4

Implementable Practices for Assessing and Managing Risk to Ensure Appropriate Operations at U.S. Institutions of Higher Education

This chapter provides some illustrative examples of implementable practices U.S. institutions of higher education should consider using to assess and mitigate risk stemming from foreign-funded language and culture institutes. These practices can ensure appropriate operations on campus and protect academic freedom, freedom of expression, and intellectual property from undue foreign interference. The committee notes that institutions of higher education are being thoughtful about this issue and several have developed a variety of useful practices. In addition, institutions of higher education are required to comply with requirements pertaining to research security, accreditation standards that include whether institutions have implemented oversight mechanisms and maintain key principles on academic freedom, and reporting foreign gifts and contracts, as per Section 117 of the Higher Education Act of 1965.¹ Compliance with these requirements itself mitigates many of the risks posed by foreign-funded institutions. Appendix C provides information on the regulatory and compliance context in which U.S. institutions of higher education operate.

ASSESSING RISK

As the previous chapter discussed, there can be real risks associated with engaging in international collaborations. Institutions of higher education can overcome these risks by demonstrating they are taking concrete steps to understand and mitigate them, which they can achieve by developing and implementing

___________________

¹ Higher Education Act of 1965, Public Law No. 89-329, 89th Congress, 1st session (November 8, 1965), Section 117 (U.S. Congress, 2022).

“well-designed internal processes capable of weighing benefits and risks carefully, making distinctions among different kinds of activities while ensuring that [the host institution’s] core values and principles and general policies are brought to bear” (Lester, 2020). Box 4-1 lists some flags that could trigger an institution of higher education to conduct a thorough risk assessment, and Appendix D provides examples of risk decision trees that institutions of higher education can use to conduct an initial risk assessment. Free, customizable risk register templates, recommended by Universities Canada (U15 Group and Universities Canada, 2019), are available online to help identify and mitigate potential risks.²

For a more detailed risk analysis, the U.S. Army Combat Capabilities Development Command, or DEVCOM, Army Research Laboratory has developed a risk rubric that involves first identifying possible risks that a foreign-funded project might have and then ranking them according to whether they are

___________________

² Available at https://www.smartsheet.com/risk-register-templates#project-risk-register-template.

low, moderate, or high risk to research security (see Figure 4-1). Ranking is done based on four characteristics: (1) whether the foreign-funded program is associated with a foreign talent program, (2) whether any of the individuals associated with the foreign-funded program are on the list of U.S. government denied entities, (3) whether the source of funding comes from a strategic competitor, and (4) whether the foreign entity sponsoring the program has a history of targeting U.S. research or technology. While this rubric is specific for research security, it should be possible to develop similar rubrics for risks to academic freedom and freedom of expression and to academic governance.

The committee emphasizes it is good practice to establish a benefit-risk framework to guide decision makers considering a new collaboration or reviewing its ongoing operation. Lester et al. (2023) emphasize the importance of university-driven risk management frameworks that are informed by deep knowledge of educational and research practices and institutional values. Doing so requires a clear articulation of relevant risks, including those that would violate the host institution’s values and principles, and a clear articulation of the benefits that the proposed collaboration will create. The committee also notes that many U.S. institutions of higher education are being thoughtful about this issue. The Massachusetts Institute of Technology (MIT), for example, has developed a review process of international proposals that come with risks to intellectual property; national security; economic competitiveness; consistency with MIT’s core values; and political, civil, and human rights.³

MIT’s process starts with a review of the proposed foreign-funded program by a committee of experienced professional staff in key project areas including finance, law, tax, export control, and operations. This committee provides information and advice on anticipated risks and approaches to reduce or avoid them. Next, a faculty-led standing committee that advises senior administration on MIT’s major international agreements reviews the proposed foreign-funded collaboration to determine whether there is a plan to address the risks identified in the first step. If a significant risk remains, the proposed foreign-funded collaboration then undergoes evaluation by MIT’s Senior Risk Group, which will either approve the proposed institute with a risk management plan or decide that MIT should not host the proposed foreign-funded institute.

RISK MITIGATION STRATEGIES

Once an institution of higher education completes a risk assessment of engagement with a foreign-funded language and culture program, it needs to demonstrate it is taking concrete actions to understand and mitigate associated risks (Lester, 2020). The committee agrees with the sentiment expressed in

___________________

³ Additional information is available at https://orgchart.mit.edu/letters/new-review-process-ele-vated-risk-international-proposals.

