Researchers who travel domestically or overseas should be aware of security considerations that apply to themselves. Our office has provided a list of some useful travel tips for those of you who work on any sponsored research.  These tips are useful for any traveler and are often overlooked in the rush to acquire tickets, hotel reservations, visas, etc.

Please remember that secure research cannot be conducted outside the United States – this includes traveling with devices that may contain research.  Please contact us or the Export Control office with any questions as they may pertain to your situation: researchsecurity@uconn.edu or exportcontrol@uconn.edu

Depending on your travel situation, we are available to provide country-specific travel briefings.  Please contact our office researchsecurity@uconn.edu to arrange an agency briefing.

All university-sponsored international travel requests are routed through the Concur system, of which the Export Control office is part of the approval workflow for specific destination countries, to included sanctioned and high-risk countries.

Travelers to sanctioned countries are prohibited from taking regular use laptops, tablets, and/or university-provided equipment.

Loaner equipment is provided to travel to high risk countries to ensure sensitive or export-controlled information, data or materials with them.

If you are planning to travel to a country which is comprehensively sanctioned by the United States Government, you are required to submit a Pre-Travel Application for Embargoed Country Travel.

Contact exportcontrol@uconn.edu with any questions, to access the Pre-Travel Application for Embargoed Country Travel form, or to request a pre-travel informational meeting.

 

Travel Security ‘101’

Every time you move away from your residence, place of work, or some other safe static location you need to focus on what is going on ‘around you’; to be always situationally aware.  Notice what is ‘normal’ to include people, objects, and environment and pay attention when that ‘normal’ adjusts or changes.  Never disregard your gut feeling as the human body amazingly is able to detect stimulus long before our brains consciously pull it all together.  Prepare for the unexpected.  Noticing small things consistently can better assist with preparing yourself and those you might be traveling with anything threat-wise that may come later.

 

Plan Ahead

Always be prepared before you travel, research where and how you are traveling, staying, or living – – what does the on-the-ground situation look like?  Are there beyond normal security and safety considerations to focus on?  Areas to avoid?  Ongoing demonstrations and/or political strife that could affect movements and onward travel?  Your pre-travel preparations should be deliberate and fulsome.

 

Keeping A Low Profile

Do your best to minimize unwanted attention.  Review what you are packing or wearing, clothing, jewelry, and even overtly displayed religious items if you typically display them on your person.  Avoid items that might necessarily identify you as an American by alternately wearing non-descript attire that enables you to blend in as best as possible especially moving through public venues.  Do not accept letters, personal messages, photographs, packages, or other material to be carried in or out of the country.

 

Airports and Airplanes

Arrive early for your flights and proceed as quickly as possible through check-in and security to your gate as this offers the best level of in-depth security against a possible terrorist or criminal threat(s).  Keep close control of all carry-on items and stay alert to those other passengers and airport personnel moving around you until you board the aircraft.  Once onboard, pay attention to the location of the closest exits by counting rows of seats, both in front and behind if that is your closest exit.  Remember if and when smoke fills the cabin, you will be unable to see the lighted strips on the floor so counting seats and placing that fact in your muscle memory can be critical in evacuating safely.  When placing carry-on bags in overhead compartments, place them with their zippers and openers towards the back making it more difficult for potential thieves to get inside.  If placing bags underneath seats, turn your bag upside down to cover the zipper or even wrap the bags strap around your foot for an additional security measure.

 

Hotel Safety

Request a room between the second and fifth floors as those are rooms too high typically for thieves but would allow fire equipment to reach in the event of a potential fire emergency.  Locate your closest emergency exit(s) and develop a plan when/if there is a fire or other emergency where quicker egress is necessary minus using elevators.  When in your room, always use all the provided door locking hardware, and check to ensure if there are any opening windows or sliding glass doors, that they too are secured properly.  Keep your room neat so you can quickly notice anything that might be out of place or conversely messy which might do the same trick.  When leaving the room typically use the ‘do not disturb’ sign on the door and keep a light on and the television also at a low volume to give the impression that someone is in the room.

