Research and Knowledge Security

Preamble

Open, inter­nationally connected research is a source of strength for ATHENE and for Germany, and the same openness carries risks: espionage, the leakage of dual-use knowledge, cyberattacks, undue influence, and damage to reputation. The ATHENE Research and Knowledge Security best practice meets these risks not with blanket restriction but by weighing risk against scientific opportunity, case by case, and it makes the ethics of security-relevant and dual-use research a standing concern rather than an occasional one.

The Research Review Board is the body ATHENE gives this concern to. It follows the DFG/Leopoldina framework for the ethics of security-relevant research as its model of good practice, without itself being a statutory Committee for the Ethics of Security-Relevant Research (KEF): ATHENE has no senate or the institutional organs a statutory KEF presupposes. The board advises; it does not decide, and it does not relieve a participating organization of its own responsibility for the work it carries out. It exists so that no researcher and no project is left to weigh a security-relevant or dual-use question alone, and so that participating organizations without an ethics organ of their own have one to turn to.

This charter sets out the board’s remit, its composition and appointment, how it convenes and decides, and how it keeps a record of its work.

§ 1Standing and legal nature

This clause establishes the RRB as a standing advisory body and fixes the limits of its authority.

1. The RRB is a standing, ATHENE-wide advisory body.
2. The RRB issues non-binding recommendations only. The decision always remains with the participating organization that carries out the work concerned.
3. The RRB is not a formal Committee for the Ethics of Security-Relevant Research (KEF) in the statutory sense.

§ 2Purpose and remit

The remit of the RRB covers the research-security aspects of ATHENE research, with the ethics of security-relevant and dual-use research at its core. On request it advises on:

• the dual-use and misuse potential of a project;
• research ethics and the handling of sensitive or personal data;
• security-sensitive research results and the coordinated (“responsible”) disclosure of vulnerabilities;
• restriction of publication as a last resort, under the openness principle of the Best Practice (Section 1.2).

§ 3Advisory role and delineation

This clause fixes how the RRB’s advice relates to a participating organization’s own ethics body.

1. The RRB advises; it does not decide. It does not replace the participating organizations’ own organs but complements them.
2. Where a participating organization has its own KEF, that KEF governs. For organizations without an organ of their own, the RRB is the shared body; for the others it is open as a voluntary second opinion.

§ 4Composition

This clause sets the size and expertise of the board and the standing of its members.

1. The RRB has five to seven members.
2. The membership combines expertise in research ethics, law and export control, data protection, and security.
3. Members serve in a personal capacity and not as delegates of their institution.

§ 5Confidentiality

Members treat the Board’s deliberations and non-public documents as confidential, during and after their term of office.

§ 6Appointment, term of office, and replacement

This clause governs how members are nominated and appointed, how long they serve, and how a vacancy is filled.

1. Members are nominated by the ATHENE CEO and appointed by the ATHENE Board.
2. The term of office is three years; reappointment is permissible.
3. A member may resign at any time by written declaration. Where a member leaves before the end of the term, a replacement is appointed for the remainder of the term.
4. The ATHENE Board may remove a member for good cause; the nomination and appointment procedure applies accordingly.

§ 7Chair

This clause establishes the chair and deputy chair and states their duties.

1. The RRB elects a chair from among its members; the chair appoints a deputy chair from among the members.
2. The chair leads the meetings, is responsible for the quorum and for the record-keeping under § 11, and represents the RRB externally. The deputy chair acts when the chair is unable to do so.

§ 8Meetings and convening

This clause sets how often the RRB meets and who may call a meeting.

1. The RRB meets as required, but at least twice a year. Meetings may be held in person or virtually.
2. The Chief Research Security Officer (CRSO) convenes the RRB and supports its work organizationally. The chair or two members may request a meeting.
3. In urgent matters the chair may bring about a decision by written procedure or by circulation.
4. The chair may invite a member of the ATHENE office as a guest to support the record-keeping.

§ 9Quorum and decision-making

This clause sets when the RRB may act and how it reaches a recommendation.

1. The RRB has a quorum when a majority of its members, including the chair or the deputy chair, take part.
2. Recommendations are adopted by a simple majority of the votes cast. In the event of a tie, the chair’s vote is decisive.
3. A member excluded from the deliberation under § 12 does not count toward the quorum for that matter and has no vote on it.
4. A dissenting view of a member is recorded in the opinion at that member’s request.

§ 10Referral, formal review, and early consultation

This clause sets who may bring a matter to the RRB and the two modes in which the board responds.

1. Any principal investigator and any ATHENE project may call on the RRB. Referral is made through the CRSO, who forwards the request to the chair. Where a matter concerns the CRSO, it may be referred directly to the chair.
2. Formal review. On request the RRB issues a reasoned, written, non-binding opinion on whether a project should proceed, proceed with conditions, or be reconsidered — normally within four weeks, sooner in urgent cases.
3. Early consultation. The RRB offers a low-threshold channel in which researchers can talk a case through before they are committed. Early consultation is informal and does not lead to a formal opinion.

§ 11Record-keeping and documentation

This clause sets what is recorded of a formal review, how the record is protected, and how it feeds the Best Practice’s effectiveness measurement.

1. A short record is kept of every formal review: the request, the members involved, the material considerations, and the recommendation with its reasons.
2. The records are held in confidence. Personal data are processed only to the extent necessary; the legal basis and the retention period follow the data-protection provisions of the Best Practice (Annex 6.5).
3. In anonymized form, case numbers and processing times feed into the effectiveness measurement under Section 5 of the Best Practice.

§ 12Conflicts of interest and other provisions

This clause sets the members’ duty of disclosure and the board’s standing commitments.

1. Members disclose conflicts of interest on their own initiative.
2. A member who has an interest of their own in a matter, or who is connected with the project, the person, or the partner concerned, does not take part in its deliberation or decision.
3. The Board carries out its work in line with the DFG/Leopoldina framework for the ethics of security-relevant research.
4. The Board curates a short code of conduct for security-relevant research and guidance on coordinated (“responsible”) disclosure, and keeps both current.
5. This charter is amended by resolution of the ATHENE Board.

§ 13Entry into force

This charter enters into force upon the resolution of the ATHENE Board.