Economic Security and Higher Education: The Rise of Research Securitisation

3.1 Domains of research security

A recent report by Universities UK International suggested that the government and institutions should focus on six domains where the risk of economic interference was highest: ‘financial, reputational, academic freedom and freedom of speech, security, relationship and personnel management, and cyber, intellectual property (IP) and data management’.⁴⁸ A similar report in Australia likewise pointed to six domains, but from the perspective of the security measures enacted to protect economically valuable research: export controls, autonomous and multilateral sanctions, criminal law, foreign investment, travel and migration, and intellectual property.⁴⁹ In both cases, controls have evolved from the economic utility of the technology in question, such that the ‘value’ of the research becomes worthwhile protecting as a matter of domestic national security.

As an example of how economic dynamics drive security dynamics, one can consider federally funded research in the US. In 2009, a doctoral student at Duke University Ruopeng Liu allegedly took millions of dollars of metamaterials research back to the PRC, establishing a ‘shadow laboratory’ to replicate US advancements.⁵⁰ Now, university researchers must make disclosure statements relating to their employment, any engagement in foreign ‘talent recruitment programmes’, as well as supplying information to the government to permit due diligence on contracts, collaborative partners and funding bodies for all research they conduct.⁵¹ Thus, the expansion of broad ‘security concerns’ is premised on the potential loss of economic value in research, even in a university where research may be done for the ‘public good’. Money that the US government invests in research is inevitably linked to service the interests of the US and must not go towards underwriting the economic development of a foreign country.

Internationally, the linkage of economic dynamics and security dynamics is resulting in growing calls for funding bodies to play a greater role in the secure administration of university research. Indeed, the Council Recommendation refers to the principles of ‘responsible internationalisation’ which concluded ‘[r]esearch funders that support international cooperation should also be able to request … risk assessments to ensure that the necessary measures are taken to ensure responsible internationalisation’.⁵² These principles continue to highlight the need for the incorporation of ‘reciprocity’ – the notion that researchers should enjoy mutual benefits, influence and protections as outcomes of the research (as opposed to one-sided or uneven benefits for the parties).⁵³ Export controls are usually mentioned in research security contexts, but are considered blunt tools totally unsuited to the ‘generally’ fundamental research occurring in universities and higher education institutions.⁵⁴ Researchers likewise will give short shrift to economic security concerns relating to their work, often raising the arguments of open science,⁵⁵ non-discrimination in the face of academic inquiry⁵⁶ and academic freedom (which may or may not be protected by statute or constitutional provisions).⁵⁷

There are significant benefits to allowing economic dynamics to drive security dynamics. First, it resolves the contentious notion of ‘dual use’ technology – those classes of technologies said to have both military and civilian end-uses, as distinct from those with purely civilian applications. Dual use as a concept becomes entirely untenable where almost every critical technology currently being researched can support or augment military capabilities (even if not regulated by arms control instruments⁵⁸). If dual use is discarded in favour of controls based on economic security, technologies can be more easily identified and regulated based on a quantifiable assessment of their economic value to the domestic defence, manufacturing or industrial base of the state in question.

Moving on from that, other dichotomous regulatory lists with similar issues – such as technology-focused export control lists or lists of ‘security relevant’ (ie, high risk) biological agents⁵⁹ – can be gradually replaced or phased out. Given that these lists are generally adopted in the form of subordinate legislation or governmental declarations, they cannot adapt and react to research and developments at the speed at which the underlying tech markets operate. Identifying research into specific areas or technologies on the basis of their economic value to the controlling state permits a more nuanced and accurate form of regulatory intervention.

