PENTESTY · EDITORIAL ANALYSIS · · 4 min read
Research partnerships: connect funding decisions with access
A contract may identify who funds a project without showing who can access its results. Follow funding, deliverables and permissions throughout the partnership.
By Pentesty
The alert and the response
On September 30, 2026, MI5 said more than 100 UK-linked academics had contributed to projects funded through CGTRI, which the agency links to Chinese intelligence. The alert acknowledges that some may not know that funding source. The Chinese Embassy rejected the allegations. These are attributed positions, not proof of misconduct by every participant.
Translate the partnership into verifiable decisions
Select one project and connect the contracting institution, funding intermediaries, participating teams and intended recipients of deliverables. Record where the information came from and who confirmed each relationship. A documentary gap calls for clarification; it does not by itself establish a covert operation.
Compare that map with access actually approved. An organization can finance one stage without needing every dataset used in the project. The supplier-chain review raises a similar question: which important dependencies remain invisible when a register identifies only the direct contractor?
Define deliverables and data before granting access
Distinguish results intended for publication, material shareable with partners and information restricted to the project. The classification should make sense to the people working with those files. Researchers should not need an improvised interpretation of the contract to determine whether they may send a dataset to a collaborator.
Connect each access profile to a work requirement, an owner and a deadline. Include repositories, computing environments, collaboration tools and integrations. The review should support legitimate work while identifying who decides when a resource, participant or recipient falls outside the initial approval.
- Funding: declared origin, known intermediaries and the source of confirmation.
- Deliverables: recipients and agreed sharing conditions.
- Access: necessary resources, purpose and duration of permission.
- Change: the person responsible for reviewing a material partnership change.
Test a project change with synthetic data
In an authorized exercise, simulate a new team joining or a change to the recipient of a deliverable. Use a test project and synthetic files. Ask participants to follow the normal sharing approval process rather than creating an exception because they are being assessed.
Observe who receives the request, which information is missing and where the decision is recorded. Then check that permissions match approval, including an attempt that should be denied. Avoid using real research documents or sending data to external organizations merely to demonstrate that an access path exists.
Review the relationship throughout the work
An initial approval can become outdated when funding, participants or purpose change. Define which changes require reassessment and which team oversees closure. The review of identity and access throughout employment helps connect authorization, operation and the end of a relationship.
At project completion, check which permissions should end and which deliverables remain available for a documented reason. Where another organization administers the platform, identify who requests a change and who confirms its effect. The conclusion should describe an observed state rather than merely a request sent to the partner.
Use consistent criteria and preserve collaboration
Apply the same documentary and technical criteria to relationships with comparable needs. Assess purpose, resources and evidence rather than treating national origin or academic affiliation as an automatic threat indicator. Project owners should be able to understand, challenge and correct information used in the decision.
Deliver a list of gaps with owners and next actions. Distinguish what was confirmed, what was declared and what remains unverified. Security contributes by making sharing and changes demonstrable, with clear limits on testing and conclusions, while preserving the work that has been authorized.
Frequently asked questions
Does the alert establish researcher guilt?
MI5 acknowledges that some participants may not know the funding source. Read it as the agency’s alert, with the Chinese response recorded, without assigning individual guilt.
Should a foreign partnership automatically be blocked?
The proposal assesses purpose, resources, declared funding and evidence consistently. Nationality alone does not demonstrate misconduct or establish which permissions the project requires.
Does a research contract replace permission review?
It informs obligations and deliverables, but those terms still need comparison with actual resources and approved access. Material changes must also reach the accountable decision maker.
How can a review’s effectiveness be demonstrated?
Record the authorized scenario, decision, resulting permission and expected denial. Preserve the sample’s limitations and confirm that legitimate work remains possible under the accepted controls.
Sources and references
- MI5: CGTRI alert, September 30, 2026
- Chinese Embassy in the UK: September 30, 2026 response
- Cyber Security Brazil: editorial news reference
Original Pentesty analysis, published October 16, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.