As a global institution of higher learning, the University of Pittsburgh openly welcomes Academic Visitors from around the world to participate in academic and research activities. There is also a growing expectation from U.S. government officials to more actively manage and protect intellectual property that results from taxpayer funded research and training. These expectations are now pronounced due to growing examples of research integrity violations through undisclosed foreign engagements and unapproved transfers of data, technologies, and materials to foreign countries. The University of Pittsburgh, through the Senior Vice Chancellor for Research, has created an International Engagement website that goes into further detail about the broad topic of foreign influence, and University systems and offices that are available to assist faculty and staff with their questions.
This section will elaborate on various research security tools and processes that the University either requires or recommends for University hosts under the Academic Visitor Process.
Restricted Party Screenings and Restricted Party Lists
U.S. Government agencies and its allies maintain public lists of individuals and entities, which are restricted or prohibited from participating in certain types of transactions with U.S. persons (defined as U.S. citizens and permanent residents or any corporation, business, organization, or group incorporated in the U.S. under U.S. law). Individuals and entities can be placed on these public lists for multiple reasons ranging from tax evasion to terrorism. These lists include both domestic and international individuals and entities. Restricted Party Screenings (RPS) check against these public lists and are necessary in order to rule out possible restrictions or prohibitions on prospective Academic Visitors and their sponsors. This short step also ensures that Pitt and the sponsoring school/department do not unknowingly violate the law.
An RPS is required for Category 2 and 3 Visitors and their affiliated institution, company, or sponsor due to their length of stay on campus, and in most cases, their proposed research activities and access to higher risk University laboratories. An RPS is also recommended for Category 1 Visitors and their affiliated institution, company, or sponsor. RPS’s are automatically conducted through the MyEC system. If the MyEC system is not used, the host departments and schools are responsible for performing their own RPS using the E2Open (Amber Road) RPS Tool. Departments and schools should retain RPS results for their records. If your visitor appears on a restricted or prohibited list, it may be possible to host the visitor but only after review and approval from the Office of Export Controls Services.
Export Controls Review
Export Controls include U.S. laws and other regulations that involve the shipment, transfer or disclosure of controlled items, technical data and software to foreign countries or to foreign persons and entities within the U.S. These laws aim at protecting the national security, economic interests and foreign policy of the United States. The information requested via the MyEC electronic review process is reviewed by the Office of Trade Compliance in order to determine if any government licenses or other internal controls are needed for the proposed activities.
To prompt this review, please enter the requested data into the MyEC Electronic Visitor System and submit the electronic form. The Visitor Liaison will then facilitate the export controls review with the Office of Trade Compliance. If there are questions about information provided on the form, either the Visitor Liaison or a member of the Office of Trade Compliance will contact you. The Visitor Liaison will notify you electronically via the MyEC system once the review is completed.
Embargoed Country Screening
Certain organizations and individuals are subject to trade sanctions, embargoes, and other restrictions under U.S. law. If your prospective Visitor is a citizen of an embargoed country, or their sponsoring institution is located in an embargoed country, there is a high probability that a specific government license and/or an internal control plan will be needed in order for the University to host this type of Academic Visitor. Currently, the U.S. Department of the Treasury lists the following countries as highly embargoed: the Crimea Region of Ukraine, Cuba, Iran, North Korea, and Syria.
The University can host an Academic Visitor from an embargoed country who is in the U.S. on an approved visa, but a review of their planned activities will be required first in order to determine if a specific government license is required. The MyEC system will automatically perform this check for you for Category 2 and 3 Visitors. It will also be done automatically for departments and schools choosing to use the MyEC system for Category 1 Visitors. If the MyEC system is not used for Category 1 Visitors, and an embargoed country is an element of a proposed Category 1 Visit, please contact the Visitor Liaison for advice.
Cyber Security
As a matter of policy, the University only endorses research projects where the results can be published and freely shared with the public. The University relies on its faculty to protect the results of research until they decide to publish or release the results. Since most data is saved electronically, University hosts should provide electronic access to Academic Visitors only to the extent that it aligns with their approved scope of activities.
Unless otherwise specified, the University’s security standard for protecting the confidentiality, integrity, and availability of research data is NIST 800-171: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations. This standard addresses the following security domains:
|
|
|
|
|
|
|
|
|
|
|
|
|
|
The University has comprehensive service offerings, including computer, storage, networking, email, and security services to support researchers, which comply with NIST 800-171. The University also offers robust cloud services such as Microsoft Azure, Amazon AWS, and Google Cloud Platform.
While the University offers many options for researchers to process, store, and transmit data, researchers must consult our data risk classification and compliance guide to understand what services are approved for each data type. Security Guides for several popular services are also available from this site to help ensure research data is well protected. If researchers consider using vendors to support their research, please request that Pitt IT Security perform a Vendor Security Risk Assessment.
To assure a consistent baseline of information security knowledge, the University requires that all Academic Visitors take the Security Essentials training course available on-demand at our Information Security Training site.
University security resources:
- Pitt IT Security site
- Data Risk Classification and Compliance
- Disclosure of Sensitive Information
- Downloading University Data Standard
- Enterprise Security Controls
- HIPAA Compliance
- Information Security Training
- Learn to Spot a Phishing Scam
- University Policies Related to Technology
- Vendor Security Risk Assessment
For further guidance, the researchers can contact the Pitt IT Help Desk to request a data security consultation.
Data Management and Federal Government Expectations
In the spirit of the University’s Guidance on Research Data Management, University hosts are, at their discretion, permitted to share unpublished research data with Academic Visitors. However, hosts should also understand their obligation to directly manage and safeguard an Academic Visitor’s use of such data under the Visitor’s approved scope of work. Often times, this data is supported by tax payer funded projects through one or more U.S. government agencies. Principal Investigators of federally funded projects are required to disclose a Visitor’s participation in such projects to the funding agency under their disclosure policies. Greater care and security should be afforded to data and technology that is seen as more valuable, and in some cases, “irreplaceable”.
Some students funded by foreign governments are obligated to report back at regular times on their progress. These reports may include unpublished data from a federally funded project. It is important to establish a process whereby the University host reviews and approves the release of any university owned data within a required report.
Monitoring and Supervisory Considerations
It is important to monitor and provide feedback to your University Visitor while they are on campus. Part of this oversight includes being sensitive to problematic behaviors that may be a sign of inappropriate or illegal activities including theft or diversion of University data or technology. However, perceived problematic behaviors may only reflect a visitor’s cultural orientation and not be a sign of illegal activities. Thus, it is important to maintain constant open communications while the visitor is on campus, and actively manage expectations. The following chart contains some problematic behaviors that should be addressed:
|
Insists on working in private |
Has unexplained or prolonged absences |
|
Lacks concern for or violates security protocols |
Attempts to gain access without a need to know |
|
Shows unusual interest in information that falls outside of his/her approved scope of work |
Rummages through offices or desks of others |
|
Expresses an interest in covert activity |
Volunteers to help on other sensitive projects to gain access to other labs or data |
|
Takes sensitive data, technology, or materials home without authorization |
Attempts to access unauthorized systems |
|
Misuses computer or information systems |
Brings audio or visual recording devices into work areas without authorization |
|
Unnecessarily photocopies or downloads sensitive material |
Conceals foreign contacts or those they know well (family, friends) |
|
Takes short trips to foreign countries for unexplained reasons |
Employs elicitation techniques |
Questions about this topic should be directed to Allen A. DiPalma, Director of Trade Compliance at dipalma@pitt.edu.