Case Studies

A collaboration opportunity was presented to the international group. Academics from the institution were invited to travel to an overseas university, deliver a series of guest lectures on their area of expertise (plant biology) and provide generic advice on establishing research facilities. Their travel and accommodation costs would be fully covered by the international partners, but they would not receive any further compensation.

The international group had initial reservations about this collaboration. Web searches relating to the overseas universities returned limited results and its representatives, although forthcoming in their disclosures, had been sporadic in their contact. Further enquiries, including contact with an overseas embassy, revealed that the proposed partner institution had been established for a year and had reached out to a number of UK and other international institutions and organisations for assistance and collaboration. A number of these collaborations had taken place without issue.

The international group determined that, with appropriate safeguards in place, the project was a promising opportunity. Despite not being financially lucrative to the university, the partner country would benefit from being able to improve local farming techniques and allow the university to develop a presence in an overseas market and could attract additional investment opportunities.

Following consideration of relevant advice, the UK institution ensured that:

• Travelling academics only took and had access to the information they needed while travelling, with safeguards in place so that they were temporarily unable to access collaborative datasets and their institution’s intranet whilst outside the UK
• Planned advice relating to research facilities were generic and high level, and not in conflict with the UK’s strategic export controls
• The academics understood that they were not to accept any further gifts or offers from the overseas institution, and advised on how best to decline offers in a culturally sensitive manner, so as not to offend their hosts
• Legal advice was sought before the trip, which found no problem with the collaboration agreement but identified that Virtual Private Networks (VPNs) were illegal in the overseas country, and recommended further input from cybersecurity colleagues.

The collaboration went ahead without issue. Although there has been limited engagement since the visit, the academics found the trip useful and have recommended the international group as a useful and necessary service to colleagues.

Following an agreement between their two institutions, a cohort of overseas Master’s students spent six months at a UK university. The students were expected to attend classes on campus and were assigned academic supervisors.

Although financial checks were completed before the agreement was finalised, further due diligence was not. Specific checks were not conducted to ensure compliance with UK strategic export controls.

Supervisors had minimal interactions with the students, assuming the visit co-ordinator to be in regular contact with them. This left the students unsupervised and free to approach researchers and ask to collaborate with them, as is normal academic practice.

Following multiple approaches, several students became involved in highly sensitive, export-controlled research projects and gained access to restricted facilities.

A request for access to a computing facility was granted by the co-ordinator with no additional oversight. The students shared the single-access card to visit the lab and other controlled areas.

Learning points

The university should have conducted a review of the work being undertaken. If the technology was controlled, an export licence should have been requested.

A range of techniques can be used to identify and exploit vulnerabilities at UK higher education institutions.

Locations containing sensitive research and materials must be appropriately protected. Following this breach, the card-operated door was replaced with turnstiles, to prevent multiple entries with a single card.

Clear management and oversight processes are required for visiting students and staff, including pre-arrival checks and regular points of contact. Supervisors of visiting staff must be aware of their obligations and responsibilities for the entirety of the visit.

Staff working on export control or dual-use technologies must understand and fulfil their obligations to protect their research and university IP, both at home and abroad.

An international graduate research student based in the UK maintained connections with a research group at a university in their home country.

The student sought permission to deliver a more formal partnership between the two research labs and offered to facilitate this. At the time, the research was not subject to export controls and, due to its initial small scale, the new partnership was exempt from sophisticated internal due diligence and oversight.

Following the establishment of the partnership, the student invited colleagues from the international lab to visit the UK institution, and made travel and other arrangements, and assisted with interpretation during their stay. About a year into the partnership, a UK research supervisor became concerned that the relationship was very one-sided. Despite the overseas lab being extremely well-funded, it was slow to follow up on emerging research and technology. Following a reassessment of the relationship, the supervisor realised that the research would likely become subject to export control restrictions and so terminated the partnership.

UK university staff later discovered that, during their visit, the delegation had taken detailed photographs of lab equipment for the purposes of reproducing the lab at their home institution. Inadequate supervision meant this breach was not identified at the time and the relationship was allowed to continue.

Learning points

Overseas partners may attempt to access the early-stage development of technology and research before it is subject to export control legislation.

Robust due diligence is necessary for all international partnerships, and may involve further investigation of the proposed partner and their identifiable associations to establish the size and scale of their operations.

There is a need for strict protocols for all visiting staff and students, conducted prior to campus visits and tours.

Visa invitation letters should only be authorised by suitably senior members of staff, not students.