 

Vehicle Safety

Always keep your doors locked and windows rolled up, especially if transiting busy thoroughfares with multiple stoplights or anything that reduces your vehicle speed.  Leave distance between you and the vehicle in front of you, typically if you cannot see the rear wheels of the vehicle in front, then you are too close and would be unable to move in the event you needed to. When parked, find well illuminated areas and keep any valuables you might have locked in your trunk and out of sight to passersby.

 

​​​​​​​Other Travel Related Resources

The U.S. Department of State, Bureau of Consular Affairs maintains a comprehensive library of information that can help you prepare for a unexpected crisis overseas. Their site includes links to additional information about other aspects of security for persons living overseas, including children.

The U.S. Department of State Smart Traveler Enrollment Program (STEP) is a free service to allow U.S. citizens and nationals traveling and living abroad to enroll their trip with the nearest U.S. Embassy or Consulate, receive information from the Embassy about safety conditions in the destination country, and help the U.S. Embassy contact you in an emergency, whether natural disaster, civil unrest, or family emergency.

Traveling overseas with mobile phones, laptops, PDAs, and other electronic devices from The National Counterintelligence and Security Center.  Additionally, the Air Force Office of Special Investigations has created a similar brochure with additional information

U.S. Department of State Current Travel Warnings are issued to describe long-term, protracted conditions that make a country dangerous or unstable. A Travel Warning is also issued when the U.S. government’s ability to assist American citizens is constrained due to the closure of an embassy or consulate or because of a drawdown of its staff.

Also see the CIA World Factbook, which contains a plethora of excellent travel data in one-page synopses.

The State Department’s annual Country Reports on Terrorism details key developments in 2020 in the global fight against international terrorist groups.​​​​​​​

 

What Is Academic Solicitation?

Academic Solicitation is the use of students, professors, scientists, or researchers as collectors improperly attempting to obtain sensitive information. Placing academics at, and requesting to collaborate with, U.S. research institutions under the guise of legitimate research in order to access developing technologies and cutting-edge research. These attempts can include requests for, or arrangement of, peer or scientific board reviews of academic papers or presentations; requests to study or consult with faculty members; and requests for and access to software and dual-use technology. Academic solicitation can also occur when a faculty member, student, employee, or visiting scholar seeks access to this same information. The number of foreign academics requesting to work with classified programs continues to rise, and the academic community will likely remain a top target for the foreseeable future. Although most academic contacts are likely legitimate, some foreign academics may ultimately take advantage of their placement and access to further their country’s research and development goals. 

 

Who Is Being Targeting? 

• Researchers, scientists, and subject matter experts conducting research/ projects on behalf of a U.S. Government customer 
• Researchers, scientists, and subject matter experts employed at academic institutions or with published in scientific or technical journals or presented at conferences
• Students, professors, and researchers with access to research and technical information (especially graduate and post-doctorate students) 
• Researchers, scientists, and subject matter experts working on cutting-edge technology 
• Subject matter experts teaching technical courses

 

What To Report  

Any contact (i.e., emails, telephone, personal contact) that is suspicious because of the manner or subject matter of the request. This may include requests from U.S. persons or from foreign nationals located in the United States or abroad, and may consist of:  

• Unsolicited applications or requests for undergraduate, graduate, postgraduate, or other research positions 
• Unsolicited requests for access to research papers or other research-related publications or documents 
• Unsolicited requests for assistance with or review of thesis papers, draft publications, or other research related documents 
• Unsolicited invitations to attend and/or present at international conferences
• Unsolicited grants or gifting of funds/equipment to conduct joint research projects from foreign academic institutions or foreign governments

 Contact the UConn Research Security Office at researchsecurity@uconn.edu with any concerns or questions.  If you suspect academic solicitation is taking place you can also file an anonymous report at compliance.uconn.edu. 

 

Economic Espionage

Economic espionage is foreign power-sponsored or coordinated intelligence activity directed at the U.S. government or U.S. corporations, establishments, or persons, designed to unlawfully or clandestinely influence sensitive economic policy decisions or to unlawfully obtain sensitive financial, trade, or economic policy information; proprietary economic information; or critical technologies. This theft, through open and clandestine methods, can provide foreign entities with vital proprietary economic information at a fraction of the true cost of its research and development, causing significant economic losses. 

