Access by staff and students to restricted material

1. Background and purpose

This document provides guidance on the safe access and management of security-sensitive or extremism-related material used for either research or teaching. It does not seek to restrict students or staff from carrying out research into any area, rather it is in place to safeguard academic freedom and freedom of speech in line with the University’s Code of Practice on Academic Freedom and Freedom of Speech), and protect staff and students who engage in or supervise sensitive or extremism-related teaching and/or research from the risk of investigation under counter-terrorism legislation. The term ‘material’ is taken to include material used for teaching related to security or extremism or accessed in relation to taught provision, as well as material used directly for research.

The University must comply with the Prevent duty, guidance for which states that “For further and higher education providers, there should be clear policies in place for students and staff using IT equipment and networks to research terrorism and counter-terrorism in the course of their learning.”

(Prevent Duty, 188, IT Policies)

The process outlined below ensures:

Activity can be traced back to the authorised user should the University get any enquiries from authorities,
Security-sensitive or restricted content does not cross-over with or end up on other systems,
Should equipment be seized, the temporary loss would not hinder the operation of the University,
Risky activity, for example accessing the dark web, is kept away from corporate systems and data.

The Code of Practice and Principles for Good Ethical Governance (paragraph 2.15) states that: Particular care needs to be taken with regard to research and other academic activities related to political extremism and terrorism. Any such activities must be reviewed by the local research ethics committee; in addition, the chair of the local research ethics committee should inform the Secretary of the Academic Ethics and Compliance Committee that a proposed activity of this nature has been submitted. Where necessary, advice should be sought from the University's Prevent Lead.

Those who access potentially security-sensitive material must not share or disseminate such material, even if it is already publicly accessible elsewhere, and must ensure that appropriate systems are in place for the storage and handling of such material. Universities UK Guidance (see Further resources) must be followed: material should be stored on specially designated university servers, and personal computers or the VLE should not be used.

2. What is ‘security-sensitive or extremism-related’ material?

Material which could be classified as "security-sensitive or extremism-related" may include anything which could be interpreted as promoting, endorsing or planning terrorism, radicalisation, or extremism.

Terrorism e.g. material relating to actual or potential terrorist methods
Radicalisation e.g. material obtained by liaising with groups which seek to persuade people to adopt extreme political, religious, or social views
Extremism e.g. material that results from collecting information from websites of extremist organisations
Government security measures in respect of extremism, terrorism or radicalisation (other than government sponsored research) e.g. an analysis of government techniques to combat terrorism, where such information would be of use to terrorists
Materials that are covered by the Official Secrets Act (1989) and the Terrorism Act 2006

3. Arrangements for access to restricted material

The requirement to access restricted material must be included in an application to your local research ethics committee, and if required, the process regarding Research Ethics and Prevent should be followed in addition. This requirement applies whether the material is being used for research or teaching purposes.

You must also contact the cyber security team via itsupport@york.ac.uk. They can offer guidance about suitable controls, the aim will be to ensure the objectives in "background and purpose" are met.

4. Monitoring

As per Regulation 11: Using University information, the University monitors and records the use of its IT services and may access data during investigations as described in the IT Investigations and Data Access Policy.

Breaches of this procedure may warrant disciplinary action under the disciplinary procedure.