Latest thinking

Working together to navigate the grey-zone

How to reconcile research security and academic freedom in an era of global instability

 

I read with interest the recent comment piece in Nature by Sarah de Rijcke, rector magnificus and professor of science, technology and innovation studies at Leiden University, in which she sets out a series of principles to support academic freedom in universities (Six principles for supporting academic freedom in universities, Nature, Vol. 657, 24 September 2026). Among those principles, she argues that security and openness should be approached as a single responsibility and that academic freedom is an indispensable consideration in the design of research security measures. Citing  recent examples of new and proposed research security rules in the US and Europe, including those restricting international research collaboration and proposing security screening of researchers, she warns that concerns for security can quickly turn into broad restrictions on partnerships and access to data.

If security-related restrictions are necessary, she argues, then they should be specific, proportionate, time limited and open to independent review. Proportionality can be achieved through targeted export control rules for clearly defined dual-use technologies with both civilian and military applications, accompanied by independent review and sunset clauses.

As a manifesto for a balanced approach to research security, those arguments make absolute sense. However, they also got me thinking about the trade-offs inherent in responsible global engagement in research. From the standpoint of the research office, it brought to mind the practical (and thorny) question of how we strike the right balance between limits on research or collaboration in the name of research security on the one hand, and academic freedom on the other.

What might specific, proportionate processes look like in a world where, by contrast, dual-use appears increasingly ill-defined and staff in university research offices find themselves grappling with the complexities of the grey-zone?

 

Disorder, competition and restless technology

To unpack this security-versus-freedom dilemma, a good place to start is by considering the broader dynamics that have made the practice of research security so much more challenging in recent times.

The past five to ten years have seen a significant change in the landscape of international relations. A global order that had been relatively stable for decades has begun to weaken markedly. International norms that had been accepted as, well, normal, are being challenged on multiple fronts.  The authority of global institutions is being called into question in ways that would have been hard to imagine twenty years ago. Russia’s ongoing aggression against Ukraine is an obvious illustration of the retreat of the international rules-based order.  However, there are numerous other flashpoints around the world where state and non-state actors are driving bloody and intractable conflicts in pursuit of a plethora of competing interests.

Away from the military sphere, great powers are locked in strategic competition for the technologies of the future and control of the raw materials and supply chains needed to secure them. Emerging technologies have the potential to change the character of warfare in really significant ways. Applications in materials science and nanotechnology for example, could provide enhanced capabilities in stealth technology and camouflage, while quantum technologies could help to defeat those same gains. AI has the potential to drive advances across a whole range of military domains, from managing logistics and intelligence analysis to supporting navigation for autonomous vehicles and target recognition.

The UK government’s Strategic Defence Review, published in June 2025, provides a useful framing for these developments when it describes the emergence of two high-level, or ‘macro’ trends. The first, a growing multipolarity and intensifying strategic competition between states is accompanied (and amplified) by the second, namely rapid and unpredictable technological progress, the latter also having the effect of driving strategic competition (Ministry of Defence (2025), Strategic Defence Review. Available at: https://www.gov.uk/government/publications/the-strategic-defence-review-2025-making-britain-safer-secure-at-home-strong-abroad. See page 26).

 

Regulate the known risks, but what about the unknowns?

Against this turbulent background, governments are responding by seeking to prevent the proliferation of military and military-adjacent technologies to bad actors, while at the same time preserving critical markets and supply chains.

In the UK and elsewhere, export control and sanctions regimes are used to prevent malign parties gaining access to military and dual-use goods, software and technology. The National Security and Investment Act 2021 provides government with powers to screen and intervene in research involving emerging technologies and critical national infrastructure.

The advances aren’t just at the exquisite, cutting-edge end of the spectrum however. The availability of commercial, off-the-shelf equipment and components that can be adapted for military purposes bring a huge range of capabilities within the reach of state and non-state actors who may not have been able to access them in decades past. There are well documented examples from the war in Ukraine, for example, of commercial or industrial (rather than military) grade components produced in western countries being recovered from the wreckage of North Korean-made missiles used in attacks on civilian targets. These items are dual-use for sure, but they don’t necessarily appear on any export control list. Instead they pass under the radar, entering complex international supply chains only to re-emerge thousands of miles away amid the destruction of war.

