Are universities equipped to catch foreign influence and national security risks?

Ireland has given its universities a new responsibility in assessing international research partnerships for foreign influence and national security risks, now it needs to help them deliver it

Universities are increasingly working in areas such as artificial intelligence, semiconductors, quantum technologies and biotechnology where academic research, commercial value, and national security can significantly overlap. File picture

Ireland’s first national research security guidelines were published and issued to third-level institutions last week. 

They mark a significant shift in how universities are expected to assess their international research partnerships.

For the first time, institutions are being asked to look beyond the academic and commercial merits of a collaboration and consider questions of national security, geopolitical risks, sensitive technologies, and foreign influence. 

These guidelines are set against a backdrop of a greater focus on national security considerations in commercial transactions, including the introduction of a national screening regime for third-country transactions and revised export control legislation.

The guidelines are proportionate, non-discriminatory, and deliberately avoid blanket restrictions on particular countries or fields of research. 

That is welcome. Researchers should be able to work with colleagues across borders without every overseas partnership being viewed through the lens of national security.

The challenge will be implementing the new structures, procedures, and training required by the guidelines, while also developing the capability and expertise to make the judgements they now demand.

The guidelines identify a real and growing challenge. 

Universities are increasingly working in areas such as artificial intelligence, semiconductors, quantum technologies and biotechnology where academic research, commercial value, and national security can significantly overlap.

Consider the position of a university approached about a promising international research partnership involving advanced technology. 

The researchers involved may see significant academic potential. The university must also ask harder questions. 

• Who ultimately controls the prospective partner? 
• Could the research have military applications? 
• Is valuable intellectual property at risk? 
• Are there export-control or sanctions issues? 
• Is there information available to government that the university simply cannot access?

Under the published guidelines, much of that judgement rests with the institution.

The guidelines specifically warn against overly defensive approaches that unnecessarily restrict legitimate collaboration. 

Universities are therefore being asked to distinguish genuine security risks from legitimate international research, often in highly sensitive areas.

There is nothing inherently wrong with institutional responsibility. 

Universities know their research better than any government department ever could. But responsibility without capability is a very different matter.

The contrast with Britain is instructive. The UK has a dedicated research collaboration advice team which acts as a first point of contact for universities facing national security questions around international research. 

It can draw on expertise across government and works alongside bodies including the national protective security authority and national cyber security centre.

Diarmaid Gavin: Universities know their research better than any government department ever could. But responsibility without capability is a very different matter.

This is not some theoretical Whitehall structure. 

By March this year, the team had carried out more than 3,800 engagements with institutions and handled more than 500 individual cases. 

Universities still make decisions. They simply do not have to make every difficult decision alone.

The Netherlands has taken a similar approach, establishing a national knowledge security contact point which institutions can approach for practical advice about the risks and opportunities involved in international partnerships.

Ireland, for now, is asking institutions to begin building that capability while much of the national support architecture is itself still being developed. 

Ireland, unlike most European states, does not have a standalone national intelligence agency whose role in providing risk intelligence would be important to the effective operation of these guidelines.

A large, research-intensive university may be able to build a dedicated team with expertise spanning research governance, cybersecurity, export controls, sanctions compliance, intellectual property, and international partnerships. 

A smaller institution may have the same person dealing with several of those areas already.

Ask both institutions to perform increasingly sophisticated security assessments within existing resources and the outcome is predictable. 

One may be able to develop a comprehensive specialist system, while the other may have to absorb the same responsibilities into already stretched structures. 

Without sufficient shared support, there is a risk that the effectiveness of the national approach will vary according to the capacity of individual institutions.

Research security cannot become another item on the compliance checklist.

Nor should the answer be to retreat from international collaboration. Ireland is a small, open economy with a research system that depends heavily on international relationships. Our openness is an advantage worth protecting.

That is why the philosophy underpinning these guidelines is right.

However, as implementation moves beyond the initial preparation phase, guidance will need to be matched by practical supports and access to specialist expertise.

Ireland should develop a central advisory capability that universities can turn to when a partnership raises questions that cannot reasonably be resolved through institutional due diligence alone.

There is already an Irish precedent for providing shared national expertise. 

Knowledge Transfer Ireland (KTI), established by Enterprise Ireland, provides a central source of guidance on research commercialisation, including the national IP protocol, model agreements and practical guidance for research-performing organisations.

Its remit is different, but the model is instructive. 

Rather than requiring every institution to independently develop expertise in complex and evolving areas, Ireland could consider whether KTI — or a similarly structured national function — could form part of the support architecture for research security.

The State does not need to make research decisions for universities, but it does need to ensure they have access to the expertise, information, and practical support required to make those decisions well. 

Ireland has now identified the problem and placed much of the responsibility for managing it with research institutions. 

The next step is to give them the capability to carry that responsibility effectively.

• Diarmaid Gavin is head of corporate and commercial and the research, innovation and technology practice at RDJ, where he advises Irish universities on research collaboration and compliance matters