Research Security Is Not Export Control

What Research Security Actually Does

Research security happens before the work begins. Before the collaboration is signed. Before the first experiment runs. It asks a set of questions that most organizations only think about after something goes wrong: ^[1]

Have we submitted all required disclosures to conduct this work? Are we partnering with individuals or organizations that appear on a government watch list? Does our institution understand and accept the reputational and funding risk of this collaboration? ^{[3, 4]}

Research security also asks whether the proposed partner has been forthcoming in their own disclosures. What does their collaborative network look like? Who else are they working with, and does that context change the picture?

The core question is: do we know our partners well enough to be both technically compliant and strategically aware? ^[2]

Where Export Control Fits

Export control looks at defined work and asks: am I prevented from sharing this technology or data with this foreign entity? It is an intrinsic part of the research security function, but the two sit at different ends of the timeline. ^{[5, 6]}

Research security casts a wide net while organizations are still scoping a collaboration. It gives decision-makers the context to say we accept this risk or we don’t. Export control looks at the output and asks whether the institution lived up to its obligations.

They are complementary. But treating them as interchangeable creates gaps. An institution can be fully export-control compliant and still walk into a collaboration that damages its reputation, threatens its funding, or ends up in a congressional report. ^{[7, 14]}

The Broader Threat Landscape

The research security conversation often defaults to military concerns, and for good reason. Several countries operate under policies that blur or erase the line between civilian research and defense applications. China’s civil-military fusion strategy is the most cited example, but it is not the only one. Other nations direct academic research toward state industrial objectives in ways that do not map neatly onto Western distinctions between civilian and military institutions. ^{[8, 15]}

But the risk is not limited to military modernization. Research security also addresses economic security. When a foreign government targets critical and emerging technologies through academic collaboration, the concern is not only that the research could support weapons development. It is also that it could accelerate a competitor’s industrial capacity in areas like advanced semiconductors, artificial intelligence, quantum computing, or biotechnology. The economic consequences of unchecked technology transfer can be as significant as the national security ones. ^[9]

This is why research security cannot rely on entity lists alone. A university that does not appear on any sanctions or export control list may still be embedded in a foreign government’s defense-industrial ecosystem. The institution’s role in that ecosystem is exactly the kind of context that research security is designed to surface. ^{[10, 11]}

The Co-Authorship Problem

Research security matters in part because outside observers rarely understand the complexity behind a published scientific paper. When a security firm, a congressional staffer, or a journalist sees a publication co-authored by a US researcher and someone affiliated with a foreign institution tied to a country’s defense or industrial policy apparatus, they draw a straight line. The assumption is that these researchers sat in the same lab, shared the same data, and worked toward the same goal. ^[12]

The reality is almost never that simple. There are many ways a US researcher can end up named on a paper alongside someone from a flagged institution without any wrongdoing having occurred.

These scenarios do not account for every case, and context matters. But they illustrate why a publication record alone is not evidence of a security failure. Without the context that research security provides, every foreign co-authorship looks the same from the outside. ^[4]

Why This Matters

Research security is imperfect. It does impact science. It creates a structure that asks researchers conducting fundamental research, and their parent organizations, to confront difficult questions: is the value of this science worth the risk to future funding if the collaboration ends up in a report that says the institution contributed to another country’s military capabilities, or gave a strategic competitor an advantage in a critical technology area? ^{[13, 4]}

The consequence is that not every collaboration will be approved. The science will not always win out. But the benefit is that when the institution does approve a collaboration, it can explain why. And when it declines one, it can explain that too. Future funding stays on the table because the institution demonstrated judgment, not just compliance.

That is what research security gives you that export control alone cannot.