Helmholtz-Zentrum: „Tür und Tor standen sperrangelweit offen“ – Sonderprüfer findet gravierende Sicherheitsmängel bei Cispa

An external special review has identified serious shortcomings in research security and export control at the Helmholtz-Zentrum für Informationssicherheit Cispa in Saarbrücken. Federal Research Minister Dorothee Bär (CSU) told the Bundestag research committee about the early findings of the nearly 400-page report. She stated that "the door and gate were wide open" at the security-relevant research center.

Bär explained that due to the data set available at Cispa, no confirmed or denied statements could be made about the leakage of security-relevant information. However, technical access possibilities showed that a leakage of security-relevant information was possible due to the regulations and systems not being adequate to prevent it.

The Helmholtz-Gemeinschaft institution in Saarbrücken has faced pressure for weeks due to research collaborations with Chinese institutions. This followed a June Business Daily report on Cispa's proximity to Chinese researchers, including those affiliated with military institutions on U.S. sanction lists. The review was conducted to determine if security-relevant research findings had reached foreign entities.

The report highlights the lack of protection of business secrets, as the organization and technical/organizational measures of Cispa were "in no way" sufficient to account for the protection from unauthorized transfer abroad, according to Bär. The review also found that Cispa had cooperated with risky individuals and institutions from the People's Republic of China, both in publication and research.

The center did not have a resilient and risk-appropriate system of research security, which had implications for the selection of scientific personnel and cooperative partners, many of whom were from China. Bär emphasized that the risks of international research collaborations and China-related issues in research security had been repeatedly raised in the oversight bodies, yet the management had not adequately addressed them.

She takes organizational responsibility for the identified risks. The foundation research at Cispa is also not exempt from adequate security measures, Bär stressed. Risks of unwanted knowledge and technology leakage, dual-use potentials, security-relevant international collaborations, and unauthorized influence must have been adequately considered.

Bär also criticized the scientific business leader Michael Backes, who refused unlimited cooperation with the special reviewer at the start, unlike the shareholder assembly demanded. He was released from his duties during the investigation. The consequences for the Bund and Saarland remain open, but the report will be carefully evaluated, leading to further necessary consequences.

The Federal Research Ministry plans to take back its representation on the Cispa supervisory board in the future. Bär defended the scientific work of the center, stating it is "scientifically excellent" and of essential importance given the geopolitical developments. However, the Cispa case demonstrates that professionalization of research security in Germany's scientific system, particularly for dual-use technologies, is "urgently necessary."

The full special report is not publicly accessible, but a legal review confirms that the entire report, all 400 pages of the special reviewer, must be classified as VS-confidential.