relevant export control license before exchanging knowledge and sending data to be hosted on an overseas IT platform.

Recipients of funding have a responsibility to ensure that they are compliant with the terms and conditions of the funding and are aware of their responsibility to conduct due diligence on the source of funding and partners. This includes new members to existing partnerships and additional streams of funding introduced during the project, where relevant.

Scenario 4 - Talent plan, funding conflicts and changing research scope

T is a research fellow at a UK university receiving government funding for conducting research on genome editing for the purposes of developing new medicines. T recently published multiple academic papers on their research and subsequently received a message from a senior employee at a UK subsidiary of a synthetic biology (SynBio) company headquartered overseas (Company A).

The senior employee showed significant interest in T’s research and requested a meeting in person. During the meeting, the senior employee presented an offer from Company A to provide T with additional funding and lab space at their facility in the UK. The overseas senior employee stated that this would be an informal talent plan arrangement and that as such, it would not be necessary for T to inform their university of the collaboration.

T accepted the offer and continued their research on genome editing for the development of new medicines, simultaneously working at the university research facilities and at Company A’s facility.

T found the staff at Company A very friendly, they frequently invited T to networking events and suggested that T bring colleagues from the UK university. Over the course of 3 months, T introduced Company A to numerous academics from the UK university and provided the contact details of additional colleagues at Company A’s request.

After working with Company A for 3 months, T’s government funding partner requested to meet with them. The funder had become aware that T had received an additional stream of funding for the project that they had also been funding. This conflicted with the terms and conditions. As a result, the government partner withdrew their funding.

A few weeks after T’s government funding was withdrawn, Company A offered T additional funding to work on a research project using SynBio to enhance physical and cognitive human performance. T agreed to work on the project. 

Considerations

Institutions and researchers/academics should be aware of the ultimate beneficiary of their work. If you are working with a UK subsidiary of an overseas company, it may be necessary to explore the structure of the organisation to conduct sufficient due diligence. Depending on how information is transferred through that structure, you may also need to consider whether export controls apply.

A reliable research partner should have no reason to hide their current or previous affiliations from you or your employer, nor should they request you to do so.

Legitimate collaborations are typically formalised by contracts, and it should be viewed as a red flag if a partner insists that a contract is not required. Foreign talent plans often incentivise their members to recruit their existing partners and colleagues, creating a domino effect whereby greater and greater amounts of research and intellectual property is transferred.

Due diligence is an ongoing process which should be revisited when changes take place during the lifecycle of a collaboration. For example, a change in research scope, funding source or new individuals being introduced to an existing partnership.

Under the National Security and Investment Act 2021 (NSI Act), the UK government may call in a qualifying acquisition of an asset⁵ if they have reasonable suspicion that it has given rise to or may give rise to a risk to national security.

Universities and other research-intensive organisations may make a voluntary NSI notification about an acquisition if they wish to be certain whether the acquisition will be called in. This power is more likely to be used for qualifying acquisitions of assets that are, or could be, used in connection with the activities set out under the 17 sensitive areas of the economy,⁶ in which synthetic biology is included, or closely linked activities. This is because these acquisitions are more likely to pose a risk to national security.

Institutions should ensure that they educate and protect their most vulnerable staff and students from potentially exploitative approaches. Staff and students may be more vulnerable at the start of their careers, when they may have less experience managing research security risks, or if they are on insecure or short contracts in which they need to meet funding targets.

Scenario 5 - University spin-out

J is a research associate at a UK university who developed a drone with capabilities to facilitate the mapping of endangered species in extreme weather conditions.

J was approached by a UK-based subsidiary of an overseas technology company, Company C, to commercialise the drone through the formation of a university spin-out company. The overseas technology company offered to oversee the business planning, manufacturing and sales to allow J to continue to develop further iterations of the technology.

Company C stated that they intended to market the drone primarily to producers of wildlife, travel and extreme sports documentaries. J was aware of the dual-use applications of the technology. For example, the drone had the ability to locate and track people, as well as animals. It was also fitted with high-specification lenses capable of withstanding explosions to maintain full functionality in adverse weather. As a result of these dual-use applications, J conducted open-source research on Company C and felt confident that they intended to use the technology for civilian purposes only.

In conjunction with the institution’s technology transfer office (TTO), J went ahead with forming the university spin-out with Company C, which involved providing them with exclusive licensing rights.

A year after the formation of the spin-out, while J was conducting research to further develop the drone capability, J identified that the country in which Company C was headquartered had developed a military drone over the last 8 months. The military drone had multiple identical capabilities to J’s drone and was almost identical in appearance.

