Export control of knowledge transfer and international sanctions
Below is an overview of guidelines in the export control regulations and international sanctions with regard to important definitions, responsibilities, information resources and tools, as well as assessments for institutional management and academic communities.
Recently edited : 7. June 2024In recent years, threat assessments from NSM, PST and NIS have shown that some states are trying to acquire knowledge that can be used for military purposes, in violation of national security and defence policy interests. Such attempts can for example take place by recruiting and placing their own citizens in advanced educational and research environments. The battle for access to knowledge and research is at the heart of the geopolitical rivalry and the race to translate new technologies into military capabilities.
Norwegian higher education and research institutions maintain a high international level in fields of military relevance. Underwater and materials technology are examples of knowledge that we know some foreign actors are trying to obtain from Norway for military use in their home country. Export control assessments must therefore be made when recruiting academic staff, receiving visiting researchers and admitting students to certain courses at PhD and master's degree level.
In research cooperation, the export control rules apply to the sharing of information and research results with foreign institutions. For knowledge covered by the export control regulations, the sharing of information when teaching courses and in attending conferences may also require prior licence. Based on estimates from Sweden and the United States, we assume that less than ten per cent of the research projects should apply for prior licence, and that approximately two per cent of the projects will be problematic in terms of export control.
What are international sanctions?
The Ministry of Foreign Affairs administers sanctions regulations that regulate Norway's obligations to implement sanctions adopted by the UN Security Council, as well as certain restrictive measures adopted by the EU. The regulations are based on Lov for gjennomføring av internasjonale sanksjoner ('Act relating to the implementation of international sanctions' – in Norwegian only). The sanctions are differently designed and it is recommended that knowledge institutions and the academic environments identify which prohibitions apply to the relevant partner country with regard to, for example, financial transfers or the use of equipment.
What is export control of knowledge transfer?
Through international treaties, Norway has undertaken to prevent the proliferation of chemical and biological weapons, prevent the proliferation of goods and technology relevant to nuclear weapons, and control conventional weapons, military goods and sensitive high tech. This is enshrined in the Act relating to Control of the Export of Strategic Goods, Services, Technology, etc. from 1987 and operationalised in Forskrift om eksport av forsvarsmateriell, flerbruksvarer, teknologi og tjenester (eksportkontrollforskriften) ('Regulations relating to the export of defence materiel, dual-use items, technology and services (export control regulations)' – in Norwegian only).
Export control in the research and education sector is mainly about control of knowledge transfer and research cooperation, pertaining to mapping of equipment and technology that require a licence, as well as awareness of data security, student and staff exchanges and visiting lecturers. Knowledge transfer control applies to new knowledge that is not already openly available 'in the public domain'.
What is the purpose of the export control regulations?
- To ensure that exports of defence materiel from Norway are in line with Norwegian security and defence policy.
- To ensure that exports of dual-purpose goods do not contribute to the proliferation of weapons of mass destruction (WMD – nuclear, chemical and biological weapons) or means of delivery for such weapons. Means of delivery may include underwater technology, advanced electronics and materials. Dual-use items refers to items, software and technology, that were originally designed for civilian purposes, but that may have important military applications.
Which government agencies are responsible for export control?
The Ministry of Foreign Affairs (UD) is responsible for providing guidance on knowledge transfer with regard to whether prior licence is required for entering into international knowledge cooperation and knowledge sharing.
The regulations mean that material, technology and knowledge with military application must be approved by the Ministry of Foreign Affairs, which issues a prior licence before such material and technology can be exported from Norway.
If you are unsure about assessments of a subject area's sensitivity and applicable export restrictions, contact the Ministry of Foreign Affairs: eksportkontroll@mfa.no
If a knowledge institution is concerned that illegal knowledge transfer has or may take place, contact the Police Security Service for dialogue and advice.
How can I find out if our partnership needs to apply for a license of knowledge transfer?
Basic research is exempt from export control. In the regulations, basic research is defined as 'experimental or theoretical work undertaken primarily to acquire new knowledge of the underlying foundations of phenomena […] not primarily directed towards a specific practical aim or objective'. In other words, basic research should not lead to the development of a product or have a practical industrial use, but can be observation of phenomena in nature or similar.
Applied research is primarily aimed at specific practical objectives, technological development or applications. Applied research can be covered by the definition of dual-use items or dual-use purposes. To find out whether your field of research falls within the scope of the regulations, see List I – Defence-related goods (partly in Norwegian) and List II – multi-purpose goods (partly in Norwegian).
