What Is Academic Solicitation?

Academic Solicitation is the use of students, professors, scientists, or researchers as collectors improperly attempting to obtain sensitive information. Placing academics at, and requesting to collaborate with, U.S. research institutions under the guise of legitimate research in order to access developing technologies and cutting-edge research. These attempts can include requests for, or arrangement of, peer or scientific board reviews of academic papers or presentations; requests to study or consult with faculty members; and requests for and access to software and dual-use technology. Academic solicitation can also occur when a faculty member, student, employee, or visiting scholar seeks access to this same information. The number of foreign academics requesting to work with classified programs continues to rise, and the academic community will likely remain a top target for the foreseeable future. Although most academic contacts are likely legitimate, some foreign academics may ultimately take advantage of their placement and access to further their country’s research and development goals. 

 

Who Is Being Targeting? 

• Researchers, scientists, and subject matter experts conducting research/ projects on behalf of a U.S. Government customer 
• Researchers, scientists, and subject matter experts employed at academic institutions or with published in scientific or technical journals or presented at conferences
• Students, professors, and researchers with access to research and technical information (especially graduate and post-doctorate students) 
• Researchers, scientists, and subject matter experts working on cutting-edge technology 
• Subject matter experts teaching technical courses

 

What To Report  

Any contact (i.e., emails, telephone, personal contact) that is suspicious because of the manner or subject matter of the request. This may include requests from U.S. persons or from foreign nationals located in the United States or abroad, and may consist of:  

• Unsolicited applications or requests for undergraduate, graduate, postgraduate, or other research positions 
• Unsolicited requests for access to research papers or other research-related publications or documents 
• Unsolicited requests for assistance with or review of thesis papers, draft publications, or other research related documents 
• Unsolicited invitations to attend and/or present at international conferences
• Unsolicited grants or gifting of funds/equipment to conduct joint research projects from foreign academic institutions or foreign governments

 Contact the UConn Research Security Office at researchsecurity@uconn.edu with any concerns or questions.  If you suspect academic solicitation is taking place you can also file an anonymous report at compliance.uconn.edu. 

 

Economic Espionage

Economic espionage is foreign power-sponsored or coordinated intelligence activity directed at the U.S. government or U.S. corporations, establishments, or persons, designed to unlawfully or clandestinely influence sensitive economic policy decisions or to unlawfully obtain sensitive financial, trade, or economic policy information; proprietary economic information; or critical technologies. This theft, through open and clandestine methods, can provide foreign entities with vital proprietary economic information at a fraction of the true cost of its research and development, causing significant economic losses. 

 Our Nation’s secrets are in jeopardy, the same secrets that make your company profitable. The FBI estimates billions of US dollars are lost to foreign competitors every year. These foreign competitors deliberately target economic intelligence in advanced technologies and flourishing US industries.  

Foreign competitors operate under three categories to create an elaborate network of spies: 

• Aggressively target present and former foreign nationals working for US companies and research institutions;
• Recruit and perform technical operations to include bribery, discreet theft, dumpster diving (in search of discarded trade secrets) and wiretapping; and,
• Establish seemingly innocent business relationships between foreign companies and US industries to gather economic intelligence including proprietary information.

 What Are Trade Secrets? 

Trade secrets are all forms and types of financial, business, scientific, technical, economic or engineering information, including patterns, plans, compilations, program devices, formulas, designs, prototypes, methods, techniques, processes, procedures, programs, or codes, whether tangible or intangible, and whether or how stored, complied, or memorialized physically, electronically, graphically, photographically or in writing, (1) which the owner has taken reasonable measures to protect; and (2) which have an independent economic value from not being generally known to the public.  

Commonly referred to as proprietary information, economic policy information, trade information, proprietary technology, or critical technology. 

 What Are Some Methods Of Targeting Or Acquiring Trade Secrets? 

• Steal, conceal, or carry away by fraud, artifice, or deception;
• Copy, duplicate, sketch, draw, photograph, download, upload, alter, destroy, photocopy, replicate, transmit, deliver, send, mail, communicate, or convey; and,
• Receive, buy, or possess a trade secret, knowing the same to have been stolen or appropriated, obtained, or converted without authorization.

