Appropriate International Engagement

CHINA, RUSSIA, IRAN, and NORTH KOREA.
Certain restrictions may also apply to Cuba and Venezuela.

Federal research agencies, and Georgetown as a recipient of federal research funding, prohibit federally-funded researchers’ involvement in malign foreign talent recruitment programs (MFTRPs). A resource that outlines the definition and characteristics of a MFTRP is available here.

Investigators engaged in research at Georgetown must attest that they are not party to a MFTRP. These attestations must also be made by Covered Persons to federal agencies in documentation associated with applications, contracts, and awards.

The DoD provides a list of known FTRPs that pose a threat to national security (and which would be considered to meet the criteria of “malign”) on page 13 of its 1286 list. However, note that any FTRP or activity that meets the definition and characteristics of a MFTRP as outlined here is a prohibited MFTRP.

FTRPs are programs in which foreign governments aim to recruit talented professionals and students in targeted fields for the purpose of benefiting from or appropriating knowledge and expertise. These programs often utilize funding through grants and research fellowships to encourage researchers to relocate to the foreign country or share information with the foreign country.  

A FTRP (as defined in OSTP Guidelines) is “…any program, position, or activity that includes compensation in the form of cash, in-kind compensation, or other types of remuneration directly provided by a foreign country at any level (national, provincial, or local) or an entity based in, funded by, or affiliated with a foreign country…”.

The definitions of “in-kind” compensation and “other types of remuneration” are broad, so Georgetown researchers should be cautious and seek advice from the Office of Research Oversight (ORO) or the Joint Office of Research Administration (JORA) if approached about any arrangement that could qualify as an FTRP. Participation in an FTRP must be disclosed and may be prohibited. Some federal agencies view FTRPs associated with a foreign country of concern (even if not meeting defined characteristics of a MFTRP) as problematic. The DOD provides a list of known FTRPs that pose a threat to national security on page 13 of its 1286 list.

The U.S. government maintains a number of restricted party lists, which it routinely updates. These lists identify parties that the U.S. government has flagged as a concern to national security.

One such list that includes a number of foreign academic and research institutions is the Department of Department of Defense “1286 List“, which identifies foreign entities and talent programs that the U.S. government has determined are engaging in activities that threaten U.S. national and economic security interests.

Members of Georgetown’s academic and research community should request a research security consult and screening before engaging with entities in a foreign country of concern, to ensure they are not on a restricted entity list.

Federal agencies have issued prohibitions and restrictions around engagement with certain programs and entities, prohibitions and restrictions that apply to individuals applying for and receiving federally-funded research. Funding to or from organizations on restricted entity lists, or collaborations with organizations (or individuals employed by organizations) on restricted entity lists may be prohibited, may impact eligibility for federal funding, or may require research security mitigation strategies.

The U.S. Department of Defense (DoD) / (Department of War (DoW)) has a documented approach to considering research security risks in its funding decisions for fundamental research. The most recent DoD decision matrix is available here. This approach could impact researchers’ eligibility for funding — or awards may come with mitigation requirements — if researchers have certain international collaborations, activities, or co-authors, particularly those involving entities or individuals affiliated with entities in designated foreign countries of concern (FCOC): China, Russia, North Korea, Iran.

The DoD outlines 4 factors in their evaluation: (1) Participation in a malign foreign talent recruitment program (MFTRP); (2) Receipt of funding from a FCOC or a foreign entity of concern; (3) Patent filings in or on behalf of a FCOC; (4) Affiliations or collaborations with entities on prohibited entity lists.

Contact JORA (jora@georgetown.edu) or ORO (researchsecurity@georgetown.edu) for more information on DoD’s risk matrix and the potential impact on Georgetown researchers. A key information sheet for DoD researchers is available here.

NASA is restricted by law from using appropriated funds to engage in bilateral participation, collaboration, or coordination with China or Chinese-owned companies. This restriction applies to all activities conducted under NASA awards. Institutions and individuals involved in NASA-funded research are prohibited from engaging in bilateral coordination, collaboration, or participation with China or any Chinese-owned companies or Chinese universities, including individuals working for such entities, under a NASA award. This restriction includes direct sharing of NASA-funded research data through any means, including IT systems, as well as bilateral joint publications with authors affiliated with the Chinese government or Chinese companies or universities. Covered individuals are prohibited from participating in any NASA-funded project if they are party to a MFTRP. Georgetown requires that covered individuals on NASA research complete a NASA-specific research security attestation. Contact JORA (jora@georgetown.edu) or ORO (researchsecurity@georgetown.edu) for more information on NASA’s research security requirements and attention.

In order to ensure the university can identify all individuals with access to laboratories, research facilities and research information and systems, an academic visitor portal, housed in GU360, has been created to allow for pre-review and screening of non-Georgetown-employed academic visitors. This portal utilizes a risk-based approach of pre-visit screening and review of individuals who will be operating in academic or research capacities, based on the nature of their visit and activities with Georgetown and the duration of their stay. Visitors are categorized by risk category in the following ways:

Category 1: Visit duration less than two weeks with no laboratory, clinical or other high-risk activities;

Category 2: Visit duration two weeks or longer, with no laboratory, clinical or other high-risk activities; and

Category 3: Visit including laboratory, clinical or other high-risk activities, regardless of duration.