Main categories of subject areas that may be covered by export control in the field of research and education are:
- Life sciences, including biotechnology
- Biochemistry
- Chemistry, including chemical process technology
- Physics, including nuclear physics
- Aviation and aeronautical engineering technology
- Mechanical engineering
- Materials technology
- Cybernetics
- Medicine/veterinary subjects
- Mathematics
For these areas, the educational institution must make a special assessment of doctoral research fellows (PhD) with regard to whether prior licence must be applied for. In addition, special attention must be paid to master's programmes with regard to the need for prior licence in connection with master's theses and in particular those that involve the following areas of technology:
- Life sciences, including biotechnology
- Biochemistry
- Chemistry, including chemical process technology
- Physics, including nuclear physics
- Aviation and aeronautical engineering technology
Although the export control regulations are aimed at the development of applied knowledge within specific fields, the regulations will primarily apply in practice when processing applications for admission or employment of students, doctoral fellows, and researchers from countries subject to export restrictions, or from countries where there are justified suspicions or concrete information about concerning activities related to the development and use of WMDs and their delivery systems.
These resources provide procedures for determining whether research fields and fields of education are covered by the export control regulations:
Residence permits for foreign researchers and students
The Directorate of Immigration (UDI) processes applications for residence permits to work or study in Norway. The applications must be assessed in relation to matters affecting national security, which are set out in The Act relating to the admission of foreign nationals into the realm and their stay here (Immigration Act) Chapter 14 and the Regulations relating to the admission of foreign nationals into the realm and their stay here (Immigration Regulations) Chapter 19A.
The case processing is described in GI-03/2023 – Instruks om behandling av saker som kan berøre grunnleggende nasjonale interesser eller utenrikspolitiske hensyn etter utlendingsloven kapittel 14, og saker etter eksportkontrollregelverket ('Instruction on the processing of cases that may affect fundamental national interests or foreign policy considerations under Chapter 14 of the Immigration Act and cases pursuant to the export control rules' – in Norwegian only).
The instructions also give an indication of what information should be included with a residence permit application. When applying for a residence permit, the applicant will receive a checklist of the documentation required, based on the type of application.
How do I apply for licence of knowledge transfer?
Applications should be submitted well before a foreign researcher is appointed or visits the institution, or before foreign students are admitted. Here is an overview of the estimated case processing times (in Norwegian only). Ensure that the application is correctly filled out and that all required attachments and documentation are enclosed.
All applications to the Ministry of Foreign Affairs must be submitted via E-lisens.
What responsibility do the universities and research institutes have?
The knowledge institutions must comply with the export control rules, and the following measures are recommended in this connection:
- Obtain an overview of which areas of knowledge are regulated by export control legislation.
- Obtain an overview of which international cooperation activities, education levels and positions in the institution, the export control regulations will apply to.
- Identify equipment, lab facilities and information that require additional protection in the form of access control and develop security systems to safeguard these assets.
- Develop internal procedures that ensure control of knowledge transfer in all activities associated with the sensitive subject areas.
Assessments must be made when recruiting academic staff, receiving visiting researchers and admitting students to certain courses at PhD and master's degree level.
Proposed assessments and procedures for management and administration
- Incorporate export control as part of the institution's overall risk management. Consider assigning responsibility for export control to dedicated persons at the institution. However, it is important that the institution's security work is rooted in the management.
- Valuation of the research areas forms the basis for which security measures must be introduced in order to comply with the regulations. The scope of values/assets covered by the regulations should be used to dimension administrative support and control systems in this field.
- Conduct a mapping of sensitive research areas, cooperation projects, interdisciplinary activities, master's and PhD programmes, laboratories and equipment.
- Consider whether the academic environments covered by the export control regulations are sufficiently familiar with them.
- Ensure regular updates, awareness and knowledge of internal export control procedures in the relevant academic environments.
- Consider the need for enhanced access control to laboratories and equipment.
- Obtain an overview of equipment that requires a licence included on list II in the export control regulations and sanctions and restrictive measures.
- The knowledge institution should keep an overview of countries subject to sanctions that may entail restrictions on international knowledge cooperation. Note that prior licence must always be applied for in order for persons with Iranian nationality/connections to Iran to use the equipment/technology/knowledge listed in the annexes to the Iran Regulations.
- Introduce standardised background checks for appointments in subject areas and positions covered by the export control regulations (see page about recruitment and appointment).
- Consider whether positions with expanded authority, rights and access should be routinely authorised through a background check.
- If an educational or research institution is concerned that illegal knowledge transfer has or may take place, contact the Police Security Service for further dialogue and advice.