 Know The Signs 

• Working odd hours without authorization 
• Taking proprietary information home without authorization
• Unnecessarily copying material 
• Disregarding company policies on personal software and hardware 
• Accessing restricted websites
• Downloading confidential material 
• Conducting unauthorized research

Personal Behaviors 

• Unexplained short trips to foreign countries 
• Engaging in suspicious personal contacts with competitors, business partners or unauthorized individuals 
• Buying items they normally cannot afford
• Overwhelmed by life crises or career disappointments 
• Showing concern about being investigated

Common Factors  

• Financial need 
• Greed 
• Unhappiness in the workplace 
• Different allegiances to another company or country 
• Drug/Alcohol abuse 
• Vulnerability to blackmail 
• Job offers from other organizations

Targeted Industries Or Sectors 

• Information and communication technology 
• Business information that pertains to supplies of scarce natural resources or that provides global actors an edge in negotiations with U.S. businesses or the U.S. government 
• Military technologies (marine systems, unmanned aerial vehicles, and aerospace/aeronautic technologies) 
• Civilian and dual-use technologies in fast-growing sectors (clean energy, health care and pharmaceuticals, and agricultural technology)
• Academia

  

As part of a nationwide campaign to raise awareness of the growing economic espionage threat, the FBI has released a short video, “The Company Man: Protecting America’s Secrets.” Based on an actual case, the video illustrates how one company was targeted by foreign actors and what the FBI did to help. 

 Contact the UConn Research Security Office at researchsecurity@uconn.edu with any concerns or questions.  If you suspect economic espionage is taking place you can also file an anonymous report at compliance.uconn.edu.

 Controlled Unclassified Information (CUI) is information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that requires safeguarding or dissemination controls consistent with applicable laws, regulations, and Government-wide policies but is not classified under Executive Order 13556 “Classified National Security Information” or the Atomic Energy Act, as amended. 

  CUI Regulations

The CUI security controls must be compliant with the federal regulations specified in 32 CFR Part 2002(link is external) and by the National Archives and Records Administration (NARA), who acts as the CUI Executive Agent (EA) to oversee the federal agency CUI compliance. The most commonly encountered Federal CUI requirements and guidelines include:

NATIONAL INSTITUTES OF STANDARDS AND TECHNOLOGY (NIST) SPECIAL PUBLICATION (SP)

• NIST SP 800-53r5(link is external) – Security and Privacy Controls for Federal Information Systems and Organizations
• NIST SP 800-171r2(link is external) – Protecting CUI in Nonfederal Systems and Organizations
• NIST SP 800-172(link is external) – Enhanced Security Requirements for Protecting CUI: Supplement to 800-171 Rev. 2

FEDERAL ACQUISITION REGULATION (FAR) SECURITY REQUIREMENTS

• FAR 52.204-21(link is external) – Basic Safeguarding of Covered Contractor Information Systems

DEPARTMENT OF DEFENSE FEDERAL ACQUISITION REGULATION (DFARS)

• DFARS 252.204-7012(link is external) – Safeguarding Covered Defense Information and Cyber Incident Reporting
• DFARS 252.204-7020(link is external) – NIST SP-171 DoD Assessment Requirements
• DFARS 252.204-7021(link is external) – Cybersecurity Maturity Model Certification Requirements

Other requirements and guidance as directed in agency-specific regulations and certain legal documents may also apply.

“Information” as defined by the Federal CUI Program may include research data and other project information, including non-public Federal Contract Information (FCI).  FCI is normally protected in accordance with FAR 52.204-21 when a research team receives, possesses, or creates FCI in the performance of a sponsored contract.

“Information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. Information systems may include electronic media, non-electronic media, and physical environments.

 

CUI Onboarding

The United States Government has instituted a requirement that only United States Persons (USPERS) with a lawful, government purpose be granted access to CUI. The Government defines a USPERS for the purpose of CUI access as those naturalized citizens, Lawful Permanent Resident Aliens, and those born in the United States.  The following acceptable forms of documentation will be utilized to establish USPER status for UConn CUI project participants:

List A: Valid US Passport, I-551 Permanent Resident Card

List B: US Military Photo ID, State Issued Driver’s License, or Government issued photo ID

List C: Original or Certified Copy of State Issued Birth Certificate, US Consular Report of Birth FS-240, DoS Certificate of Birth Abroad DS-1350, Certificate of US Citizenship, or Certificate of US Naturalization

A determination of USPER status will require one item from List A; or one item from List B and one item from List C. All documents produced to verify birth in the US must be either the originals or certified copies.

In addition, please complete the following training prior to meeting with me, and please have your User Agreement, Technology Control Plan Briefing Acknowledgement and Non-Disclosure Statement, and Background Check completed/submitted:

DoD CUI Training (as mandated by DoD and provided by DCSA)

• Please access the training here: https://securityawareness.dcsa.mil/cui/index.html

Insider Threat Awareness 

• Please access the training here: https://www.cdse.edu/Training/eLearning/INT101/

This course provides a thorough understanding of how Insider Threat Awareness is an essential component of a comprehensive security program. The course promotes the reporting of concerning behavior observed within the place of duty. Using case study scenarios, the course teaches common indicators associated with insider risk. The instruction promotes a proactive approach to reporting, to support positive outcomes for the workforce.