University Engagement with China: An MIT Approach that universities should take the initiative to develop and implement robust risk management and mitigation strategies given the lack of prescriptive federal guidance (MIT, 2022). Potential steps to address, manage, and mitigate risk include the following:

• Ensuring that the university is in compliance with all relevant federal and state laws and regulations (see Appendix C).
• Developing an international engagement strategy that advances and protects the priorities and mission of the institution (NCUSCR, 2019).
• Creating an advisory board of faculty and administrators with experience working abroad to develop such a strategy; to assess and evaluate such a strategy over time; and to ensure that university actions are consistent with intellectual exchange and academic freedom (Lester, 2020; NCUSCR, 2019).
  • For example, Tufts University created a committee in 2019 to review the pros and cons of renewing its Confucius Institute (CI) based on the experience hosting a CI and with input from faculty, staff, and students, as well as outside counsel with expertise on CIs. As a result of this audit, the committee recommended renewal with several conditions, including revising the terms of the agreement with Hanban that would clarify and ensure the university retains management control of the CI and that U.S. laws and Tufts policies apply to all aspects of the CI. In addition, the committee proposed several revisions to Tufts’s governance structures and processes to increase transparency and oversight of the CI and its staff, and it also recommended instituting a confidential complaint process for students and faculty who “feel they have come under pressure that threatens academic freedom” (Tufts University, 2019).
• Developing standard or recommended language for foreign-funded partnerships that contributes to safeguarding academic freedom (NCUSCR, 2019).
• Utilizing existing laws and university codes of conduct to manage the malicious reporting of student or faculty speech to foreign governments or other forms of harassment by agents of a foreign government (NCUSCR, 2019).
• Ensuring that the terms of foreign-funded language and culture institutes are clear and are in writing with all participants and their affiliations identified, if possible. This could go as far as to specify the roles and responsibilities of all participating individuals.
• Ensuring that policies and procedures are in place to monitor risks associated with suppression of freedom of speech and that mechanisms are in place to protect students (NCUSCR, 2019).
• Designating a senior faculty member to serve as the director of the institute who then oversees all aspects of course development.

• • At Pacific Lutheran University, a small liberal arts institution that is home to the CI of Washington State, the institute director writes all course syllabi, enabling the director to know what the CI instructors are teaching and when they are teaching it. The director, who remains the instructor of record, meets with instructors biweekly for a report on everything happening in class and handles all final grading in a course.⁴ In addition, the director is available for students to report their own impressions about what happens in class.

Practices for Academic Governance of Foreign-Funded Language and Culture Institutes

• Establish foreign-funded language and culture institutes as formal university Centers or Institutes, which would subject them to all university policies and procedures, including those regarding shared governance.
• Maintain full managerial control of the foreign-funded language and culture institute’s curriculum, instructors, textbooks, teaching materials, programmatic decisions, and research grants.
• Create an independent and expert governance structure at the U.S. host institution with the primary responsibility to the U.S. host institution that does not allow political or other influences to interfere with governing body duties.
• Designate all foreign-funded language and culture institute employees and affiliates as having a formal association with the host institution and being subject to the host institution’s human resources policies and procedures and corresponding campus policies.
• Maintain appropriate fiduciary and financial oversight and transparency of the foreign-funded language and culture program.
• Consider the following key questions developed by the Organization of American Historians⁵ to ensure that funding associated with a foreign-funded language and culture institute promotes the institutional mission and does not threaten academic freedom.
  • Who are the funders and why are they funding the institute?
  • Do the funder’s motives, goals, and agenda align with, and promote balance and equity within, the institutional mission?
  • Do offers of funds follow established procedures and engage shared governance bodies from the initial exploration through the funding agreement?
  • Are decisions about accepting, allocating, and spending the monies made in compliance with the institution’s shared governance system?

___________________

⁴ Pacific Lutheran University is small enough that the director can review the progress of each student enrolled in a CI-sponsored course.

⁵ Available at https://www.oah.org/best-practices/funder-influence/.