There are also contemporary changes in both the funding and manpower of research and development to consider. The commercialisation of universities has pushed most research ‘closer to the “D-end” of the R&D spectrum’, thus there has emerged a growing and more insistent need to protect the economic benefits of the work occurring at these institutions.⁶⁰ Researchers have always had impacts in the geopolitical arena; after all, it should be remembered that during the Cold War, the Soviet-Union and the US engaged in tit-for-tat intellectual property theft as a form of State-sanctioned espionage.⁶¹ Instead, when economic dynamics are permitted to drive security dynamics – especially where the geopolitical environment has become both vertically and horizontally more volatile – research security becomes easier to accept because it is ensuring economic viability as an arm of the national interest.⁶²

3.2 Calling out bad actors: Canada’s Sensitive Technology Research and Affiliations of Concern

The Canadian definition of research security is arguably less inclusive than that of the Council Recommendation, with the former referring solely to ‘the ability to identify possible risks to your work through unwanted access, interference, or theft and the controls that minimize these risks and protect the inputs, processes, and products that are part of scientific research and discovery’.⁶³ Originally circulated in 2015 by Public Safety Canada, Canada’s federal public safety ministry, as a roadmap of ‘safeguarding science’,⁶⁴ clarity in that definition has been largely supplied in response to a series of research scandals where knowledge has been compromised because of the actions of foreign entities.

The most infamous of these scandals was the quiet suspension, and then termination, of the employment of medical researchers Dr Xiangguo Qiu and Keding Cheng at the Winnipeg-based National Microbiology Lab (NML).⁶⁵ Qiu and Cheng, both Chinese nationals, had been the subject of a Canadian Security Intelligence Service (CSIS) investigation that resulted in the cancellation of their security clearances to work with highly infectious diseases at NML, including the Ebola virus. The CSIS report – originally classified and only tabled in Canada’s federal Parliament following a lengthy row between Prime Minister Justin Trudeau and the opposition⁶⁶ – documented significant research security failures over two years:⁶⁷

1. Qiu’s collaboration with a Major-General in the People’s Liberation Army and a top virologist at the Academy of Military Medical Sciences in the PRC;

2. Travel to the Wuhan Institute of Virology (paid by the PRC) to train Chinese scientists in the development of monoclonal antibodies;

3. The filing of a patent for an inhibitor of the Ebola virus with the Chinese National Institutes for Food and Drug Control, in which Dr Qiu was named as a contributor;

4. The shipping of live samples of Ebola and Henipah viruses to the Wuhan Institute of Virology.

Around the same time as the NML incident was occurring, Canada was stepping up its research security protections. Public Safety Canada published the document ‘Building Security Awareness in the Academic Community’⁶⁸ which put universities on notice of both the threat and possible risk mitigations, whilst ministerial statements made clear that research security was emerging as a political imperative.⁶⁹ In 2023, the U15 Group (representing Canada’s most research intensive universities) published a collation of practices they had identified as ‘best practice’ in research security.⁷⁰ At the same time, Canada’s Liberal government established the National Security Guidelines for Research Partnerships (NSGRP), obligating applicants for federal funding to complete a risk assessment and propose risk mitigations as a condition of that funding.⁷¹ In a report published last year assessing the impact of the NSGRP, Public Safety Canada identified that only 4% of applications had required more significant scrutiny, with 32 applications (out of 1,158 total applications received) refused on national security grounds.⁷²

Following the NML incident, research security protections in Canada were strengthened again in 2024 with the launch of the Policy on STRAC. STRAC made clear that researchers in so-called ‘sensitive technology areas’ would not be eligible to receive federal funding if they were affiliated with, or received funding or in-kind support from, ‘a university, research institute or laboratory connected to military, national defence, or state security entities that could pose a risk to Canada’s national security’.⁷³ The STRAC was essentially comprised of two components – the Sensitive Technologies Research Areas (STRA) list,⁷⁴ and the Named Research Organisations (NRO) list.⁷⁵ Research into any area on the STRA list could not be conducted with federal funding if the researcher was affiliated with, or receiving funding or in-kind support from, an entity on the NRO list.

