Special audit reveals safety deficiencies at the Cispa research center

Berlin. At the Helmholtz Center for Information Security Cispa in Saarbrücken there were serious deficits in research security and export controls. These are the central results of a special external audit. The findings regarding possible data outflows and connections to China are particularly explosive.

“The door and gate to the Research Center for Information Security were wide open,” said Federal Research Minister Dorothee Bär (CSU). In the early afternoon, she informed the research committee in the Bundestag about the initial results of the around 400-page report.

“The outflow of security-relevant information can neither be confirmed nor ruled out.” According to Bär, the reason is “exclusively” that the data available at Cispa does not allow any reliable statements to be made.

However, the investigation into the technical access options showed “that an outflow of security-relevant information was possible because the existing regulations and systems were not suitable to prevent this.”

Cispa in Saarbrücken, which is part of the Helmholtz Association, has been under pressure for weeks because of research collaborations with Chinese institutions. This was preceded by a report in the Handelsblatt from mid-June about Cispa's proximity to researchers from China.

The institute has therefore worked with Chinese scientists from universities in the military environment who are on US sanctions lists. Many of them come from military-related facilities in China.

After it became known, the shareholders, the federal government and the Saarland, immediately appointed a special auditor to examine the events in the Helmholtz Center. The special audit was intended to clarify whether security-relevant research results were passed on to foreign bodies.

The verdict on the protection of trade secrets is clear in the report. The organization of the Cispa and its technical and organizational measures were “in no way” sufficient to adequately take into account the protection against unauthorized transfer abroad, said Bär.

The research center's China connections were also the subject of the investigation. It is “true that Cispa has also cooperated and published with risky people and institutions from the People’s Republic of China,” said the minister.

According to the auditors' findings, the center "did not have a sufficiently resilient and risk-adequate research security system." The deficits also extended to the selection of scientific staff and cooperation partners, “not least from China”.

Bär pointed out that the risks of international research collaborations and China-related research security issues had been repeatedly addressed in the supervisory bodies. However, the management “did not adequately fulfill” its management tasks in export control and research security. It therefore bears “organizational responsibility for the identified risks”.

Bär emphasized that basic research does not exempt the center from taking appropriate safety precautions. Risks of an undesirable outflow of knowledge and technology, dual-use potential, security-relevant international cooperation and undue influence should have been adequately taken into account. “According to the report, that was not the case.”

Bär also expressed criticism of the scientific director Michael Backes. “Unlike what was requested by the shareholders’ meeting, he refused to cooperate fully with the special auditor from the start.” Backes had been released from duty for the duration of the investigation.

It is still unclear what consequences the federal government and Saarland will draw from this. The report will now be carefully evaluated. “Further necessary consequences” would then be drawn, said Bär. It is already clear that the Ministry of Research wants to represent itself on the Cispa supervisory board again in the future.

At the same time, Bär supported the center's scientific work. This is “scientifically excellent” and, given geopolitical developments, “of essential importance more than ever.” However, the Cispa case shows that professionalization of research security in the German science system is “urgently necessary,” especially when it comes to dual-use technologies.

Bär formulated a clear limit: “Academic freedom must never be an invitation to freedom from espionage or to the unauthorized outflow of knowledge and technology.”