For research security practitioners, this trend in particular illustrates why universities and research institutions need to look beyond approaches that focus solely on export control lists and NSI Act sensitive sectors. In a world where relatively simple technologies can be adapted at low cost to support a variety of military and related applications, it’s becoming more important than ever to understand the full range of potential end-uses that research might have, and the intentions of our partners. How well do we really know our collaborators? What about our collaborators’ collaborators?

 

Taking the research security dialogue to the next level

At its best, risk assessment in research security has traditionally operated as a partnership between the research office and the research community. Research support staff understand the regulatory and advisory frameworks that are relevant to proposed projects, while the researchers bring their detailed knowledge of technologies, specifications and capabilities. Taken together, that combination of experience and expertise allows the assessments to be made.  

As we’ve seen though, the modern environment presents research security professionals with a three-pronged challenge.  Unpredictable technological advance, non-traditional adaptations of basic technologies for military end-uses and increasingly complex international supply chains combine to create a disorientating grey-zone, where understanding the objective risk posed by individual collaborations becomes all the harder.

In the absence of clarity, there’s a risk that blanket, indiscriminate restrictions are called upon to fill the vacuum.

One answer to this conundrum, and a way to strike a pragmatic balance between security and academic freedom, is to build on the partnership model of risk assessment by developing enhanced processes that take the dialogue between institutions and their research communities to a deeper level.

Proportionality is important here, though: enhanced review processes aren’t warranted for every proposal. However, where known risk factors including the field of research, or connections with riskier destinations are present, asking some relevant additional questions can provide institutions (and researchers themselves) with valuable extra reassurance.

 

Know your people, know your partners, know your technology

An enhanced partnership methodology builds on existing export control, security and partner due diligence checks by adding additional elements that fall into three main categories: know your people, know your partners and know your technology.

Know your people aims to address the person-centred risks that can defeat even the most comprehensive form- and checklist-based systems. From the research office, it means a greater emphasis on explaining and raising awareness of the contexts that underpin research security. Why does extra care need to be taken with research-related links to certain countries and regions of the world? How might informal collaboration and additional affiliations cause problems (and how might those issues intersect with funder and employer expectations around transparency and conflict of interest)? What risks do longer term collaborative arrangements like visiting positions pose and what sensible measures can we take to mitigate those risks?

Know your partners broadens the scope of due diligence beyond partner institutions and includes a focus on prospective collaborators themselves. Who are they, who do they collaborate with, who funds them and how does our contribution fit into their research aims?

Know your technology asks the research community for detailed awareness of the full research lifecycles that surround their technologies, including downstream value chains. Who controls the raw materials and components? Who has the capacity and resources to scale for commercialisation? What is the range of potential end-uses, beyond the proposed outputs of the immediate project?

 

Pragmatism and proportionality

When incorporated into pragmatic, well-designed processes, these three elements can make a real, positive, difference to the strength-in-depth of institutional research security capabilities. Not only do they help to identify the proposals that warrant escalation for additional checks, they also build grassroots research security awareness among the research community. This is particularly important for those colleagues working in early stage research in emerging and fast developing disciplines. Helping everybody to better understand the risk vectors for themselves builds agency, helps individuals to assume greater responsibility for their own choices and, over time, can erode the notion of research security as an imposition from above.

This post began with a call for proportionality and it’s important to be clear that measures like these aren’t in themselves definitive. At the same time, they don’t involve blanket restrictions, nor do they imply, or pre-suppose, no-go areas. A finding of concerns wouldn’t necessarily mean a halt to a proposal, but it could well result an escalation to RCAT or an end-user advice check.

Developing critical awareness of the risks entailed in international collaboration isn’t just about short-term mitigation, it’s about building a risk aware research community and a clearer understanding of mutual accountabilities. Freedom with responsibility.

 

Note: the content of this post is for information purposes only and is not intended to be a comprehensive review of all developments in the law, regulation, or practice in this field, or more generally. It does not constitute legal or professional advice. Information may be out of date by the time you come to read it. Readers should verify critical information and obtain independent professional or specialist advice before applying it to specific situations or transactions. All content on this blog is provided subject to this website’s Terms of use.