Although the STRA list is relatively well established, entities can be added to the NRO list at any time, if and when the federal government forms the view that the entity will ‘pose the highest risk to Canada’s national security due to their direct, or indirect connections with military, national defence, and state security entities’.⁷⁶ In this way, the STRAC is highly adaptable and reactive to emerging or changing geopolitical realities by ‘calling out’ threats – an important aspect of providing security to economies that move at speed and scale. It is also important to note that both the STRA list and the NRO list are considered non-exhaustive. The STRAC clearly articulates that collaboration with any research partner involving a technology on the STRA list, or any other collaboration with an entity on the NRO list (ie, not involving an STRA technology), may still present risks to research security. Researchers continue to be encouraged to utilise the NSGRP for all forms of research collaboration, to underpin a deeper understanding of the partners to their research.

3.3 Calling in bad actors: the UK’s National Security Investment Act 2021

Turning now to the UK’s NSI Act, this piece of legislation – which came into force on 4 January 2022 – ties both inbound and outbound foreign direct investment (FDI) to concerns around national security. Entities that would gain control of either a ‘qualifying entity’ or ‘qualifying asset’ are required to notify the UK Secretary of State prior to gaining control by giving a ‘mandatory notice’⁷⁷ or, as part of due diligence, seek the Secretary’s consideration of the transaction by issuing a ‘voluntary notice’.⁷⁸ The Secretary is permitted 30 days to consider such notices, before concluding that either no action will be taken, or that the transaction will be ‘called-in’ for further review.⁷⁹ Qualifying entities or assets differ slightly in that:

1. A qualifying entity includes any natural person, corporation, partnership, not-for-profit or other legal entity, if they ‘carry on an activity’ as set out in the Schedules of the Regulations.⁸⁰

2. A qualifying asset includes ‘land, tangible, moveable property, and ideas, information or techniques which have industrial, commercial or other economic value (“intellectual property”)’ and ‘trade secrets, databases, source code, algorithms, formulae, designs … [and] software’.⁸¹

Call-ins can also be exercised by the Secretary at any time where either ‘a trigger event has taken place in relation to a qualifying entity or qualifying asset’ or ‘arrangements are in progress or contemplation which, if carried into effect, will result in a trigger event taking place in relation to a qualifying entity or qualifying asset’, and the relevant trigger event ‘may give rise to a risk to national security’.⁸² According to the Secretary’s statement on the use of the call-in power – made under section 3 of the NSI Act⁸³ – call-ins are ‘not a system for screening all acquisitions in the economy’ and intended to operate in relation to only a ‘small number of investments that could be harmful to national security, whilst leaving the vast majority of deals unaffected’.⁸⁴ Principal acquisitions that threaten UK economic security are those that ‘may lead to disruption, erosion or degradation to critical national infrastructure’, ‘present risks to governmental and defence assets’, ‘undermine the UK’s military, intelligence or security capabilities’ or permit foreign actors to build their own such capabilities.⁸⁵

Irrespective of the exercise of a call-in, the NSI Act imposes significant barriers to investment that does not conform with its terms. Where an entity moves to acquire any entity or asset that would ordinarily require consideration under the NSI Act, they not only commit a criminal offence but also any contract or act in furtherance of the acquisition is annulled by law.⁸⁶ The Secretary may also issue various orders if he or she is satisfied a risk to national security ‘has arisen or would arise’,⁸⁷ which can compel both positive and negative actions including orders of divestment of some part of the acquiring entity or cancellation of the transaction.⁸⁸ The terms, scope and breadth of the NSI Act is considered a critical aspect of UK research security; firstly because universities have been overwhelmingly targeted by call-in notices⁸⁹ and secondly because the NSI Act:

In this manner, the NSI Act is largely concerned with identifying aspects of ‘foreign ownership, control or influence’ (FOCI), a US concept traditionally applied to defence contracting and the protection of classified information.⁹¹ Any entity ‘under FOCI’ could risk access to classified information or contract because a foreign interest could ‘decide or direct … the entity’s management or operations’, or alternately a foreign government could exercise some power over the entity, either directly (ie, contractual means) or indirectly (ie, by appointment to the governing board).⁹² In both cases, the independence and autonomy of the contractor is, or could be, compromised by a foreign actor.

