UCPH’s new head of security must reconcile intelligence-service logic with open research

In recent years, the threat landscape facing Danish universities has intensified.

Geopolitical conflicts and a fiercer international race for knowledge have increased the risk of both research espionage and cyberattacks.

Because research is by nature about developing and sharing knowledge across national borders, universities and other research institutions are particularly vulnerable.

At the University of Copenhagen, the heightened threat level has received growing attention in recent years. Now, the University is stepping up its security efforts further by appointing its first university-wide head of security.

From 1 September, Esbern Stig Møller will coordinate the University’s work on physical security, IT and information security, emergency preparedness and crisis management.

He has 23 years of experience with the police, including 13 years with the Danish Security and Intelligence Service. But the approach he knows from there cannot simply be transferred to a university with almost 40,000 students and more than 10,000 employees.

»At an intelligence service, I can be given the authority to decide a great deal about what people are and are not allowed to do. But I cannot take the same approach here,« he tells the University Post.

In his own words, the job will be both »incredibly exciting and daunting«:

»It is an enormous organisation, and it is an enormous responsibility. We need to help take UCPH to a better and, of course, safer place.«

Countries of concern want the University’s knowledge

When Esbern Stig Møller explains what UCPH needs protection from, he points in particular to nation states that may have an interest in the University’s research.

Russia, Iran and China, in particular, have been designated by the Danish Security and Intelligence Service as countries of concern. Researchers and universities are advised to exercise particular caution when entering into collaborations involving these countries.

According to Esbern Stig Møller, states may try to obtain knowledge that would otherwise take them many years and large sums of money to develop themselves. They may also attempt to disrupt research or use Danish findings to gain a technological advantage, he says.

»We are a knowledge-based society, and we need to protect that. But we risk losing it if we are a little too laissez-faire about safeguarding it,« Esbern Stig Møller says.

According to the new head of security, recent years have also shown that threats can come from more unexpected quarters. It is therefore important not to focus solely on the three countries currently considered countries of concern.

»‘Friends’ has become a strange concept, because until quite recently we also thought the US was our friend,« he says, referring to the current Trump administration.

Research and security as opposing forces

The University’s fundamental openness is one of the things that makes Esbern Stig Møller’s new position difficult.

His experience from the intelligence service and as a security consultant tells him that sensitive knowledge should be closely guarded and shared with as few people as possible. Research, by contrast, advances when knowledge is shared and tested across national borders.

»The two positions are complete opposites,« he acknowledges.

Esbern Stig Møller’s task will therefore be to work with researchers and UCPH’s security staff to find common ground, allowing the University to protect its research without bringing the exchange of knowledge on which it depends to a halt.

In that sense, I understand researchers who think that people like me see ghosts everywhere and impose restrictions on them

Esbern Stig Møller, the University of Copenhagen’s new head of security

He does not yet have a ready-made solution.

»Finding a way through that tension will be incredibly difficult, so no, I do not simply have a recipe for it. I will have to develop one together with all the capable people who are already here,« Esbern Stig Møller says.

The current threat landscape also means that research collaborations which are otherwise sound from an academic perspective sometimes have to be abandoned because of security risks. And several observers expect this to happen more frequently in the future.

»In that sense, I understand researchers who think that people like me see ghosts everywhere and impose restrictions on them. That is why my aim is to proceed carefully and build trust, so that we can develop something together instead of confronting them with a set of finished requirements.«

READ ALSO: Deputy Director: International spying a future threat to research

More clicks, passcodes and locked doors

This does not mean, however, that employees and students will necessarily be unaffected by the new security agenda.

»Accessing IT systems may require more clicks and passcodes. And there may be more things that people need to apply for and have approved at a higher level,« Esbern Stig Møller says.

He envisages, among other things, that sensitive research projects may lead to stricter requirements for card readers on doors or special rules governing data storage.

He stresses that he has not yet taken up the position and is therefore only offering possible examples.

»Not every project needs to be kept inside the ‘steel box’. Some can remain completely open – including collaborations with countries that, in other areas of research, we might regard as hostile to Danish research,« Esbern Stig Møller says.

Other projects may be so strategically important that UCPH needs to consider who the findings are shared with.

This applies particularly to dual-use research, a term covering technologies that can be used for both civilian and military purposes.

Shortly before the summer break, UCPH’s Board approved a new framework for defence research, an area expected to expand considerably in the coming years. The new head of security will also be involved in this work.

Researchers may, for example, need advice on hacking, coercion and espionage, he says.

»We need to provide an awareness and protection package. Not necessarily a package of restrictions, but one of protection. And we need to help people understand that they are researching something unique which could make them a target for espionage,« Esbern Stig Møller says.

»Security can sometimes be inconvenient«

For the new head of security, it is important that UCPH does not introduce security measures »merely for the sake of security«.

New initiatives should reflect the specific risk, and the people required to adopt new procedures need to understand why they are necessary.

He nevertheless expects that the University will inevitably set the bar both too high and too low at times and will subsequently have to adjust its approach. Complaints and criticism from employees and students should therefore be used to determine whether a measure goes too far or has simply been poorly explained.

»Security can sometimes be inconvenient, and of course we should try to avoid that. At other times, we have to stand firm and say that this is how it is going to be,« he says.

For Esbern Stig Møller, the first sign of success will be when people across the University of Copenhagen begin raising questions about security and emergency preparedness themselves. And do so at an early stage of a project.

»That will be my goal: for researchers, students and employees to want to have that conversation, and perhaps even contact us themselves to ask for guidance.«

REAL ALSO: University of Copenhagen steps up defences against espionage