Australian research needs to be protected like critical infrastructure
Australian research needs to be protected like critical infrastructure
Australia should better protect its most strategically sensitive university research by adapting principles from its Security of Critical Infrastructure (SOCI) framework, its arrangement for defending vital facilities, supply chains, information technology and communications.
Universities increasingly hold technologies, data and intellectual property whose compromise could affect national security, economic resilience and sovereign capability. This doesn’t mean treating all university research as subject to the full suite of obligations under the SOCI framework but rather applying its risk-governance approach more systematically to strategically significant research.
Australia isn’t starting from scratch. The University Foreign Interference Taskforce already gives universities guidance on governance, due diligence, cybersecurity and foreign-interference risks. Defence trade controls already regulate some transfers of military and dual-use technology, and universities also operate their own cybersecurity, research-integrity and risk-management systems. The next step should be to sharpen this combined approach by borrowing from the SOCI approach.
Under SOCI, organisations responsible for certain critical assets must maintain a Critical Infrastructure Risk Management Program. They must identify hazards where there is a material risk to an asset and take reasonably practicable steps to minimise or eliminate those risks and mitigate their consequences. The important idea here isn’t the regulatory machinery itself; rather, it is SOCI’s focus on identifying material risks to important assets and managing those risks proportionately. Research security could apply this logic more systematically at the level of strategically significant research capabilities.
Universities may hold thousands of research projects, datasets, laboratories and intellectual-property assets at various levels of strategic significance. Treating them as though they were equal would either impose excessive security on routine research or leave important capabilities without enough protection. Australia should therefore identify a narrower class of strategically significant research capabilities, defined by more than commercial value, technological sophistication or links to defence.
Fields such as AI, quantum technology or biotechnology shouldn’t automatically be labelled sensitive. Instead, the test should focus on consequence. Research involving quantum-resistant cryptography, advanced radio-frequency systems, autonomous technologies, dual-use AI or unique datasets may meet that threshold. However, the subject area alone shouldn’t determine whether research is strategically significant.
Strategically significant research is better defined as a research capability whose unauthorised acquisition, manipulation, loss or disruption could materially harm Australia’s national security, critical-infrastructure resilience, economic security or ability to independently develop and sustain technology of national importance. That creates a direct parallel with SOCI. For critical infrastructure, the starting question is whether a hazard poses a material risk to an asset. For research, the equivalent question should be whether compromise of a particular capability could have a material strategic effect on Australia.
SOCI doesn’t treat cybersecurity as the only source of risk. Its risk-management approach considers a broader range of threats to an asset. Research security should do the same. A strategically significant research program might face cyber intrusion, insider risk, inappropriate technology transfer, compromised supply chains, physical theft, undisclosed affiliations or manipulation of research data. Assessing those risks together would be more useful than treating each one as a separate compliance problem.
SOCI places responsibility for risk management at the organisational level rather than leaving security entirely to technical specialists. Strategically significant university research should similarly attract clear senior accountability. Where a university holds a capability of national importance, responsibility for protecting it should be visible at the executive and governing-body level. Higher education and research already sit within the SOCI framework, yet the full risk-management obligations applied elsewhere in critical infrastructure don’t extend uniformly to critical education assets.
Universities are fundamentally different from electricity networks, telecommunications systems or ports. Research depends on openness, international collaboration and the movement of people and ideas. Applying infrastructure regulation wholesale could damage the very research Australia is trying to protect. The lesson from SOCI is therefore one of governance, not classification: identifying what is most important, understanding the hazards facing it, applying controls proportionate to the consequences, reviewing those risks as circumstances change and holding senior leaders accountable.
This approach could also help preserve academic openness. If the government can identify the small pool of research capabilities whose compromise carries serious national consequences, stronger controls can be concentrated there rather than imposed generally across disciplines or international partnerships.
The timing is right. This month, the University Foreign Interference Taskforce steering group announced plans to refresh its approach in response to an evolving security environment. Existing government guidance on defending against foreign interference already encourages proportionate safeguards and is intended to support rather than restrict low-risk academic activity.
Australia should build on this foundation. SOCI already recognises higher education and research as part of Australia’s critical-infrastructure landscape. This should now be taken further, by applying SOCI’s central risk-governance principle more intentionally to the research capabilities whose compromise would have the greatest national consequences. Australia doesn’t need to turn universities into fortresses. It needs to identify the research it cannot afford to lose and govern the risk accordingly.
About Author