 Our Nation’s secrets are in jeopardy, the same secrets that make your company profitable. The FBI estimates billions of US dollars are lost to foreign competitors every year. These foreign competitors deliberately target economic intelligence in advanced technologies and flourishing US industries.  

Foreign competitors operate under three categories to create an elaborate network of spies: 

• Aggressively target present and former foreign nationals working for US companies and research institutions;
• Recruit and perform technical operations to include bribery, discreet theft, dumpster diving (in search of discarded trade secrets) and wiretapping; and,
• Establish seemingly innocent business relationships between foreign companies and US industries to gather economic intelligence including proprietary information.

 What Are Trade Secrets? 

Trade secrets are all forms and types of financial, business, scientific, technical, economic or engineering information, including patterns, plans, compilations, program devices, formulas, designs, prototypes, methods, techniques, processes, procedures, programs, or codes, whether tangible or intangible, and whether or how stored, complied, or memorialized physically, electronically, graphically, photographically or in writing, (1) which the owner has taken reasonable measures to protect; and (2) which have an independent economic value from not being generally known to the public.  

Commonly referred to as proprietary information, economic policy information, trade information, proprietary technology, or critical technology. 

 What Are Some Methods Of Targeting Or Acquiring Trade Secrets? 

• Steal, conceal, or carry away by fraud, artifice, or deception;
• Copy, duplicate, sketch, draw, photograph, download, upload, alter, destroy, photocopy, replicate, transmit, deliver, send, mail, communicate, or convey; and,
• Receive, buy, or possess a trade secret, knowing the same to have been stolen or appropriated, obtained, or converted without authorization.

 Know The Signs 

• Working odd hours without authorization 
• Taking proprietary information home without authorization
• Unnecessarily copying material 
• Disregarding company policies on personal software and hardware 
• Accessing restricted websites
• Downloading confidential material 
• Conducting unauthorized research

Personal Behaviors 

• Unexplained short trips to foreign countries 
• Engaging in suspicious personal contacts with competitors, business partners or unauthorized individuals 
• Buying items they normally cannot afford
• Overwhelmed by life crises or career disappointments 
• Showing concern about being investigated

Common Factors  

• Financial need 
• Greed 
• Unhappiness in the workplace 
• Different allegiances to another company or country 
• Drug/Alcohol abuse 
• Vulnerability to blackmail 
• Job offers from other organizations

Targeted Industries Or Sectors 

• Information and communication technology 
• Business information that pertains to supplies of scarce natural resources or that provides global actors an edge in negotiations with U.S. businesses or the U.S. government 
• Military technologies (marine systems, unmanned aerial vehicles, and aerospace/aeronautic technologies) 
• Civilian and dual-use technologies in fast-growing sectors (clean energy, health care and pharmaceuticals, and agricultural technology)
• Academia

 https://www.fbi.gov/video-repository/newss-the-company-man-protecting-americas-secrets/view 

As part of a nationwide campaign to raise awareness of the growing economic espionage threat, the FBI has released a short video, “The Company Man: Protecting America’s Secrets.” Based on an actual case, the video illustrates how one company was targeted by foreign actors and what the FBI did to help. 

 Contact the UConn Research Security Office at researchsecurity@uconn.edu with any concerns or questions.  If you suspect economic espionage is taking place you can also file an anonymous report at compliance.uconn.edu.

 Controlled Unclassified Information (CUI) is information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that requires safeguarding or dissemination controls consistent with applicable laws, regulations, and Government-wide policies but is not classified under Executive Order 13556 “Classified National Security Information” or the Atomic Energy Act, as amended. 