As an exporter, you need to comply with strategic export controls and ensure that without an appropriate export licence is in place, where this is necessary. It is also possible that a compliance inspector from the Export Control Joint Unit (ECJU) will identify an irregularity during a compliance audit. If this happens, it is very important to report the irregularity (sometimes known as ‘voluntary disclosure’) to HM Revenue & Customs (HMRC) as soon as possible, as they are responsible for the enforcement of strategic export controls. If the irregularity was found on an ECJU-compliance audit, the compliance inspector will have informed HMRC and you are strongly advised to do the same.

Following a recruitment process, an international professor was appointed to a UK university.

Unknown and undisclosed to the university, the professor maintained paid involvement in a number of overseas government projects, including leading a national laboratory for applied military research.

To progress this work without regular travel, the professor hosted fully funded visiting research students from his overseas laboratory to research in the UK. These students were used to transfer dual-use research and technologies to the overseas lab.

Colleagues became concerned at the professor’s workload and ill-health. Following an approach from university staff, the professor confessed to holding an external position and operating a shadow laboratory.

The professor explained that the overseas contract placed him in a legally and ethically compromising position, prevented disclosure of the relationship without consent from the overseas government employer, and required him to work for many additional months a year.

In addition, he had been instructed to curtail his UK employment in the next year and return to the home country and laboratory, in line with the existing contractual agreement. The majority of the funded visiting graduate research students, it transpired, were directly linked to the overseas country’s military development activities.

Learning points

Academic staff and students are sometimes recruited to circumvent export control regulations and transfer technology without authorisation.

Although the institution had policies in place to identify overseas appointments and conflicts of interest, these procedures were not suitably robust. Institutions should promote a culture of vigilance, risk minimisation and support to identify vulnerabilities, particularly in relation to high-risk research areas.

University policies must require all staff to disclose all overseas appointments, consultancies or honorary positions held. Universities must take a proactive approach to confirming guest academics’ curricula vitae to ensure independent academic research is safeguarded.

A post graduate student received an unsolicited email from a researcher based outside the UK. The email congratulated the student on a recent co-authored journal article and asked if he would be willing to discuss the research and paper in more detail. The student did not recognise the emailer’s name or home university, but excited by the opportunity, responded saying he would be more than happy to discuss his work.

The student’s supervisor was glad to see the paper had received attention and indicated she would join the call if possible. She suggested that the student fill in a short online form, as required by the department before any form of international engagement. The student submitted the form and was advised the next day that he should decline the meeting. The email he had received was sent to several researchers across the institution – on a wide variety of research topics – and was deemed to be suspicious and unlikely to be genuine.

In this scenario, the student followed departmental protocol and the request for a discussion about the research was ultimately declined. What internal processes do you have in place to support academics

Several students from a Middle Eastern country would like to study medical science, including core subjects such as microbiology or toxicology, in the UK.

The core elements of the course are capable of misuse in a chemical and biological weapons programme.

The subject matter of a medical science degree course is likely to be in the ‘public domain’. Therefore the transfer of such ‘technology’ would be exempt from these controls. The course tutor need not seek an export licence.

A licence may be required if the students undertake more advanced research projects or practical study of pathogens or toxins, when using information or data not normally in the public domain.

A tutor must also apply for an export control licence on becoming aware or informed that the ‘technology’ being taught is intended for WMD purposes. Generalised concerns about WMD programmes is not normally sufficient justification.

Practical research in areas such as virology, bacteriology and toxicology fall under strict regulatory requirements in addition to export controls, such as health and safety legislation and the Anti-Terrorism Crime & Security Act 2001 (Part 6, Security of Pathogens).

Case study seven: Overseas students studying in and outside the UK

Two postgraduate students from South Asia with to study on advanced postgraduate programmes on the design and development of satellites.

One plans to attend full-time at a university in the UK. The other wants to study based on a split-site programme, part-time at the UK university and part-time with an institution in their own country.

Technology for the development and production of spacecraft is normally controlled under the relevant entry in the Dual-Use List (Category 9, Aerospace).

Face-to-face teaching of the student in the UK falls under the controls in Article 10 of the 2008 Export Control Order (transferring ‘technology’ within the UK).

Course tutors must apply for dual-use export licences to transfer course notes containing information not already in the ‘public domain’, outside the UK. This applies for both course notes that are physically exported or transferred electronically.

Technology for the development, production, or use of satellites specifically designed or modified for military use, falls under the UK Military List. Any electronic transfer to any destination is licensable.

A licence is only required for face-to-face teaching when the tutor is aware or informed that either student intends to put their teaching to ‘WMD purposes’.

The course tutor must get an export licence for online teaching of the student undertaking the split-site study when it involves the electronic transfer of teaching material. This is unless that information is already in the ‘public domain’.

Export Control licence approval is required for the transfer of technology including by intangible methods such as:

• Electronically via email
• File downloads
• Video conferencing
• Virtual learning environments
• Telephone conversations