J approached Company C, but they denied any involvement in the development of a military drone. At the end of the licensing period, Company C did not renew the agreement with J’s university spin-out.

Considerations

There is often an expectation that the researcher/academic’s university will want to be a shareholder in any university spin-out companies established. The institution may have a specific policy on university spin-outs, particularly in regard to IP ownership.

Under the National Security and Investment Act 2021 (NSI Act), the UK government may call in a qualifying acquisition of an asset⁷ if they have reasonable suspicion that it has given rise to or may give rise to a risk to national security. Universities and other research-intensive organisations may make a voluntary NSI notification about an acquisition if they wish to be certain whether the acquisition will be called in. This power is more likely to be used for qualifying acquisitions of assets that are, or could be, used in connection with the activities set out under the 17 sensitive areas of the economy⁸ or closely linked activities. This is because these acquisitions are more likely to pose a risk to national security. Drones would be included within the ‘military and dual-use’ sensitive area of the UK economy.

Consequently, Company C’s investment into the university spin-out could have been voluntarily notified to the UK government.

Institutions and researchers/academics should be aware of the ultimate beneficiary of their work. If you are working with a UK subsidiary of an overseas company, it may be necessary to explore the structure of the organisation to conduct sufficient due diligence. Depending on how information is transferred through that structure, you may also need to consider whether export controls apply.

When working with overseas partners or in overseas markets, it may be necessary to obtain additional IP protections. However, some overseas territories do not uphold IP protections with the same rigour as the UK.

NPSA’s Secure Innovation⁹ campaign provides guidance on how to protect start-ups and spin-outs from state threats.

Scenario 6 - Identifying export controls and sanctions

P was a PhD student at an overseas university conducting research on advanced materials. After finishing their PhD, P successfully applied for a postdoctoral research associate position at a UK university to conduct research into graphene.

While in the UK, P conducted extensive research into the application of graphene as a protective material. In their home country, P’s former PhD supervisor was an expert in the application of graphene as a construction material. P wanted to collaborate with their former PhD supervisor on research into the structural composition of graphene.

P contacted their former PhD supervisor and asked if they would be willing to co-operate. They were keen to be involved and suggested that to fully understand the requirements of the UK research project, P would need to share the aims of the research project and the research which had been conducted thus far.

Before exchanging any research with their former PhD supervisor, who was based in their home country, P consulted the UK university’s policy/process on collaborations which advised checking UK Government advice on export controls and sanctions. P consulted their research office for advice on undertaking these research security checks. With the assistance of their research office, P identified that their research would be subject to export control due to the potential dual-use application of graphene as a protective material and that their former PhD supervisor’s university was subject to UK sanctions.

Through discussions with the research office, P recognised that it would not be possible to undertake the collaboration with their former PhD supervisor and informed the UK university that although they had been in contact with a sanctioned university, that the research into graphene as a protective material would not be discussed any further and no intellectual property had been transferred.

Considerations

To mitigate risks, universities may want to consider putting reporting mechanisms in place for academics to be able to report interactions which may be of concern. To increase the likelihood of these functions being appropriately used, universities should aim to foster a culture of transparency so that reporting is seen as positive. In this instance, the interaction was halted before it became problematic but because P reported the interaction to the university, the institution could create a record of the exact circumstances which may be useful if any allegations of a collaboration are made in the future.

The use of graphene as a protective material falls under the Export Control Order 2008 (Schedule 2 – military goods, software and technology) and use of graphene in body armour (i.e. a protective material) would also fall under ‘Category 1 – special materials and related equipment’ of the UK Government consolidated list of strategic military and dual-use items requiring export authorisation.

You may want to use the Department for Business and Trade’s Goods Checker tools¹² to identify whether technology is subject to export control. This resource may provide a helpful indication of whether an export license is required but as it is primarily designed for goods, rather than research, it is always beneficial to discuss your requirements with the research office.

The UK Government can impose a variety of sanctions on individuals, organisations or countries. As such, there are a variety of different sanctions lists¹³ which must be consulted prior to the transfer of goods, technology or knowledge.

Institutions should be alert to the use of third-party countries in international collaborations to circumvent UK sanctions.¹⁴

Scenario 7 - Identifying dual-use applications before commercialisation

Lecturer F is a Principal Investigator specialising in nuclear energy who has developed an innovative solution for disposing of the radioactive waste produced during the creation of nuclear energy. Lecturer F has been approached by an overseas company to create a university spin-out company to market and sell the product.

