"The Governor View" - Managing international security and risk

As every university knows, internationalism in higher education brings immense benefits - but there are associated risks and these are increasingly coming under the spotlight.

From Conservative leadership contender Rishi Sunak’s threat to close down Confucius Institutes to an investigation into a donation to an Oxford college from a company with links to an authoritarian regime, the connections between institutions at home with states, companies, organisations and individuals abroad are potentially headline news, present the risk of reputational damage and greater regulatory control.

The new legal duty on universities to have systems in place to manage and report potential risks, The National Security and Investment Act, became law in January.

It gives the government the right to scrutinise and intervene in business or commercial acquisitions across 17 areas of the economy that could harm the UK’s national security.

In the first use of its power in relation to higher education, Manchester University was blocked from licensing vision-sensing technology to a Chinese company because of a potential for it to be used in military drones or missiles. The university had referred the deal to the government in line with the Act and said it had satisfied all internal processes used to scrutinise international agreements.

As the case shows, the nature of what is regarded as a threat, and the threat actors themselves, are not static. According to UUK guidance, Managing risks in international research and innovation, state and non-state actors may target and seek to exploit academic institutions and collaborations – for example, to transfer or steal information and intellectual property.  Physical access to research sites and personnel offered by academic collaboration are also effective in obtaining and transferring or compromising research and expertise. Research and expertise can be accessed and transferred through academic institutions, state-linked entities, and private companies and individuals.

The role of governors here is seen as one of seeking assurances from the leadership team that the university has the systems in place to manage risk and, when necessary, to review those processes to ensure they are fit for purpose, robust and up-to-date.

“We are interested in making sure the university has the right processes in place and is capable of monitoring what’s going on so that we don’t fall foul of any rules,” said the chair of the governing body at a Russell Group university.

He described the management of risk as a balancing act that involves “fine dividing lines”.

“Of course this area is increasingly important and very much in the public eye,” he said. “The legislation is increasing and there are reputational issues as well. We see it as a very difficult, challenging and sensitive area partly because we, like other universities, have deeply embedded relationships with companies and businesses.”

Collaborations with universities and businesses in China, in particular, are important for financial reasons but governors are acutely aware that organisations in the country invariably have a state link.

“We have a long standing-relationship with Huawei (the Chinese telecommunications company), and with universities and institutes in China,” said the chair. “We have many, many Chinese students and students from many other countries coming to the university and the very last thing we want to do is to demonise them or the legitimate business and research activities which are going on extensively across the piece.”

The chair of governors at another university described a similar approach where the systems in place, implemented by the executive and heads of departments, were overseen by audit and risk and security groups and committees. The governing council undertakes the role of taking stock and seeing whether these procedures measure up to the potential risks.

“What we do is ensure the system is in place and then the executive takes that forward through our risk register process,” she said. “If anything emerged that needed Council’s view then it would be escalated to us.”

Governors pointed to expertise in senior teams but cautioned that researchers may need more awareness and training about security risks following the changes to the law.

“Staff working on acquisitions in professional services will be aware of these things. For less formal arrangement between researchers who are working with people abroad, that’s where it comes down to making sure the awareness is there,” said the governor of a post-92 university. “I think across the sector there is increasingly more training available to meet the ongoing struggle to raise awareness.”

A Russell Group governor makes a similar point: “Academics, who are free spirits and don’t have hard rules and regulation at their fingertips, need to understand what the limits are and work within them.”

Universities with strong research records may well have well established, good procedures and processes in place - including connections to relevant government departments and with firms well versed in security issues.  Institutions where research is less of a priority may have less experience and need to consider committing resources to the issue.

One governor said that working with UK firms such as BAE systems and Rolls Royce, which are working in sensitive areas, had made the university’s academics more conscious of the rules and regulations.

Even with expertise, governors said that new legislation leaves some room for interpretation. This runs the risk of institutions feeling they must report even innocuous collaborations and transactions, leading to an increase in bureaucracy.

“There are 17 key areas, such as emerging tech, where it is mandatory to notify government. But there are some more nebulous cases where you can make a notification if you think you should but you don’t have to – it’s a bit unclear,” said a governor at a post-92 university. “At the same time, there’s lot of pressure on universities to demonstrate their willingness to engage and be collaborative and proactive on this.”

There is also a sense that despite communications with government and other organisations, universities may lack intelligence on specific risks but these gaps in knowledge cannot be filled because of the sensitive nature of the intelligence.

For governors, the changing landscape of what constitutes a threat is problematic, not least for long-term planning.  At a recent meeting of the heads of MI5 and the FBI, China was identified as the "biggest long-term threat to our economic and national security". Yet under previous UK administrations, the country was regarded as a vital trading partner and universities were encouraged to create links.

 “In the Cameron years we were all encouraged to embrace China; people were always being sent out to China and there was a big economic push by government and we followed its lead,” said a governing body chair. “Clearly, there are now international dynamics we need to reflect on, but I think the government needs to reflect on the fact that it has given very mixed messages by first actively promoting and supporting these partnerships and now expecting universities – some of which have become financially very reliant on them -  to possibly withdraw from them."

The importance of international students and education and research partnerships means UK universities have to tread carefully.

If the souring of relations with China affected the flow of international students, for instance, the impact on some institutions would be catastrophic, according to one governor. He warned that the UK government would be unlikely to plug the funding gap that would be left.

“We are in a very sound financial position but at a stroke we could be in a very unsound financial position with all sorts of grief if China stopped allowing student to come to us.”

The impact on research of broken international relationships would be felt across the UK, he added: “When one looks at the development of universities in China and their research strengths, for our universities to remain world leading it is essential that we do have relationships with top research institutes, even in countries where we are not very happy about their regimes.”

Many of the reasons why connections with China were considered a good idea in the past still remain, the governor of a London university points out. She calls for a more nuanced approach to risk that takes into account the nature of the contact, rather than blanket suspicion.

There is a big difference between a university involved in a partnership with an institution in China based on cultural events linked to schools, and another collaborating at a high level with companies involved with science and technology that could potentially be linked to arms or intelligence, she added. 

“Rather than taking countries as a whole we should be looking at the risks of actual collaborations.”

Across the globe, many states, regimes and multi-national companies have problematic histories, policies and business interests. Governors question whether universities should, or have the capability to, move beyond due diligence before creating links.

“There are many countries with unsavoury records,” said one Russell Group institution governor. “And some of those are in the global south where we are being encouraged to share expertise and make connections. Do we refuse to collaborate with all their institutions and companies?”

UK universities need help and guidance in this sensitive space, according to one governor.

“We don’t have the expertise to research complicated money trails, investors and regime links thousands of miles away,“ she warned.

New restrictions and duties on universities could influence the decisions researchers make about collaborations and links overseas and lead to a form of self-censorship.

“There is pressure on universities to be proactive on security and risk,” said a governor at a new university. “It is too early to tell, but it has the potential to lead to a reluctance to enter into new arrangements.”