Education and Campus Security: Universities, Schools, and Research Facilities | CloseProtectionHire

University campuses combine some of the most valuable intellectual property in the world – pre-publication research in advanced materials, quantum technology, life sciences, and defence-relevant science – with some of the most open physical environments in any sector. The combination is not inherently unmanageable, but it requires a security model designed specifically for the academic context.

The threat picture has changed. National security agencies in the UK, US, Australia, and Canada now consistently identify academic and research institutions as primary targets for state-sponsored intelligence collection operations. The era in which universities could treat security as a primarily welfare and access-control function is over.

The Intellectual Property Threat

State-Sponsored Research Theft

In July 2021, NCSC, FBI, ASD, and CCCS jointly issued an advisory warning that academic institutions were being targeted by state-sponsored actors, specifically identifying the targeting of COVID-19 vaccine research, quantum computing, advanced AI research, and aerospace and defence-related science.

The advisory identified the primary attack vectors as:

• Spearphishing against specific researchers with access to target research
• Recruitment of insiders – both students and academic staff – to provide ongoing access to research output
• Exploitation of research collaboration agreements that provide legitimate access to systems
• Academic partnership and joint venture structures used to establish a persistent presence within the institution

The National Security and Investment Act 2021 was in part a legislative response to this threat picture, creating powers to scrutinise partnerships and collaborations in 17 sensitive sectors before they create vulnerabilities that are difficult to unwind.

Export Controls and Deemed Exports

The Export Control Order 2008, administered by the Export Control Joint Unit (ECJU), applies to the transfer of controlled goods, software, and technology. “Technology” includes technical data, technical assistance, and training. A university that involves a researcher from a country subject to export restrictions in controlled research activity may be transferring technology in a way that requires an export licence – even if no physical goods cross a border.

This is the “deemed export” concept. It is well-established in US Export Administration Regulations (EAR) and ITAR enforcement, and the ECJU is increasingly active in enforcing its UK equivalent. Universities with significant international research populations and defence or dual-use research portfolios need an export control compliance programme that specifically addresses the academic working environment.

Safeguarding and the Prevent Duty

Keeping Children Safe in Education

Schools are subject to the DfE statutory guidance Keeping Children Safe in Education (updated 2023), which requires governing bodies and proprietors to ensure appropriate safeguarding arrangements, including controlled access to the building, robust visitor management, and safer recruitment procedures. The security infrastructure required by the safeguarding framework – single point of entry during school hours, visitor sign-in with identity verification, CCTV at access points – is directly aligned with the physical security requirements.

Counter-Terrorism and Security Act 2015: Prevent Duty

The Prevent duty requires specified authorities – which include schools, further education institutions, and universities – to have due regard to the need to prevent people from being drawn into terrorism. For educational institutions, this means having policies and procedures in place to identify and respond to concerning behaviour, referral pathways through the Channel programme, and staff training in Prevent awareness.

The Prevent duty creates a specific governance requirement: designated Prevent leads with defined responsibilities, annual review of the institution’s Prevent risk assessment, and records of Prevent-related referrals and outcomes.

Access Control on an Open Campus

The open-campus model is not a security failure. It is a deliberate reflection of the institution’s educational purpose. Security measures must be designed to function within it, not to replace it with a closed-campus model the institution cannot sustain.

The effective approach is zoned access:

Zone A – Open campus: Public spaces, teaching buildings during teaching hours, library, student union. No access control beyond normal building security.

Zone B – Staff and enrolled student access: Research buildings, administrative offices, server rooms, specialist teaching facilities. Card access or fob required.

Zone C – Restricted research areas: High-value research equipment, sensitive data environments, defence research facilities. Named access list, visitor management system, audit trail of access.

CCTV deployment should follow the same zoned logic – coverage at the transitions between zones, at vehicle access points, and at the perimeter of restricted research buildings. General surveillance of open-zone spaces creates GDPR compliance obligations and public trust issues without proportionate security benefit.

Protest and Demonstration Management

Universities face protest activity more frequently than most comparable institutions. Student protest, external activist targeting of campus events, and conflict-related demonstrations are all recurring features of campus security operations.

The legal framework governing protest management on campus is not straightforward:

• The Higher Education (Freedom of Speech) Act 2023 imposes duties on registered higher education providers and their students’ unions to take reasonably practicable steps to secure freedom of speech, and to maintain a code of practice on it. This has implications for how institutions respond to protest against speakers or events.
• The Prevent duty requires the institution to assess the radicalisation risk of speakers and events.
• The duty of care to students and staff requires the institution to manage the physical safety of anyone on campus during a demonstration.

These obligations sit in tension. Managing protest on campus requires a policy framework that addresses all three, with defined protocols for each scenario type, a communications lead who understands both the freedom of speech obligations and the safety obligations, and a security operation that is capable of facilitating lawful protest while managing the safety risk.

Personnel Security in the Research Environment

The NCSC/FBI/CCCS advisory identified insider recruitment as a primary state-sponsored intelligence collection method in academic institutions. This creates specific requirements for personnel security in research environments:

Vetting for sensitive research roles: Access to high-value research systems should be limited to individuals who have been appropriately vetted. This does not necessarily mean government security clearance – for many research roles, a robust pre-employment screening process (identity verification, employment history, academic qualification check, right to work) combined with an ongoing monitoring culture is the appropriate level. Where research is classified or directly relevant to national security, BPSS or SC clearance may be required and should be a condition of the role.

Reporting culture: Staff and students need a clear, low-threshold reporting mechanism for approaches they consider unusual – requests for information outside their normal professional relationships, social approaches at conferences that feel transactional, requests to share pre-publication research with external parties. The reporting mechanism needs to be simple, confidential, and trusted.

For the insider threat assessment methodology and the indicators of insider recruitment that security teams and managers should recognise, see our insider threat and corporate security guide. For the surveillance detection awareness that is relevant to academic staff travelling to conferences or international research meetings, see our surveillance detection in close protection guide.