4.1 Selective fortification of the research enterprise

The notion of selective fortification has arisen by scholars examining the previous policy approaches from the establishment of the EU, where views of economic policy were largely divided into camps of ‘Atlantic Europe’ (collaborative policy, openness by default) or ‘Fortress Europe’ (nationalist policy, protective of municipal interests). The current literature suggests that such models can no longer survive the modern geopolitical environment.¹¹⁰ ‘Selective fortification’ – that is, the ‘develop[ment of] targeted instruments and institutional capacities that aim to insulate European firms from new patterns of international competition’¹¹¹ – is itself a rebranded version of the ‘high fence, small yard’ strategy (which focuses on targeted economic interventions rather than sweeping reform¹¹²). Put another way, research security as economic security should focus on ‘identifying and mitigating the security vulnerabilities that accrue from open, globally integrated markets’.¹¹³ This requires EU Member States to embrace the notion of economic dynamics driving security dynamics, and adopting specific and targeted legislation like the US CHIPS and Science Act to both incentivise domestic manufacturing/research, whilst discouraging and penalising foreign actions which threaten that domestic base.

Selective fortification aligns with practical observation of research security practices emerging in the wake of the Council Recommendation. Germany for example has published a Position Paper in response to the Zeitenwende (turning point in history),¹¹⁴ Italy has published a National Action Plan on research security,¹¹⁵ and Latvia and Estonia have seen the emergence of their security services as valued stakeholders in academic settings.¹¹⁶ They join well-established research security nation-states in the EU, such as France (which has recognised threats to research security in its Criminal Code since at least 2012¹¹⁷) and the Netherlands (where the National Contact Point has long coordinated discussions between academia and the national intelligence body, the AIVD¹¹⁸). Scholars in the field have also demanded that policies adopt principles of ‘responsible internationalisation’, involving a recognition of risk in international collaborations but advocating for heavy-handed governmental interference in only the direst of cases.¹¹⁹ These principles also recognise and accord with academic autonomy, substantial dips and rises in the sector’s homogeneity across the EU, as well as the ‘academic norms advocating international exchange, openness, and transparency’.¹²⁰ Selective fortification clearly incorporates these principles, invoking many states to engage in a marked ‘increase [in] state intervention in the emerging economies, the growth of state-owned enterprises and sovereign wealth funds, and the return of industrial strategy in the West’.¹²¹

Thus, each of the Member States could enact – in consultation with their domestic higher education providers and the Commission – domestic protections reminiscent of the US CHIPS and Science Act and protect domestic manufacturing and research bases. Obviously, this would require Member States of the EU to have a deep understanding of what areas of technology they specialise or lead the market in, or at least wish to develop a stronger sovereign capability in. Research into technologies or concepts outside of those considered ‘critical’ to the economy of the relevant Member State should be regulated lightly (if at all). Not only would this meet the overarching language of the UN General Resolution A/79/416 DR but is also defensible as an exercise of the sovereign interests of the relevant Member State. Alternately, such Member States could use existing or new laws (or economic value instruments) to disincentivise their domestic research and innovation markets from foreign inputs – noting that this not only has significant economic implications that would need to be accounted for but may also put individual Member States out of lockstep with the wider EU.

4.2 Balancing positive and negative interventions

Provisions of economic security across the EU – including those enacted for the purposes of research security – have also largely been focused on banning/limiting potential risky collaborations, and thus been devoid of positive economic security measures.¹²² For example, Hahn and Reinhold write extensively on the EU’s ‘promoting’, ‘protecting’ and ‘partnering’ measures under economic security declarations, to consider whether those are compliant with broader international trade laws under the auspices of the World Trade Organization.¹²³ The point here is not to consider whether these measures are sine qua non compliant with international obligations generally or in a particular case – more to observe that punitive measures in the EU economy security strategy ought to be combined with incentives.