  CUI Regulations

The CUI security controls must be compliant with the federal regulations specified in 32 CFR Part 2002(link is external) and by the National Archives and Records Administration (NARA), who acts as the CUI Executive Agent (EA) to oversee the federal agency CUI compliance. The most commonly encountered Federal CUI requirements and guidelines include:

NATIONAL INSTITUTES OF STANDARDS AND TECHNOLOGY (NIST) SPECIAL PUBLICATION (SP)

• NIST SP 800-53r5(link is external) – Security and Privacy Controls for Federal Information Systems and Organizations
• NIST SP 800-171r2(link is external) – Protecting CUI in Nonfederal Systems and Organizations
• NIST SP 800-172(link is external) – Enhanced Security Requirements for Protecting CUI: Supplement to 800-171 Rev. 2

FEDERAL ACQUISITION REGULATION (FAR) SECURITY REQUIREMENTS

• FAR 52.204-21(link is external) – Basic Safeguarding of Covered Contractor Information Systems

DEPARTMENT OF DEFENSE FEDERAL ACQUISITION REGULATION (DFARS)

• DFARS 252.204-7012(link is external) – Safeguarding Covered Defense Information and Cyber Incident Reporting
• DFARS 252.204-7020(link is external) – NIST SP-171 DoD Assessment Requirements
• DFARS 252.204-7021(link is external) – Cybersecurity Maturity Model Certification Requirements

Other requirements and guidance as directed in agency-specific regulations and certain legal documents may also apply.

“Information” as defined by the Federal CUI Program may include research data and other project information, including non-public Federal Contract Information (FCI).  FCI is normally protected in accordance with FAR 52.204-21 when a research team receives, possesses, or creates FCI in the performance of a sponsored contract.

“Information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. Information systems may include electronic media, non-electronic media, and physical environments.

 

CUI Onboarding

UConn research contracts, projects, and/or meetings that have Controlled Unclassified Information (CUI) as indicated in the research contract, we will need to meet with the University Research Security Office to display the documents listed below in order to complete their USPERS/citizenship verification.

 The United States Government has instituted a requirement that United States Persons (USPERS) be granted access to CUI. The Government defines a USPERS for the purpose of CUI access as those naturalized citizens, Lawful Permanent Resident Aliens, and those born in the United States.  The following acceptable forms of documentation will be utilized to establish USPER status for UConn CUI project participants: 

 List A: Valid US Passport, I-551 Permanent Resident Card 

List B: US Military Photo ID, State Issued Driver’s License, or Government issued photo ID 

List C: Original or Certified Copy of State Issued Birth Certificate, US Consular Report of Birth FS-240, DoS Certificate of Birth Abroad DS-1350, Certificate of US Citizenship, or Certificate of US Naturalization 

 A determination of USPER status will require one item from List A; or one item from List B and one item from List C. All documents produced to verify birth in the US must be either the originals or certified copies. 

 Training Requirements 

 

DoD CUI Training (as mandated by DoD and provided by DCSA) 

All Personnel handling (CUI) must receive initial and annual refresher CUI education and training, and maintain documentation of this training for audit purposes. The University of Connecticut provides a mandatory training course for all DOD personnel with access to CUI. This course also fulfills CUI training requirements for industry when it is required by Government Contracting Activities for contracts with CUI requirements. 

• Please access the training here: https://securityawareness.usalearning.gov/cui/index.html

University of Connecticut Technology Control Plan Briefing Acknowledgement and Non-Disclosure Statement 

• https://uconn.kualibuild.com/app/builder/app/63ebd8543981ce38d8f61cfe/run

 

OVPR Export Control trainings required (2 modules, offered by CITI) 

• Authorized USPER project participants will be required to successfully complete the following CITI online export training prior to working on the project and shall provide proof of completion to the Director of Export Compliance. CITI training can be accessed at https://www.citiprogram.org/?pageID=668 
• Then, type in “UConn” to find the university. 
• Then, sign in with your UConn SSO login.
• Under the “Learner Tools” section of the website after you log in (you’ll have to scroll down in the webpage to see this section), click “Add a Course”
• Then, check the box for the Export Compliance course, and follow the remaining steps to enroll and take the courses.
• Contact the Export Control Officer, exportcontrol@uconn.edu if you have any difficulty accessing these required trainings.

NIST 800-171 compliance training (2023 version) 

• 2023 CMMC 2.0 NIST 800-171 Compliance Training
• Please use this link to start your training:
• https://training.knowbe4.com/auth/saml/667c8d12bf2d3
• Students will need to first contact SRITraining@uconn.edu to be added to take the training

NIUVT User Agreement (NIUVT projects only) 

• https://uconn.kualibuild.com/app/builder/app/62432ba8d88f65e3695cad83/run

OVPR Export Control User Agreement (for all non-NIUVT projects)           

• https://uconn.kualibuild.com/app/651c2dab32976c013a5ea4f0/run

 

 Background Screening for CUI 

 All university researchers and staff who handle or have access to Controlled Unclassified Information (CUI) are required to undergo background investigations as a condition of their access as required by NIST 800-171. Background investigations are necessary to verify the trustworthiness, reliability, and suitability of individuals with access to sensitive information.