All academic visitors from foreign countries of concern under Georgetown-sponsored visas must be reviewed and onboarded using the academic visitor portal. When launched university-wide, all Category 2 and Category 3 visitors must be reviewed and onboarded using the academic visitor portal, as well as Category 1 visitors coming from or affiliated with entities in foreign countries of concern.

The NIH’s Policy on Enhancing Security Measures for Human Biospecimens establishes new requirements for sharing or distributing human biospecimens collected, obtained, stored, used, or distributed with ongoing or new NIH support, in alignment with Executive Order 14117 and 28 CFR Part 202. This policy aims to protect U.S. persons’ sensitive health data and prevent foreign adversaries from accessing Americans’ genomic or personal health information, and applies to all NIH-funded mechanisms, including grants, cooperative agreements, contracts, Other Transactions, and intramural support. 
Key Restrictions Outlined in NIH Policy
* The biorepository, institution, or investigator that holds human biospecimens of U.S. personscollected, obtained, stored, used, or distributedusing on-going or new NIH funds are prohibited from directly or indirectly distributing the human biospecimens to institutions or parties located in countries of concern
* Countries of concern include: China (including Hong Kong and Macau), Russia, Iran,North Korea, Cuba, or Venezuela
* This restriction applies even to the transfer of a single biospecimen and extends to indirect transfers (e.g., via intermediaries or third-party collaborators).

Key Requirements for Georgetown’s Research Community
* Do not share, distribute, or ship any human biospecimen materials without an appropriate institutional agreement in place
* Georgetown’s MTA, DUA, and other agreement processes include appropriate screening and vetting of destination countries and entities for such materials
* Coordinate with ORO and EH&S before any international shipment of human biospecimen materials

The DOJ’s Bulk Data Rule (also known as the DOJ Data Security Program (DSP)) imposes requirements on U.S. persons and entities that provide access to bulk U.S. sensitive personal data and government-related data, including the need to prohibit or restrict transfers of such data to Countries of Concern or Covered Persons, as defined in the Rule.

A one-page key information guide created by the IAPP is available for reference here.

Researchers handling sensitive data (such as those described below), and who are collaborating with individuals or entities in countries of concern (as listed below), must ensure compliance with the Rule as applicable.

Any transfer of University data, including sensitive data, must occur under the appropriate University agreement (e.g., DUA, SRA).

Countries of Concern and Covered Persons

The Rule prohibits certain transactions involving sensitive data with countries of concern and covered person(s): China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia, and Venezuela.

*The above list of countries also includes individuals and entities under their control.

Covered persons under the Rule includes:

• Foreign entities that are organized under the laws of a country of concern, have their principal place of business in a country of concern, or are 50% or more owned by a country of concern.
• Entities that are 50% or more owned by another covered person.
• Foreign individuals who are:
  • Primarily a resident in a country of concern, or
  • Employed by or acting on behalf of a covered entity.
• Any individual specifically designated by the DOJ as subject to the direction or control of a country of concern or another covered person

Categories of Sensitive Data & Bulk Thresholds

The Rule establishes the following categories of personal data, along with the designated bulk thresholds below. Any combination of these categories in which at least one type meets the bulk threshold is subject to the Rule:

Category of Sensitive Data Bulk Threshold

• Covered Personal Identifiers   (100,000 U.S. Persons)
• Personal Financial Data   (10,000 U.S. Persons)
• Personal Health Data (10,000 U.S. Persons)
• Precise Geolocation Data   (1,000 U.S. Persons)
• Biometric Identifiers   (1,000 U.S. Persons)
• Human ‘omic Data (not Genomic) (1,000 U.S Persons)
• Human Genomic Data (100 U.S. Persons)
• Combined Data (Lowest Applicable Number)

The term “bulk U.S. sensitive personal data” means a collection or set of sensitive personal data relating to U.S. persons, in any format, regardless of whether the data is anonymized, pseudonymized, de-identified, or encrypted, where such data meets or exceeds the applicable threshold.

Exceptions to the Rule

The rule includes exemptions which allow data transactions that would otherwise be prohibited under the Rule, including the following most likely relevant to researchers;

Data transactions with countries of concern or covered persons involving drug, biological product, device, or combination product approvals or authorizations if the data transactions involve regulatory approval data   necessary to obtain or maintain regulatory approval.

Data transactions with countries of concern or covered persons conducted pursuant to a grant, contract, or other agreement entered into with the U.S. Government are exempt from the Rule.

Federal Risk Matrix Overview

NIH Decision Matrix for Assessing Potential Foreign Interference for Covered Individuals or Senior/Key

DoW 1286 List

DoW Component Decision Matrix to Inform Fundamental Research Proposal Mitigation Decisions

NSF Trusted Research Using Safeguards and Transparency (TRUST) Framework

DOJ Data Security Program Compliance Guide

IAPP Data Security Program Cheat Sheet