• • Do any use-of-funds provisions preclude or restrict (directly or via expected self-censorship) faculty or instructors’ academic freedom?
• Empower and support faculty governance bodies and representatives to insist on transparency and meaningful participation in the development and implementation of funder agreements and programs.

Practices to Preserve Freedom of Expression and Academic Freedom on Campus

Strong shared governance is a cornerstone of protecting freedom of expression and academic freedom on campus (DeGioia, 2019).

• Ensure that the institution has a clear set of guiding principles to protect freedom of expression. Adopting the Chicago Principles on Freedom of Expression (Stone et al., 2015) or affirming the American Association of University Professors’ “1940 Statement of Principles on Academic Freedom and Tenure” (AAUP, 1940) are two options that some campuses use. The Board of Regents of the University System of Georgia provides an illustrative example of a U.S. university system that recently approved a statement of principles to affirm and protect academic freedom and freedom of expression for faculty, staff, and students at its colleges and universities.⁶
• Maintain and raise awareness of an effective reporting system containing “safe harbor” provisions⁷ to report potential issues on freedom of expression and academic freedom.
• Develop clear and transparent statements regarding academic freedom protections on campus to guide administration, faculty at all ranks, staff, and students in understanding and exercising rights, responsibilities, and procedures in situations where academic freedom is felt to be threatened or abused. The American Council on Education and PEN America’s resource guide on Making the Case for Academic Freedom and Institutional Autonomy in a Challenging Political Environment contains communications tools and talking points that may be of interest,⁸ as does the Working Group on Academic Freedom’s Principles for Implementing the Right of Academic Freedom.⁹
• Develop policies and practices that protect freedom of expression and dissent as well as academic freedom and that are enforced by institutional

___________________

⁶ See https://www.usg.edu/news/release/board_of_regents_approves_statement_of_principles_regarding_academic_freedom_and_freedom_of_expression.

⁷ Merriam-Webster defines “safe harbor” as “something (as a statutory or regulatory provision) that provides protection (as from a penalty or liability).”

⁸ See https://www.acenet.edu/Documents/Academic-Freedom-Resource-Guide.pdf.

⁹ See https://www.scholarsatrisk.org/wp-content/uploads/2023/03/Principles-for-Implementing-the-Right-of-Academic-Freedom-ENGLISH.pdf.

• governance structures. The Organization of American Historians’ “Best Practices in Defense of Academic Freedom” provides a set of implementable practices that may be a useful resource.¹⁰
  • Have faculty interview prospective CI instructors and include a frank discussion about the essential importance of academic freedom and reiterate that message during the appointee’s preliminary training once they arrive in the United States.
• Acknowledge there are political sensitivities that can impede certain conversations at certain points in time. Finding ways to work around those obstructions is entirely doable if one is directly engaged. The key is to be mindful of potential issues and creative in how to work around those obstacles.
  • For example, prior to an event that would discuss contemporary politics and U.S.-China relations, a CI instructor told the director of the CI of Washington that they could not attend given the sensitivity of the topic. In private, the CI instructor offered some of his perspective, which the director included in their remarks at the event without attribution. The director reported that the ensuing discussion at the event was enriched by the instructor’s comments.
• Reject conditions in the agreement between the host institution and the foreign funder that threaten or compromise academic freedom. The Organization of American Historians’ Funder Influence website may be a useful resource.¹¹
• Draw upon the expertise of on-campus country specialists to provide insights on the foreign funder’s policies regarding academic freedom and freedom of expression (U15 Group and Universities Canada, 2019).
• Conduct a vulnerability assessment to understand external pressures on academic freedom and integrity (DG RTD, 2022).
• Conduct stress testing of governance and oversight processes to simulate possible adverse scenarios and ensure that the institution is prepared to respond (Van Loo, 2022).¹²

___________________

¹⁰ See https://www.oah.org/about/governance/policies/academic-freedom-guidelines-and-best-practices/.

¹¹ See https://www.oah.org/about/governance/policies/academic-freedom-guidelines-and-best-practices/funder-influence/ and https://www.oah.org/best-practices/funder-influence/.

¹² Stress testing is similar to conducting a “tabletop exercise,” “Red Team testing,” or “penetration testing,” and is intended to simulate extreme circumstances to ensure that an institution is prepared to respond during an emergency in a manner that is consistent with the institution’s governance policies. Stress testing can potentially be a powerful tool for administrative governance and accountability in a time of escalating risks (Van Loo, 2022).