University of Connecticut Technology Control Plan Briefing Acknowledgement and Non-Disclosure Statement

• https://uconn.kualibuild.com/app/builder/app/63ebd8543981ce38d8f61cfe/run

OVPR Export Control trainings required (2 modules, offered by CITI)

• Authorized USPER project participants will be required to successfully complete the following CITI online export training prior to working on the project and shall provide proof of completion to the Director of Export Compliance. CITI training can be accessed at https://www.citiprogram.org/?pageID=668
• Then, type in “UConn” to find the university.
• Then, sign in with your UConn SSO login.
• Under the “Learner Tools” section of the website after you log in (you’ll have to scroll down in the webpage to see this section), click “Add a Course”
• Then, check the box for the Export Compliance course, and follow the remaining steps to enroll and take the courses.
• Contact the Export Control Officer, exportcontrol@uconn.edu if you have any difficulty accessing these required trainings.

NIST 800-171 compliance training (2023 version – required if you will need access to Secure Research Infrastructure)

• 2023 CMMC 2.0 NIST 800-171 Compliance Training
• Please use this link to start your training:
  • https://training.knowbe4.com/auth/saml/667c8d12bf2d3
• Students will need to first contact SRITraining@uconn.edu to be added to take the training

NIUVT User Agreement (NIUVT projects only)

• https://uconn.kualibuild.com/app/builder/app/62432ba8d88f65e3695cad83/run

OVPR Export Control User Agreement (for all non-NIUVT projects)              

•  https://uconn.kualibuild.com/app/651c2dab32976c013a5ea4f0/run

  Background Check Required

As part of your work, you may have access to Controlled Unclassified Information, which requires safeguarding or dissemination controls consistent with various laws and regulations. One of these regulations, NIST SP 800-171, establishes the basic security requirements for protecting CUI. One of these requirements is to screen individuals prior to authorizing access to organizational systems containing CUI. To begin this process contact researchsecurity@uconn.edu.

Background Investigation Process:

Background investigations may include, but are not limited to, criminal history checks, employment verification, education verification, and reference checks. The results of background investigations will be used to assess the suitability of individuals for access to CUI.

 

FAQ:

https://research-compliance.umich.edu/research-information-security/controlled-unclassified-information-cui

 

Additional Resources:

National Policy 

• Executive Order (EO) 13556, Controlled Unclassified Information 
• 32 Code of Federal Regulations (CFR), Part 2002, Controlled Unclassified Information 
• NIST Special Publication 800-171 (Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations) 

DOD Policy 

• DODI 5200.48 Controlled Unclassified Information (CUI) 
• DFARS Section 252.204-7012 

 Useful Links 

• CUI Cover Sheet 
• CUI Quick Marking Tips  
• DOD CUI Marking Job Aid 
• DCSA CUI Frequently Asked Questions (FAQ)
• CUI Quick Start Guide
• DCSA CUI Resources One-Pager
• DCSA CUI Glossary & Policy Summaries
• DCSA CUI Landscape
• CUI Quick Reference Guide
• DCSA CUI Destruction Guidance

CUI Resources: https://www.dcsa.mil/Portals/91/Documents/CTP/CUI/DOD-CUI_Resources_One-Pager_for_DOD.pdf 

Research security at universities is crucial for safeguarding sensitive information, intellectual property, and national security interests. NSPM-33, or National Security Presidential Memorandum 33, outlines the guidelines and policies for securing research activities, particularly those involving sensitive or classified information. This memorandum emphasizes the need for universities to implement robust security measures to prevent unauthorized access, disclosure, or exploitation of research findings that could potentially harm national security or economic interests. By adhering to NSPM-33 and implementing research security measures, universities can ensure the protection of valuable research assets while also fostering a collaborative and transparent research environment. 

 

EXPORT CONTROLS

Export control laws are federal regulations that govern how certain information, technologies, and commodities can be transmitted overseas or to a foreign national on U.S. soil. The scope of the regulations is broad: they cover exports in virtually all fields of science, engineering, and technology and apply to research activities regardless of the source of funding. Failure to comply with these laws can have serious consequences, both for the institution and for the individual researcher. Potential penalties include fines and possibly imprisonment. It is thus critical for UConn researchers to understand their obligations under these regulations and to work with the UConn Export Control Office to ensure that the University is in compliance.

UConn adheres to multiple federal agencies’ regulations pertaining to export controls, but there are three main regulations which the university is concerned with:

• The International Traffic in Arms (ITAR) from the U.S. Department of State, which covers defense articles and defense services.
• The Export Administration Regulations (EAR) from the U.S. Department of Commerce, which govern some commodities, software, technology, and “dual-use” civilian/military articles and technology.
• The Office of Foreign Assets Control (OFAC) from the U.S. Department of the Treasury, which enforces economic and trade sanctions based on U.S. foreign policy and national security goals.

UConn’s Export Control Office supports the university’s faculty, staff, and students with questions about and guidance for actions required in order to comply with these various federal regulations.