Employee Background Checks:

Employees of the university will have their background checks conducted by the Human Resources department as part of the standard hiring process as required by the Pre-Employment Background Check Policy. Any employee hired prior to the implementation of background checks by the university will be required to undergo a background investigation prior to accessing CUI.  The University Research Security Office will provide you with additional information during your onboarding.

Undergraduate and Graduate Student Background Checks:

Undergraduate student and graduate students who are state employees are also required to undergo a background check in order to handle or have access to CUI as part of their research activities. The background investigation process for these students must be initiated through the Research Security Office prior to beginning any CUI research.

Background Investigation Process:

Background investigations may include, but are not limited to, criminal history checks, employment verification, education verification, and reference checks. The results of background investigations will be used to assess the suitability of individuals for access to CUI.

 

FAQ:

https://research-compliance.umich.edu/research-information-security/controlled-unclassified-information-cui

 

Additional Resources:

National Policy 

• Executive Order (EO) 13556, Controlled Unclassified Information 
• 32 Code of Federal Regulations (CFR), Part 2002, Controlled Unclassified Information 
• NIST Special Publication 800-171 (Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations) 

DOD Policy 

• DODI 5200.48 Controlled Unclassified Information (CUI) 
• DFARS Section 252.204-7012 

 Useful Links 

• CUI Cover Sheet 
• CUI Quick Marking Tips  
• DOD CUI Marking Job Aid 
• DCSA CUI Frequently Asked Questions (FAQ)
• CUI Quick Start Guide
• DCSA CUI Resources One-Pager
• DCSA CUI Glossary & Policy Summaries
• DCSA CUI Landscape
• CUI Quick Reference Guide
• DCSA CUI Destruction Guidance

CUI Resources: https://www.dcsa.mil/Portals/91/Documents/CTP/CUI/DOD-CUI_Resources_One-Pager_for_DOD.pdf 

Research security at universities is crucial for safeguarding sensitive information, intellectual property, and national security interests. NSPM-33, or National Security Presidential Memorandum 33 https://www.whitehouse.gov/wp-content/uploads/2022/01/010422-NSPM-33-Implementation-Guidance.pdf , outlines the guidelines and policies for securing research activities, particularly those involving sensitive or classified information. This memorandum emphasizes the need for universities to implement robust security measures to prevent unauthorized access, disclosure, or exploitation of research findings that could potentially harm national security or economic interests. By adhering to NSPM-33 and implementing research security measures, universities can ensure the protection of valuable research assets while also fostering a collaborative and transparent research environment. 

 

EXPORT CONTROLS

Export control laws are federal regulations that govern how certain information, technologies, and commodities can be transmitted overseas or to a foreign national on U.S. soil. The scope of the regulations is broad: they cover exports in virtually all fields of science, engineering, and technology and apply to research activities regardless of the source of funding. Failure to comply with these laws can have serious consequences, both for the institution and for the individual researcher. Potential penalties include fines and possibly imprisonment. It is thus critical for UConn researchers to understand their obligations under these regulations and to work with the UConn Export Control Office to ensure that the University is in compliance.

UConn adheres to multiple federal agencies’ regulations pertaining to export controls, but there are three main regulations which the university is concerned with:

• The International Traffic in Arms (ITAR) from the U.S. Department of State, which covers defense articles and defense services.
• The Export Administration Regulations (EAR) from the U.S. Department of Commerce, which govern some commodities, software, technology, and “dual-use” civilian/military articles and technology.
• The Office of Foreign Assets Control (OFAC) from the U.S. Department of the Treasury, which enforces economic and trade sanctions based on U.S. foreign policy and national security goals.

UConn’s Export Control Office supports the university’s faculty, staff, and students with questions about and guidance for actions required in order to comply with these various federal regulations.