State Threats and Universities: Case Studies from the United Kingdom

Universities within the United Kingdom are facing increased threats from state actors
and are attractive targets due to their world-leading role in research, intellectual property development, and international collaboration. These threats manifest themselves in many different ways and, as such, there is an increasing need to ensure that universities and, indeed, researchers fully understand the myriad of risks that they may be exposed to. In responding to these risks, universities will likely be challenged in striking the balance between openness and security, and it is therefore fundamental that decisions are informed by knowledge of the latest threats and mitigations, as well as advice from government agencies. Central to ensuring the security of UK research is the need for universities and researchers to fully understand the risks that they face.
The purpose of this report is to introduce some of the risks that UK universities have
faced from state threat actors in recent times through a series of case studies. In some of the case studies presented the intentions of the threat actors are subtle and required technical assistance from specialist IT practitioners to identify these. Other risks, however, stem from challenges including geopolitics, informal collaborations, funding and reputation. These case studies are designed to help other universities understand the different risks that are present within the UK research environment, as well as what was done by those universities to manage and mitigate the risks.
The case studies have been developed from interviews with different UK universities and focused on actual or near-miss state threat related security incidents allowing universities to tell their story on what happened, the impacts that were experienced, what was done in response, and how other universities could learn lessons from them.