For example, the two case studies examined above – the STRAC of Canada and NSI Act of the UK respectively – do not of themselves contribute positive measures in an economic security sense. But these policies do exist in a broader legal and policy network that can be marshalled for the purposes of regulating national security threats to the research enterprise. Canada administers around CAD$450 million in the Research Support Fund to help domestic institutions with programmes to ‘secure research from threats’,¹²⁴ whilst the UK operates the Research Collaborative Advice Team, a government agency designed to provide advice to researchers and institutions on methods for managing their research security risks.¹²⁵ Yet even these regulatory factors may still incorporate further negative measures:

To be truly viable, economic security measures that apply to research security should feature positive counterparts – tax or investment incentives, favoured trading status and tariff reductions. Returning to our earlier example where economic dynamics have driven security dynamics, one tranche of the CHIPS and Science Act of the US¹²⁷ provides US$52.7 billion in financial incentives for domestic production of semiconductors under the CHIPS Program Office (whilst simultaneously limiting overseas supply of semiconductors to foreign nations) as well as supplying funding to the National Science Foundation and US universities to strengthen research security.¹²⁸ EU Member States would do well to incentivise the pursuit of research security measures with financial benefits (recalling that LERU and CE7 called for exactly this in late 2024).

Aspects of the AUKUS Agreement between the US, UK and Australia serves as yet another exemplar of positive incentivisation of economic (and research) security – Australia and the UK became members of a licence-free environment from some of the more draconian provisions of the US International Traffic in Arms Regulations.¹²⁹ The excision of both Australian and UK environments serves as a powerful incentive for defence researchers, innovators and contractors to supply their knowledge and materiel in ways that support the broader achievement of US foreign and industrial policy. The EU Member States could also learn from the experiences of the US in forging these crucial pieces of legislative enablement of their domestic capabilities, by examining the export control regimes (especially as they apply to university research) for ways to exempt ‘trusted’ partners from permit obligations and thus incentivising the sharing of research with partners in ways that achieve their national security objectives.¹³⁰

4.3 Blending hard and soft law: what role for flexibility?

Where economic security measures are already written into the legislative restrictions (‘hard law’), Member States should also be contemplating whether such measures have articulated circumstances of flexibility or exemption to permit each institution to set some aspect of their research security policy settings (‘soft law’). Economic security from both the position of the EU and its individual Member States will increasingly come to rely on ‘more common and integrated policy action’, and this in turn requires that ‘the need to pool more sovereignty to achieve economic security needs to be recognised’.¹³¹ This is in fact one of the significant benefits of the EU legislative environment: each Member State must consider for themselves the law and policy settings applicable within its jurisdiction (subject to compliance with other EU or transnational legal instruments or treaties). On the other hand, Member States also need to cleave to the principles established inter alia by the European Parliament and Council of the EU, to ensure that no gaps in regulatory or legislative coverage can arise which might permit regulatory arbitrage – that is, the avoidance of onerous or restrictive regulation in one state by basing their operations in another, to the detriment of the wider market.¹³²

The UK NSI Act outlined earlier is a positive exemplar for the blend of hard and soft law. For example, the rigid provisions of the NSI Act are supported by a ‘section 3’ statement issued by the Secretary of State.¹³³ Whilst a section 3 statement is a policy document, it is both required by law and must be informed by both national and international policy considerations. The Secretary of State may seek to amend a section 3 statement at any time to change (for example) the scope of ‘areas of the economy’ to which the call-in power might relate, the purposes for which the Secretary of State might exercise the call-in power and the diverse factors which the Secretary has committed to taking into account when considering whether to exercise a call-in. In doing so, the NSI Act and accompanying Secretarial statement impose two forms of economic security regulation. The first is a ‘gatekeeping function’ that invokes a security interest to establish a clear threshold for State intervention, ie, research requiring protection from foreign manipulation or interference will incur economic security consequences.¹³⁴ A second function of the NSI Act with relevance to economic security is the provision of ‘virtue signals’ to the market. Transactions which fall outside the NSI Act or Secretarial statement are not considered relevant for economic or national security purposes and can be used to signal or communicate confidence that such transactions are viewed as a low security priority.¹³⁵ Both the threshold for intervention and the virtue signals to the market are entirely scalable and changeable, and may be amended by the Secretary of State to take account of changes in the prevailing market or shifting geopolitical conditions.