Proposed assessments and procedures for the academic community
- Is your subject area on the list of knowledge areas covered by the export control regulations?
- Does your research, teaching or international project cooperation depend on the use of a laboratory/technology/equipment/software that is on List II - dual-use technology?
- Can the knowledge developed through the collaboration have a potential military application (including delivery technology)?
- Is the country involved in the planned knowledge cooperation covered by the sanctions regulations? Consider possible implications for the cooperation.
Other resources and tools for compliance with export control regulations for knowledge transfer
- The Ministry of Foreign Affairs' website with an overview of sanctions and restrictive measures
- The National Threat Assessmentprovides information about the countries the Police Security Service considers to be security threats and that could engage in covert attempts to collect information.
- The National Security Authority's annual threat assessment 'Risiko' ('Risk' – in Norwegian only)
- The Norwegian Intelligence Service's annual threat assessment 'Focus'
- EU compliance guidance for research involving dual-use items
- Report No 26 to the Storting (2018-2019) – Eksportkontroll av forsvarsmateriell fra Norge I 2018, eksportkontroll og internasjonalt ikke-spredningsarbeid ('Export control of defence materiel from Norway in 2018, export control and international non-proliferation work' – in Norwegian only).
- Sikresiden.no has created an e-learning course on export control.
- The Council for Public Security and Preparedness in the research and education sector has prepared a memo: Kontroll med kunnskapsoverføring ('Control of knowledge transfer' – in Norwegian only). In the appendices, there are examples of how to word call texts and reservations in connection with appointments.
Examples of internal security procedures
Examples of internal security procedures related to critical areas in the export control regulations for knowledge transfer at a research institute.
Ensure independence. Among other things, this means not entering into agreements that cannot be terminated at short notice. It requires a thorough assessment of the financial consequences of entering into the agreement and the financial and practical consequences of terminating the agreement for the institution. This ensures independence, since the institution does not commit to 'advertising' on behalf of equipment suppliers, and it is not contractually obligated to open doors to new customers or to markets.
Researchers are not funded in a way that gives them incentives to share data with unauthorised persons or adjust conclusions in order to secure their position in future.
Ensure that equipment from foreign suppliers with security risks is kept physically separate from internal infrastructure in separate rooms ('air-gap'). Air-gap is a security measure that involves isolating a computer or network by preventing it from establishing a remote connection to wirelessly or physically connect with other computers/devices.
Relevant authorities to contact
The Ministry of Foreign Affairs' Section for Export Control manages and enforces the regulations related to export control, and is the authority that decides when an export licence is required. The section can provide advice and guidance on which subject areas and activities are regulated.
The Police Security Service (PST) (in Norwegian) is Norway's domestic intelligence and security service and is subordinate to the Minister of Justice and Public Security. PST’s main task is to prevent and investigate serious crime that threaten national security. PST collects information about individuals and groups that may pose a threat, prepares analyses and threatand provides advice.
The Directorate of Immigration (UDI) considers applications for residence permits etc. in accordance with the Act relating to the admission of foreign nationals into the realm and their stay here (the Immigration Act). The applications must be assessed in relation to circumstances affecting fundamental national interests and foreign policy considerations, cf. the Immigration Act C14 and the Regulations relating to the admission of foreign nationals into the realm and their stay here (the Immigration Regulations) Chapter 19A.
Glossary
Protective security is a term used in the Security Act. It covers both measures that reduce the likelihood of an event occurring and measures that limit the effects of such an event.
Dual-use items refers to items that were originally designed for civilian purposes, but have important military applications. In the context of knowledge, dual use refers to research that can be expected to generate knowledge or technology that has a potential to be exploited for harmful purposes and that threatens public health or national security, even if the research has a different purpose
National security is defined as state security and a limited part of the social security area which is essential for a state's ability to safeguard national security interests.
National security interests are a country's sovereignty, territorial integrity and democratic system of government, as well as general political security interests related to (a) the activities, security and freedom of action of the highest state bodies, (b) defence, security and contingency preparedness, (c) relations with other states and international organisations, (d) economic stability and freedom of action, and (e) fundamental societal functions and the basic security of the population.
On the one hand, 'values' refers to norms and principles, such as academic freedom. However, the term 'values' or 'assets' is also used in the context of valuation and risk analysis. Here, the terms refer to anything that is worthy of protection and can be threatened, such as life and health, information, material assets and reputation. Measures cannot influence the values/assets and threats themselves. An organisation can however take measures to limit is its vulnerabilities (for example organisational or technical), which will in turn reduce the risk.