National Security - Related Policy

1. Introduction

This policy addresses the risk that technology or knowledge developed as part of the work that the Academy supports could be misused by a foreign state to build capacity to target UK interests in a hostile fashion, or to control or repress their population. It also addresses the risk that a foreign state could try and gain influence or access to connections and networks through the Fellowship nomination process. It also looks to support wider measures to ensure the security and integrity of the UK research and innovation sector, and its international partnerships.

2. Scope

This policy applies to all Academy activities. It focuses on our research and innovation grant giving activities, work with international partners, and on our Fellowship nomination processes. It applies to all staff, Fellows, others assessing grant applications or nominating for prizes/awards, Academy grant and award/prize holders and recipient organisations.

3. Policy Statement

1.1 The Royal Academy of Engineering is the UK’s National Academy for engineering and technology, and we are proud of the contribution that engineering and technology make to the security of the United Kingdom and its allies. In all our activities we seek to minimise the risk that engineering and technology developed as part of work that we support could be misused by a foreign state (or hostile actors) to build a capacity to target UK interests in a hostile fashion, or to control or repress populations.

1.2  We strongly support the UK government’s ambition to build on UK’s Science and Technology strengths to purse long-term growth that is supportive of economic security and resilience, and project strategic leadership at the forefront of geopolitical competition. Hence, we also support measures to make it more difficult for potentially hostile states to gain access to sensitive UK research information, whilst seeking to make sure that those measures are not so burdensome as to harm the advantage that they are looking to protect. We will work with partners across the UK research system to support the security and integrity of the UK’s research system.

1.3  The Academy is committed to playing a progressive leadership role in all aspects of equity, diversity and inclusion within engineering and technology. We therefore strongly reject any behaviours that use national security concerns as an excuse for prejudice or hostility towards researchers of a particular ethnicity or nationality, or similar non-inclusive behaviour.

1.4  We are concerned that the Academy, given our connections to many of the UK’s leading engineering centres, may be a target for organisations seeking to gain unauthorised access to intellectual property, connections or networks We are likewise concerned that the Academy’s beneficiaries, both in the UK and around the world may similarly be targeted by organisations seeking to gain unauthorised access to intellectual property. We therefore make this policy public to highlight how the Academy and its beneficiaries should respond to this developing set of risks.

1.5 We seek to support both the vitality and the integrity of the system of international research and innovation collaboration, which is vital to the continued success of the UK’s research and innovation sector, and the realisation of many benefits around the world. We highlight the guidance provided by the National Protective Security Authority (NPSA) (formerly Centre for the Protection of National Infrastructure (CPNI)) on Trusted Research,  Secure Innovation and Foreign Influence Registration as central to that goal.

1.6 We highlight that the UK government has issued guidance on how export control legislation applies to academic research. This highlights that whilst there are exemptions for knowledge already in the public domain and for basic research, they do apply to applied research collaborations and taking research overseas. Failure to apply for the required licence can potentially carry severe criminal sanctions. Many of the Academy’s activities support applied research, making knowledge of these controls particularly important for our community.

1.7 We are committed to working globally, supporting excellent engineers around the world to promote social benefit, and convening international partners to develop solutions and systems that will help address the most pressing global challenges. We acknowledge that in doing so, we and our awardees will work with engineers from nations that have a wide range of relationships with the UK, including some where there are concerns of potential adversarial relationships. We are committed to guiding our awardees navigate this evolving landscape, including through raising their awareness about the risks their relationships may pose to future international investments and partnership opportunities.

1.8 This policy shall be updated from time to time reflecting new regulatory positions and any improved understanding of the risks to be managed. An up-to-date version can be found here.

4. Summary of Requirement

For All

• To seek to minimise risks that technology developed as part of work that the Academy supports could be misused by a foreign state to build a capacity to target UK interests in a hostile fashion, or to control or repress their population.
• To treat national security related risks with the requisite degree of care and diligence.
• To remain strongly committed to diversity and inclusion in all activities, remembering that national security concerns must never be used as an excuse for prejudice or hostility towards researchers and people of a particular ethnicity or nationality.
• To understand that the Academy may place reasonable restrictions upon some activities and that in some cases Nationality can be grounds for non-participation.  All such cases will be escalated to the Trustee Board for approval and would be to ensure that participation would not put the safety of an individual at risk.  If standard communication routes are not judged appropriate, to report concerns about national security-related risks according to the Academy’s Whistle Blowing Policy and Procedure.