Lecturer F asked their Head of Department to approve travel expenses for them to visit the overseas company to discuss terms. The Head of Department enquired about the details of the spin-out and recommended that as nuclear energy falls under the 17 sensitive sectors of the economy as defined in the National Security and Investment Act (NSI Act) that Lecturer F should conduct detailed research into the overseas company. Lecturer F stated that they had confirmed that the collaboration did not require a mandatory notification and therefore did not feel it was necessary to conduct further checks.

The Head of Department referred the collaboration to the university’s research security team and the technology transfer office (TTO) to ensure all legal obligations were met. The research security team identified that Lecturer F’s product included multiple components listed on the UK Government consolidated list of strategic military and dual-use items requiring export authorisation. The research security team also conducted open-source research on the overseas company and identified news articles citing the company in disputes over IP theft.

The research security team escalated the collaboration to the research risk review board for their assessment. Given the dual-use application of the product and the concerning reputation of the overseas company, the university decided to voluntarily submit a notification of the collaboration to the UK Government under the NSI Act.

As a result, the Head of Department advised Lecturer F not to travel overseas until the review under the NSI Act had been completed to ensure all legal obligations were met and that Lecturer F’s IP was protected.

Considerations

The absence of a requirement for a mandatory notification under the NSI Act does not mean that a collaboration is low risk. Thorough due diligence should still be undertaken, and all legal obligations must be fulfilled.

In this situation, if Lecturer F had travelled to visit the overseas company and presented the product without an export license, they would have been in breach of export control regulations, therefore committing a criminal offence. As a result, their reputation and the reputation of their institution could have been damaged and they could have been liable to pay a fine or face up to ten years imprisonment.

The theft of IP can result in a loss of competitive edge, reputational damage, a slowdown in research progress and/or business growth and a loss of trust from partners and funders. Further, the theft of dual-use or sensitive IP can also negatively impact the UK’s national security by uplifting overseas military capabilities and/or eroding UK capabilities.

To prevent IP theft, institutions should identify their most sensitive/valuable IP and protect it appropriately. Protective measures include patents, cyber security, non-disclosure agreements (NDAs), selective sharing, clear IP ownership agreements, restricted access (physically and from a network perspective) and policies that set clear specifications for what can be taken overseas. IP ownership agreements should include:

• identification and notification of arising IP
• protection decisions • management of IP
• commercialisation and use of IP
• termination agreement
• background and foreground IP
• jurisdiction and governing law
• where information is stored
• allowances and limitations of usage of IP (what, how, when)

Footnotes

¹ https://www.gov.uk/guidance/export-controls-applying-to-academic-research#basic- scientific-research

² https://www.npsa.gov.uk/specialised-guidance/trusted-research/trusted-research-countries-and-conferences

³ https://www.gov.uk/government/publications/national-security-and-investment-act-guidance-for-the-higher-education-and-research-intensive-sectors/national-security-and-investment-act-guidance-for-the-higher-education-and-research-intensive-sectors#how-the-rules-work

⁴ https://www.gov.uk/government/publications/national-security-and-investment-act-guidance-on-notifiable-acquisitions

⁵ https://www.gov.uk/government/publications/national-security-and-investment-act-guidance-for-the-higher-education-and-research-intensive-sectors/national-security-and-investment-act-guidance-for-the-higher-education-and-research-intensive-sectors#how-the-rules-work

⁶ https://www.gov.uk/government/publications/national-security-and-investment-act-guidance-on-notifiable-acquisitions

⁷ https://www.gov.uk/government/publications/national-security-and-investment-act-guidance-for-the-higher-education-and-research-intensive-sectors/national-security-and-investment-act-guidance-for-the-higher-education-and-research-intensive-sectors#how-the-rules-work

⁸ https://www.gov.uk/government/publications/national-security-and-investment-act-guidance-on- notifiable-acquisitions

⁹ https://www.npsa.gov.uk/specialised-guidance/secure-innovation/company-guidance#security-from-the-start

¹⁰ https://www.ipo.gov.uk/ip-support/welcome

¹¹ https://www.gov.uk/guidance/national-security-checks-on-patent-applications

¹² https://www.ecochecker.trade.gov.uk/spirefox5live/fox/spire/OGEL_GOODS_CHECKER_ LANDING_PAGE/new

¹³ https://www.gov.uk/government/publications/the-uk-sanctions-list

¹⁴ https://www.gov.uk/government/publications/notice-to-exporters-202308-russia-sanctions-trade-sanctions-circumvention/nte-202308-russia-sanctions-trade-sanctions-circumvention