TL;DR: Innovation ecosystems thrive on open exchange, but openness still requires boundaries. Event organizers, research institutions, evaluators, and participants should define what information can be shared, who needs access, and what safeguards apply. Those decisions should follow the information and each participant’s role, not assumptions based on nationality, accent, or international background.
Industrial espionage sounds like a story about spies. Research security failures often begin with something far more ordinary: a meeting invitation, a shared slide deck, an informal conversation, or a guest who receives access without anyone pausing to define what that access includes.
We recently attended an innovation-focused event where another independent external evaluator was present. The person had been invited and appeared to have a legitimate connection to another federally funded project. Nothing I observed established misconduct. The experience still left me with a process question: How had the organizers decided who could hear, see, retain, or later use the information shared during the event?
Completing the U.S. National Science Foundation’s (NSF) Research Security Training changed the way I think about that question. Research security includes protecting data and intellectual property, managing collaborations, fulfilling disclosure obligations, and recognizing circumstances that can expose federally supported research to misuse. NSF also emphasizes the value of principled international collaboration and the need to guard against bias and discrimination.
Innovation leaders may want to use the same lens to pressure-test their next event before registration opens or presentation files begin circulating.
The Overlooked Research Security Gap Is Undefined Access
Innovation events bring together researchers, entrepreneurs, universities, funders, consultants, evaluators, economic-development organizations, and community partners. That mixture creates value because participants encounter ideas and expertise outside their usual networks.
It also creates ambiguity.
Organizers may screen speakers carefully while giving less attention to observers, guests, vendors, consultants, or members of another project’s evaluation team. Participants may assume that everyone in the room has received the same instructions, signed comparable agreements, and been authorized to access the same information. Those assumptions can be wrong even when every attendee has legitimate reasons to participate.
NSF describes research security as a shared responsibility that includes managing risks associated with collaborations and data. That responsibility extends beyond identifying prohibited relationships. It requires organizations to understand what they are sharing, why they are sharing it, and whether the recipient’s access matches an established purpose.
A recognizable name, respected employer, university affiliation, or federal-project connection does not answer those questions. Neither does a person’s citizenship or national origin.
Independent Evaluators May Need Access, but Their Role Should Be Defined
Independent external evaluators often attend meetings, observe project activities, interview participants, and examine information that other guests never see. That access can be essential. Evaluators cannot assess implementation, collaboration, outcomes, or ecosystem development from a distance.
Independence does not automatically establish an evaluator’s information-security responsibilities. The project still needs to define:
- Which meetings the evaluator may attend.
- Which documents the evaluator may receive.
- Whether the evaluator may record or photograph presentations.
- Which participant or organizational data the evaluator may collect.
- Where the information will be stored.
- Who else within the evaluation firm may access it.
- How long the information will be retained.
- How suspected loss, misuse, or unauthorized disclosure will be reported.
These are ordinary governance questions, not accusations. EBHC applies the same principle to any consultant, contractor, evaluator, vendor, or institutional partner whose work requires access to project information.
The GAP appears when a project treats an invitation as proof that every resulting form of access is appropriate. An invitation establishes permission to participate. It does not define permission to receive, retain, reproduce, or reuse every piece of information encountered.
Classify the Information Before Deciding Who Can Access It
An event’s safeguards should reflect the information being shared. Organizers cannot make sound access decisions when every presentation, conversation, and document is treated as equally public.
Public Information
Public information includes published research, approved marketing materials, public award announcements, and presentations specifically prepared for broad distribution. Sharing this material with diverse audiences generally supports the open exchange that innovation ecosystems need.
Limited-Access Information
Limited-access information may include pre-publication findings, internal project discussions, participant-level data, draft commercialization strategies, partnership negotiations, preliminary evaluation results, or technical information that provides a competitive advantage.
This material may be appropriate for selected collaborators or evaluators, but access should have a defined purpose and boundary.
Controlled or Legally Restricted Information
Some projects involve controlled technology, source code, proprietary technical data, protected personal information, or other material subject to contractual or legal restrictions. Organizations should involve their research-security, export-control, privacy, information-technology, or legal personnel before sharing such information.
The Bureau of Industry and Security explains that releasing certain controlled technology to a foreign person in the United States can constitute a deemed export. The same guidance also recognizes that fundamental research intended for broad publication is generally treated differently. The correct determination depends on the information, applicable controls, recipient, and context, not a casual judgment based on someone’s accent or birthplace.
Due Diligence Should Follow the Data
Useful due diligence asks what a participant will access and what obligations accompany that access. Weak due diligence begins and ends with a person’s biography.
Event organizers and project leaders should consider several practical questions:
- What information will participants encounter?
- Which sessions are public, limited, or restricted?
- Does each participant need access to accomplish a defined role?
- Have evaluators, consultants, and vendors agreed to appropriate confidentiality and data-use terms?
- May participants photograph, record, download, or redistribute materials?
- Will documents remain available after the event?
- Do third-party organizations use subcontractors, temporary personnel, or external platforms?
- Who receives a report when someone observes a potential security concern?
- Who has the authority and expertise to verify that concern?
These questions create a consistent process that applies to domestic and international participants alike. They also generate records showing why access was granted, what safeguards applied, and how the organization responded when circumstances changed.
Security Concerns Require Verification, Not Profiling
A person’s nationality, accent, political background, or imperfect pronunciation of an institution’s name does not demonstrate espionage. Those details can attract attention, especially after intensive security training, but they do not establish intent, conduct, or risk.
NSF’s research-security guidance specifically emphasizes objectivity, equity, human oversight, and verification. It prohibits research-security analytics that select people based on national origin or racial identity. NSF also describes international collaboration as essential to scientific progress.
That standard points toward a more credible approach. Organizations should evaluate observable conduct, documented affiliations, access needs, disclosure consistency, contractual obligations, and applicable legal restrictions. A concern based solely on identity should not become an allegation. A concrete inconsistency or unauthorized action should move through an established reporting and verification process.
This distinction protects both the research enterprise and the people participating in it. Profiling can damage legitimate collaborations while diverting attention from ordinary access failures that involve trusted insiders, domestic personnel, poorly configured systems, or unclear vendor relationships.
Secure Collaboration Requires Better Boundaries, Not Closed Doors
Innovation ecosystems cannot function when every unfamiliar participant is treated as a threat. They also cannot protect valuable work when openness becomes an excuse for undefined access.
Good research security creates deliberate boundaries. Organizers identify what can be public, what requires limited access, and what needs specialized review. Project leaders document why third parties need information. Evaluators understand their responsibilities before they enter the room or open a shared folder. Participants receive clear instructions about recording, retention, attribution, and redistribution.
Teams preparing an innovation convening may want to examine whether their current controls follow the information throughout the event, including what happens after the final session ends.
Industrial espionage is a real concern, particularly around emerging technologies and strategically important research. The most constructive response is a repeatable governance process that examines access, behavior, obligations, and verified relationships. That process protects innovation while preserving the international collaboration and open inquiry that make meaningful research possible.