For Academy grant holders

• To be aware of and comply with this policy.
• To be vigilant against any risk that their work may be adopted by a foreign state’s military or similar hostile organisation against UK interests or be misused by a state to control or repress populations.
• To report to the Academy any concerns about National Security that arise in their work. In particular, to report through their usual Academy contact point if they take on any new role associated with a foreign government and if they plan any new partnership with a defence firm or military organisation outside the UK.
• To take note of the guidance provided by the National Protective Security Authority (NPSA) on Trusted Research (https://www.npsa.gov.uk/trusted-research).
• If involved in an innovative company, to note the guidance from NCSC and NPSA on Secure Innovation and to be aware of the legal requirements of the National Security and Investment Act 2021.
• To be aware of the potential application of Export Controls to applied engineering and technology work and to abide by those laws, seeking guidance and support from their hosting organisation to do so.
• To attend training events around National Security risks organised by the Academy, their employer or research/innovation partners.
•  To abide by any specific risk mitigation plans put in place on grants.
• To highlight to the Academy if they believe their hosting institution is not providing them with suitable specialist support for managing risks around international collaborations.

For Research and innovation institutions applying for or hosting Academy grants

• To provide specialist support for their research staff around risks in international collaboration, export controls and related issues. This must be done in a way that ensures that researchers are not expected to undertake due diligence on their own projects. Rather, such checks should be the responsibility of experts in international collaboration risks not directly engaged in the same project. The costs of such specialist support should be considered an essential part of a well-founded applied technology research activity.
• To work in line with evolving sector guidance such as Universities UK’s report on “Security and risk: how universities can protect their research and people”:
• To link with the government’s Research Collaboration Advice Team (RCAT) within the Department for Science, Innovation and Technology (DSIT), which promotes government advice on security-related topics, such as export controls, cyber security and protection of intellectual property, and other specialist groups for sharing knowledge across the sector.
• To be aware that failure to suitably support research staff or to manage risks in National Security issues (in any activity, not only those directly funded by the Academy) may lead to an organisation being declared ineligible for Academy funding or being asked to give formal assurances to retain eligibility for Academy funding.
•  To report to the Academy any concerns about National Security that arise in conjunction with any Academy funded work. In particular, to highlight as soon as they are made aware of an awardee taking on any new role associated with a foreign government.
•  To ensure that any partner organisations, with respect to Academy funding, have been appropriately researched and that any risks associated with national security have been considered and mitigated.

 For Fellows and others making decisions on grant, prize, awards or membership applications/nominations

• To support security mindedness in all aspects of the Academy’s activities.
• To be mindful of potential national security concerns surrounding any application to the Academy for support or nomination to become a Fellow, and to alert the panel chair and supporting staff about any such risks.
• To be aware that failure to declare a national security related concern related to Academy activities can be considered grounds for an investigation into misconduct under the Fellows Code of Conduct.
• To ensure that, when an application has been flagged as containing export-controlled content, that the application in question is only accessed within the UK and to ensure that the application in any form (paper or digital) is not taken overseas.

For Academy Staff

• To be aware of and comply with this policy.
• To be aware of and comply with the Procedure Document for this policy (Annex A in the internal version) and in particular how it applies to grant making and international partnerships work.
• To notify a member of the Academy’s National Security Risks Group of any national security related concerns of which they become aware.
• To ensure their attendance and that of their direct reports at national security risk training, as requested by Academy National Security Risks Group.
• To be aware that failure to declare a national security related concern can be a disciplinary offence.
•  To include any national security related risks within risk registers at organisation, team, scheme or other levels as appropriate.
•  To ensure that appropriate due diligence and risk assessments have been conducted and recorded on all grant recipients ahead of funding and following a risk-based approach to intensity.  This includes consideration of national security related risks.
• To ensure, where programmes are at risk of applications including export-controlled information that any such applications are accessed/reviewed by staff, peer reviewers and panel members within the UK and to ensure that the application in any form (paper or digital) is not taken overseas.

5. Roles & Responsibilities 

The National Security Risks Group chaired by the Associate Director, Research Programmes and Awards with Executive Director, Product as senior sponsor, has responsibility for updating this policy and the associated National Security Risks Procedure Document. As appropriate, it may consult Audit and Risk Committee or relevant Academy Operating Committees for comment and advice on those procedures.
This group includes:

• The Executive Director, Product
• Associate Director, Research Programmes and Awards
• Head of Grants Processes and Operations
• Head of Risk and Compliance
• Associate Director Engineering Diplomacy
• Associate Director of Engineering Policy
• Head of Innovation, Analysis and Public Affairs.

This group will review any concerns on national security risks and decide on the Academy’s response, possibly after consultation with specialist representatives of government, expert Fellows, and Chairs of responsible steering groups and committees.

6. Training

Training will be delivered annually to impacted staff, Fellows, award holders and relevant external contributors, including new starters. This will be in the form of a mandatory training module to be delivered for staff explaining the national security risk policy, with case studies for how it is implemented across the Academy and the responsibilities of the National Security Risks Group. There will also be an annual online webinar on Trusted Research, with NPSA colleagues, for all award holders and staff to learn about the guidance available to collaborate securely with partners.

7. Policy Review & Compliance

All policy breaches shall be escalated to the Chief Operating Officer for further action. Any violations of the policy by employee may be subject to disciplinary action in accordance with the disciplinary process.