Practices Related to the Research Environment

The committee reiterates its belief, as expressed in the first report (NASEM, 2023), that no additional risk is posed by the conduct of classified research on a campus hosting a foreign-funded language and culture institute, including a CI, as long as the campus complies with National Industrial Security Program (NISP) and, in particular, those policies and procedures detailed in the National Industrial Security Program Operating Manual (NISPOM).¹³ At the same time, there are several practices that institutions of higher education should adopt as a matter of principle to protect the research environment.

• Meet and comply with all applicable Department of Defense requirements for information, data, physical, and research security.
• Provide resources to faculty contemplating international research activities to support sound risk assessment and decision-making. This can include review of potential contracts the researcher is being asked to enter into by the foreign entity for consistency with university policy and alignment with existing research commitments.¹⁴
• Restrict access to the host institution’s cyber network beyond an individual’s remit on campus, monitor computer networks routinely for suspicious activity, and install intrusion detection systems.
• Provide comprehensive education and training to both newly appointed and current faculty members and scholars, ensuring their complete understanding of all relevant security, disclosure, and intellectual property policies concerning engagements with foreign entities.
  • Useful guides include the National Knowledge Security Guidelines developed by the University of the Netherlands¹⁵ and the Canadian government’s National Security Guidelines for Research Partnerships Risk Assessment Form.¹⁶
• Establish a “Know Your Collaborator” culture based on “best practices in monitoring scientific and research collaboration with foreign nationals and determining whether such collaboration adheres to U.S. scientific research values, especially in the area of research integrity” (Office of

___________________

¹³ National Industrial Security Program Operating Manual, 32 CFR part 2004. Available at https://www.dcsa.mil/mc/isd/nisp/.

¹⁴ The University of California, Berkeley’s Global Engagement Office provides resources for faculty and staff involved in international partnerships, including guidance on policies, best practices, and partner vetting. See https://globalengagement.berkeley.edu/international-agreements-resources-and-campus-guidelines.

¹⁵ Available at https://english.loketkennisveiligheid.nl/binaries/loketkennisveiligheid-en/documenten/publications/2022/04/07/national-knowledge-security-guidelines/National+Knowledge+Security+Guidelines.pdf.

¹⁶ Available at https://science.gc.ca/site/science/en/safeguarding-your-research/guidelines-andtools-implement-research-security/national-security-guidelines-research-partnerships/national-security-guidelines-research-partnerships-risk-assessment-form.

• Senator Tom Carper, 2019; Permanent Subcommittee on Investigations, 2019).
• Protect and restrict access to specific information on university invention disclosures, patent applications, and license agreements (AAU and APLU, 2019).
• Draw upon the expertise of on-campus country specialists to provide insights on whether the foreign funder’s practices are consistent with the host institution’s policies on research conduct (U15 Group and Universities Canada, 2019).
• Consider the following key questions developed by the JASON independent science advisory group to assess the risk associated with a foreign engagement. These questions can reveal new insights and lead to a fuller understanding of an engagement involving foreign partners or funding before an individual or institution agrees to enter or to renew such an agreement (JASON, 2019).
  • Describe the engagement succinctly and without jargon. Is it fundamental research? If not, what are the institution’s policies around creating the engagement?
  • Are the terms of the engagement made clear in writing? Have all the participants been identified? Are all participants known to the PI and the PI’s institution?
  • Are all the participants conflicts of interest and commitment documented? Are there any aspects of the engagement that are not to be disclosed to any of the participants? If so, what is the reason?
  • Is there any aspect of the engagement that seems unusual, unnecessary or poorly specified?
  • Where does the funding and other resources needed for the activity come from? Is it clear what each party is providing?
  • Are all of the tangible assets of the engagement, existing or to be generated (e.g., data, metadata, profits, equipment, etc.), known? How will they be shared? Who decides how they are allocated?
  • How does a participant end their engagement?
  • Are scholars expected to reside away from their home institutions as a part of the engagement? If so, how are they chosen for participation in the engagement?
  • What are the reporting requirements back to home institutions or organizations?
  • Who will control the dissemination of the resulting fundamental research?