Parliamentary Joint Committee on Intelligence and Security – Questions on Notice

Parliamentary Joint Committee on Intelligence and Security – Questions on Notice Can each university provide material evidence of: 1. What Foreign Interference tools do they have in place and when were they developed? A detailed outline of UTS’s approach to foreign interference, including a timeline of when these tools were developed and our approach for the future, can be found in our opening statement tabled with the Committee on 19 March 2021. In summary for the Committee’s benefit, UTS, working closely with University Foreign Interference Taskforce (UFIT) and other universities, has developed a number of tools designed to mitigate foreign interference risks including: • A mature policy framework covering risk and due diligence • A risk-based delegation framework which ensures independent oversight and approval, including the use of an external due diligence partner • Clear rules around managing conflicts of interests in the Code of Conduct • External risk condition indicators used for risk assessments • Best practice cyber security program, including online awareness training • A principles-based approach to international engagements which ensures UTS makes an informed decision on a potential partner based on the opportunity and risk profile • A deliberative cultural change program including staff training activities that are tiered based on the risk profile of the area. High-risk areas have received training designed and delivered in collaboration with the National Counter Foreign Interference Coordination Centre in the Department of Home Affairs, and • Various staff resources including an online information portal supported by multi- channel awareness campaigns. As the Government’s risk appetite for international engagement has evolved, so too has ours and while many of these tools existed for some time they have evolved over the years. There is still more work to do to implement our current suite of responses, particularly around training and a cultural change program to embed our new approaches. We are also conscious that the international context will continue to change so we need to be prepared to adapt our tools into the future. 2. What business processes do they use in the implementation of those tools? A detailed outline of UTS’s business approaches in relation to our foreign interference tools can be found in our opening statement tabled with the Committee on 19 March 2021. In summary for the Committee’s benefit, we have a variety of business processes that are used to review and assess the risks of foreign interference in our operations. For example, we have: • Developed a mature risk management process and culture, including using an external due diligence partner for various international engagements • Updated policies outside of their normal review cycle to incorporate foreign interference considerations and strengthen due diligence requirements • Deployed an online outside work register and information collection process • Established a UTS-wide International Business Assurance function to take carriage of our response to the Foreign Arrangements Scheme, facilitate process improvement to continually strengthen business processes in light of the changing foreign interference landscape, and support a capacity uplift across these domains • Independent delegates reviewing and approving all international engagements • Updated the mandatory Protocol for the Execution of Documents (PED) to include references to foreign interference. The PED is completed by staff for the delegated authority to support their review • Aligned our processes to engage international collaborators to our UTS 2027 strategy through implementing a principles-based international engagement framework • Implemented a best-practice cyber security program, deployed two-factor authentication and jointly appointed a Chief Information Security Officer (CISO) with the University of Newcastle to support information sharing • Dedicated risk resourcing to manage higher-risk areas, including research, and • Utilised the appropriate existing governance functions, including Council, to monitor performance and regularly assess risk appetite. We are constantly evolving our systems, processes and cultural programs to maintain our operational integrity and protect national security in our work. 3. What criteria do they use to assess an engagement with a foreign entity and identify the risks? We use a range of internally and externally informed criteria to assess a potential international engagement based on the nature of the work and the partner entity. For research partnerships for example, we consider the following risk conditions (criteria): • Country: we look at where the partner university/academic/entity is from and consider factors such as the Transparency International’s Corruption Perceptions Index (CPI). • Partner: we examine who the partner is including: o The activities of the proposed partner, including the industries they are engaged in and whether there are any political sensitivities associated with them or key individuals in the entity o The compatibility of the partner and activity with UTS’s values, including our longstanding commitment to social justice • Activity: we consider the area of activity or research and interrogate aspects such as: o Whether the activity is on the Defence Strategic Goods List, is a sanctioned export or there is a potential dual use o Compatibility between any contractual conditions and UTS policies, and o Work, health and safety and reputational risks. • Dissemination: we take into account how research outcomes will be disseminated such as open publication or protection of university IP. These risk conditions inform a risk assessment which in turn informs: • The level of due diligence required, including obtaining external independent due diligence for collaborations assessed as having a medium or higher risk, and • The seniority of delegate required to approve the research project. For our highest risk engagements, the Deputy Vice-Chancellor (Research) in consultation with the Senior Executive, review arrangements. Similar frameworks are used with tailored, activity-specific risk conditions for various key processes. 4. What is their definition of non-mitigatable risk? The Senior Executive define UTS’s risk appetite on an annual basis informed by UTS Council. In accordance with UTS’s Risk Management Policy, the UTS risk appetite is reported to the Audit and Risk Committee of UTS Council each year. 5. How many engagements have they reviewed and when did they start with the review? UTS has an established program of reviewing international engagement activities. Over the last ten years we have reviewed hundreds, if not thousands, of engagements. 6. Were any cases reviewed prior to the tools mentioned above being developed/implemented? If so, how? Yes, various reviews were undertaken before our current suite of tools were implemented. As far back as 2013 and in response to the Defence Trade Controls and Autonomous Sanctions Acts, UTS reviewed our current (at that time) processes, capabilities, capacity and resources to respond; assessed the risks and mitigation options for UTS activities impacted by the Acts; recruited staff to help UTS comply with and respond to the Acts; developed training resources and a screening tool to automatically risk assess proposals against the Defence and Strategic Goods List; established best- practice processes to identify, assess and manage activities impacted by the Acts and provided training to those staff and students most impacted by the Act. 7. How many new engagements have been rejected, when and on what basis? We review hundreds of arrangements each year. A small number of these have been rejected for a range of reasons including non-alignment with UTS strategy, lack of commercial viability and risk profile. A key element of our response when it comes to foreign interference has been a deliberative program of cultural change which has helped reduce the instances of engagements being nominated that would be rejected on the basis that they would not meet our risk appetite for an activity. 8. What risks or irregularities with previous/ongoing engagements have been identified? As part of reviews of previous international engagements, we identified the following considerations which required a higher-level of scrutiny and sophisticated due diligence: • Projects where there are opaque corporate governance arrangements, particularly involving subsidiary entities, and • Projects where concerns exist around the potential application or dual use. 9. How did the institution address the risks? UTS has continued to strengthen our systems and processes to address the evolving threat of foreign interference and address the considerations outlined above. This work has included: • Regularly auditing key processes, practices and documentation to identify opportunities to improve our practices • Undertaking more detailed analysis and documentation of subsidiaries of organisations involved in collaborative arrangements • Moving to more active partnership management by regularly re-evaluating risks associated with agreements and partners in light of changing geopolitical situations, and • Adopting a strategic focus on the responsible use of technology. 10. Have they found any irregularities in previous/ongoing engagements that may create a conflict with federal funding provisions? We are not aware of any instances where a review has identified contractual positions that conflict with federal

Load more