Research Security Begins Upstream: Capability retention, research policy and national security

UK research security is built around a downstream problem: valuable research capability exists, and hostile or strategically adverse actors seek access to it. MI5’s Espionage Alert of 30 September 2026 on the China General Technology Research Institute is a clear example. This paper argues that research security also has an upstream problem. A research system can lose strategically consequential capability not because another state acquires it, but because the domestic conditions that reproduce it disappear. The idea that capability is slow to rebuild once continuity is broken is familiar from defence-industrial planning; what is missing is its application to the research system. The paper distinguishes the stock of capability a system holds from its ability to reproduce that capability and to regenerate it after loss, and proposes that endogenous capability loss becomes a research-security matter only where three conditions coincide: the capability supports a strategically consequential function; its reproduction or regeneration is materially impaired; and regeneration would plausibly take longer than the warning time within which the capability may be needed. It shows that the UK’s legal framework for research security is triggered almost entirely by external acts, such as acquisition, export, transfer and assistance to a foreign intelligence service, and that the framework for university market exit is directed at students and taxpayers rather than research capability. Following the abolition of the Department for Science, Innovation and Technology in July 2026, the paper identifies the Department for Business, Innovation, Science and Trade as the natural home for a limited, diagnostic regeneration assessment, notes the tension between that department’s growth mission and the problem it would be asked to see, and proposes an independently evaluated three-case pilot. Security diagnosis, it argues, does not imply security control over research. Remedies should remain with the ordinary policy institutions responsible for the underlying cause, and no new statutory powers are required.