Duke and UND Got 30 Days: What the New Foreign-Funding Investigations Reveal About Research Security

On September 16, 2026, the U.S. Departments of Education and State announced that they had opened foreign-funding investigations into Duke University and the University of North Dakota. The agencies say their reviews indicated incomplete, inaccurate, and untimely disclosures under Section 117 of the Higher Education Act, the statute that requires colleges receiving federal aid to report foreign gifts and contracts of $250,000 or more. The government specifically alleges that certain governmental partners were identified as non-governmental.

The dollar threshold in Section 117 is not the interesting part of this story. It has been $250,000 for years, and most compliance officers in higher education can recite it. The interesting part is what the government asked the two universities to produce, and how far those records reach across a university that most people would not think of as connected.

To be clear about what has and has not happened: these are investigations, and the allegations described below are the government’s stated findings at this stage, not a court or agency ruling that either university broke the law. Both institutions have 30 calendar days to respond with records. Foreign relationships are not inherently wrongdoing, and a disclosure investigation is not the same thing as a sanctions violation, an export-control violation, or a research-security determination. Those distinctions matter, and we come back to them below.

For Duke, the announcement points to Duke Kunshan University, a joint venture Duke established with Wuhan University, and describes governance ties between Wuhan University and Chinese government officials. The release also notes that the Department of War had already directed Duke and other research universities, in August 2026, to review their collaborations with foreign entities of concern. None of that is a finding that any specific collaboration was improper; it is the backdrop the government cites for why it is looking now.

For UND, the government highlights the university’s School of Aerospace and its federally supported work on uncrewed air systems, and states that Chinese aviation companies with close associations to China’s military have had investment and involvement in that work. Again: this is the government’s characterization of what its review found, offered as the basis for the investigation, not an independent classification we are making of any company or individual.

For both universities, the records demand covers eight overlapping categories. Reading them side by side is more revealing than any single line item:

A Section 117 filing is a single number: the value of a foreign gift or contract, reported twice a year. The records list above is not that. It spans an entity’s identity and its government or non-government status, the individuals connected to that entity, the collaboration the relationship supports, the funding attached to it, and whatever internal review, if any, that relationship received.

At most research universities, those records do not live in one office. Finance departments track payments. Sponsored research offices track grants and contracts. International programs offices track student and partner-institution relationships. Faculty affairs tracks appointments and outside activities. Export-control officers track controlled technology and technical data. Legal and compliance track disclosures and filings. Not every institution uses these exact department names or draws the lines the same way, but the underlying record types are separable regardless of how the org chart is drawn.

A finance system can know that a payment arrived from a foreign source. A research office can know that a faculty member has an affiliation with a foreign university. An export-control office can know that a project involves controlled technical data. Individually, each of those facts might look routine. What is much harder to produce on short notice is the join between them: this payment, from this entity, connected to this researcher, supporting this project, reviewed by this person, on this date.

That is an operational risk, not an accusation against any particular office. Most university systems were not built to answer a cross-departmental question about a single foreign relationship. When a 30-day records demand arrives, the institution discovers whether that join exists or has to be reconstructed by hand, under a deadline, across departments that do not normally talk to each other about the same relationship.

It is worth being precise here, because these terms get collapsed together in a way that does not help anyone building a real program.

Section 117 disclosure is a reporting statute triggered by a dollar threshold. It exists for public transparency and as a condition of federal student aid participation. It does not, by itself, restrict a relationship or designate a party as dangerous.

Sanctions screening (the OFAC SDN and consolidated lists) checks whether a specific named party has been designated, which can carry a legal prohibition on transactions.

Export-control restrictions under ITAR and the EAR govern whether controlled technology or technical data can be released to a foreign person, separate from whether that person or their employer appears on any list.

Government entity and program lists, such as the BIS Entity List, the Section 1260H list of Chinese military companies, or the Department of War’s Section 1286 list of foreign talent programs and entities of concern, identify named organizations or programs assessed as posing risk. A name appearing on one of these lists is a reason to look closer, not an automatic verdict on every relationship connected to it.

Research-security review is the institution’s own risk assessment, weighing all of the above against context: the nature of the research, the funding source, and the personnel involved.

Institutional adjudication is the documented human decision, made by someone with the authority to make it, about whether and how a relationship proceeds, and why.

A Section 117 timeliness or accuracy gap is not the same as a sanctions violation, an export-control violation, an Entity List match, or a research-security determination. The government’s own materials frame this as a disclosure investigation. Treating it as anything more than that, before the government says so, gets the story wrong in both directions: it understates what disclosure accuracy is worth, and it overstates what has actually been found.

None of this is a statutory checklist. It is an operational model for what a university (or any organization managing foreign-party relationships) needs to be able to reconstruct when someone asks, later, why a relationship looked the way it did:

• Source — where the relationship or funding was first captured.
• Entity — the foreign organization, including its government or non-government status and the basis for that classification.
• Relationship — the contract, gift, appointment, or agreement connecting the entity to the institution.
• Person — the researcher, faculty member, or student the relationship runs through.
• Collaboration — the project or work the relationship supports.
• List result — any relevant sanctions, Entity List, or research-security list match, kept separate from the institution’s own decision.
• Review — who looked at the relationship, and when.
• Rationale — why it was approved, escalated, or declined.
• Supporting documents — the agreement, disclosure form, or license itself.
• Date and reviewer — when each of the above happened, and who is accountable for it.
• Monitoring history — whether, and when, the relationship was looked at again.

SecurePoint Education already brings screening, case review, monitoring, and evidence into a structured workflow for the people and organizations schools manage, including researcher, faculty, vendor, and foreign-institution parties. SecurePoint’s existing Education architecture is built around people, organizations, screening evidence, human review, and retained records. As research-security and foreign-funding disclosure expectations expand, those same primitives can support more connected institutional review workflows. That is a foundation, not a finished answer to what the government asked Duke and UND to produce, and we are not claiming otherwise.