Berlin. Several politicians across party lines are calling for a broad and regular security check for German research institutions. The reason is the serious security deficiencies at the renowned Helmholtz Center for Information Security (Cispa) in dealing with Chinese cooperation partners in highly sensitive research areas.
“The federal and state governments should now check whether comparable vulnerabilities also exist at other research institutions,” recommended the digital policy spokesman for the SPD parliamentary group, Johannes Schätzl. When it comes to key technologies and dual-use research that can be used economically and militarily, there should be “no blind spots,” he told the Handelsblatt. Scientific collaboration remains important: "But openness should not be confused with naivety."
The chairman of the Bundestag's intelligence control committee, Marc Henrichmann (CDU), also emphasized: "When it comes to research security, we need a higher level of risk awareness for possible espionage." The Cispa case shows “how seriously we must take the risk of scientific espionage, especially by China.”
The deputy of the Green Party, Konstantin von Notz, described the events at Cispa to the Handelsblatt as a “real alarm signal”. This also applies with regard to the “urgently necessary increase in the protection of other research and economic institutions”. Von Notz is deputy chairman of the Intelligence Control Board.
The background is reports from the Handelsblatt about the research center's explosive Chinese connections. Cispa had worked with Chinese scientists from military-related universities who are on US sanctions lists.
The Green Party's research policy spokeswoman, Ayse Asar, is specific: "The participation of institutions, companies and cooperation partners based in the People's Republic of China must no longer be permitted in all key technologies financed by the High-Tech Agenda Germany," she demanded. "We need a clear catalog of criteria that applies to all research institutions." This includes the rule: "No cooperation with the Sevens Sons or other institutions that are subordinate to the Chinese Ministry of Industry."
Five of the universities with which Cispa has worked belong to the so-called Seven Sons of Defense. The “Seven Sons of National Defense” are elite universities that have close ties to the defense industry and are subordinate to the Ministry of Industry and Information Technology. They work on top secret projects, such as developing weapons systems. 20 German universities and technical colleges nationwide work with the Sevens Sons.
For the Office for the Protection of the Constitution, the Cispa case is part of a greater threat situation. China has been building a “comprehensive system of technology and know-how transfer” for years, the authority explains. In doing so, the country wants to strengthen its supremacy “politically, economically, technologically and militarily” and, among other things, achieve global market and technological leadership. “The procurement of technology and know-how can also take place through scientific cooperation with universities and (top) research institutions in Germany,” explained the Federal Office. The Chinese state is specifically exploiting weak points in the German science system.
The focus is on so-called “emerging and disruptive technologies”, including quantum technology, artificial intelligence (AI) and hypersonic technology. Bio and surveillance technologies are also of interest. Many of these research fields can be used for both civil and military purposes.
At the request of the Handelsblatt, the domestic intelligence service named several factors that play into Beijing's hands. The Federal Office for the Protection of the Constitution sees “legal gray areas”, a “lack of risk awareness” and the “academic freedom of science” guaranteed by the constitution in Germany as gateways for Chinese espionage. This leaves Beijing open to exploiting Chinese guest scientists for its “strategic ambitions”.
The Handelsblatt research prompted the federal government and Saarland to appoint the auditing firm KPMG as a special auditor. The first results of the approximately 400-page report, which is classified as secret, were announced last Wednesday. Federal Research Minister Dorothee Bär (CSU) said in the Bundestag Research Committee that Cispa had, figuratively speaking, “the door wide open” when it came to research security.
There were no security measures. The House said the results were “devastating”. In the meantime, the federal government and Saarland have separated as shareholders from the head of Cispa.
Green Party politician von Notz called it “completely incomprehensible” that there are still institutions that ignore the warnings of the Office for the Protection of the Constitution. This reveals “a frightening level of naivety.” Security authorities have been drawing attention to the threat for years. With Cispa in particular, given its research area, it was actually clear how much the institution was in the focus of potential attackers. Nevertheless, the center did not meet basic security standards.
An experienced export controller analyzed and evaluated the situation at Cispa based on the published work of the former scientific director and another central department head. The results are available exclusively to Handelsblatt.
The work is “worthy of inspection,” according to the inspector’s assessment, who did not wish to be named. Some are even “particularly worthy of review” because they came about in cooperation with critical Chinese universities or institutes and were co-financed with Chinese funding. “Chinese funding recipients are subject to Chinese disclosure obligations to the state,” says the expert, explaining the high risk of knowledge leakage.
According to the Foreign Trade Ordinance, there is an obligation to audit, according to the expert, since research into AI security technologies “potentially falls under the area of strategic key technologies”. Scientific questions such as attacks on AI systems or work on cryptography may also fall under the European dual-use regulation and should be examined accordingly.
In addition, the Federal Office of Economics and Export Control should have been involved to check the technology areas and whether “knowledge transfer via publications constitutes an act requiring approval”. There was also particularly “dense” cooperation with individual scientists in China, which shows the danger of “possible informal knowledge transfer channels,” the expert summarizes.
For the future, the expert recommends reviewing all current and planned collaborations between Cispa researchers and Chinese institutions and funding agencies. Cispa should introduce a mandatory disclosure requirement for external funding sources, including foreign ones. A comprehensive and intensive preliminary review should be introduced for international co-authorships - especially for co-authors from military-related institutions.
In view of what is happening at Cispa, the SPD politician Schätzl also believes that it is essential that when cooperating with Chinese institutions, it is necessary to examine more closely who is on the other side. "If there are connections to the military, intelligence services or other state structures, we cannot simply assume that they are trustworthy partners."
