Topline Report

Defense budgets, programs and contracts.

Brief No. 008research security

30 universities, 14 days: Pentagon orders foreign-ties audits with future research funding at stake

The research and engineering office told 30 U.S. schools on Aug. 17 to review their links to Section 1286-listed foreign institutions and rebranded Confucius Institutes and report back by Aug. 31. Six weeks later, the waiver for Confucius Institute hosts expires.

Institutions notified
30
Ordered Aug. 17, 2026 [1]
Report deadline
Aug. 31
Findings and mitigation due to DoD [1]
Section 1286 list
130
Foreign institutions, per DefenseScoop [2]
Confucius waivers issued
0
Authority ends Oct. 1, 2026 [6]

BLUF Bottom line up front

Thirty U.S. universities and technology institutes have two weeks to audit their foreign research partnerships or put future Pentagon research money at risk. The Office of the Under Secretary of War for Research and Engineering notified the schools on Aug. 17 that they must review academic, financial and research ties to foreign entities identified under Section 1286 of the fiscal 2019 NDAA and to groups linked to “rebranded Confucius Institutes,” then report findings and mitigation steps by Aug. 31 [1]. For contractors that team with universities on research or subawards, the notice puts a near-term compliance question over partners that, by DefenseScoop’s list, include MIT, Johns Hopkins and the University of Illinois [2].

The money

The release does not put a dollar figure on what the 30 schools receive, and it does not name the account at risk. What it says is direct: “To maintain eligibility for future federal research funding,” each notified school must audit its identified foreign collaborations, assess the exposure of sensitive or export-controlled research, and carry out mitigation plans that can include ending partnerships [1]. The stated purpose is to protect “American taxpayer-funded research investments” from technology transfer and intellectual property theft [1].

What federal law already says about DoD research funds and foreign ties

The audits sit on top of four layers of statute and regulation that Congress and the department have built since 2018.

Section 1286 (2018). The fiscal 2019 NDAA told the Secretary of Defense to set up an initiative with universities that do defense research to protect intellectual property and controlled information and “to limit undue influence, including through foreign talent programs” [3]. Among its required pieces were policies “to limit or prohibit funding” for institutions or researchers who knowingly violate the initiative’s rules [3].

The fiscal 2024 amendments. Congress widened that in December 2023. One change added a goal of keeping institutions on the Section 1286 list from “benefitting from funding provided by the Department of Defense to United States academic institutions” [4]. Another required DoD policies, due by June 1, 2024, that cut or bar funding for institutions or researchers who knowingly contract or make financial arrangements with listed entities [4]. Those policies had to include a disclosure question for proposers, an annual compliance certification from awardees, notice of suspected noncompliance with at least 30 days to fix it, and an appeals process [4]. The same law ordered the DoD inspector general to report on how the department carried out Section 1286 and National Security Presidential Memorandum-33 [4].

The fiscal 2025 limit. Section 238 of the fiscal 2025 NDAA barred fiscal 2025 DoD funds from paying for a grant or contract to a U.S. institution “for the specific purposes of conducting fundamental research in collaboration with a covered entity,” meaning a school on the latest Section 1286 list or anyone it employs [5]. The definition of collaboration is wide. It covers shared facilities or data, shared technical know-how, sponsored fellowships or visas, joint ventures, and researchers serving as advisers or review-board members [5]. The Assistant Secretary of Defense for Science and Technology can waive the limit case by case, with notice to the Armed Services committees within 30 days of the award [5]. The Aug. 17 release quotes Joseph Jewell as Assistant Secretary of War for Science and Technology [1].

The Confucius Institute ban. Section 1062 of the fiscal 2021 NDAA bars DoD funds from going to a college that hosts a Confucius Institute unless the research and engineering office grants a waiver [6]. The fiscal 2024 NDAA broadened the definition to any program funded by the Chinese International Education Foundation or the Ministry of Education’s Center for Language Exchange Cooperation, or any cultural institute “directly or indirectly funded” by the Chinese government, and ended the waiver authority on Oct. 1, 2026 [6]. DoD wrote the change into the DFARS in a final rule on Aug. 25, 2025. Offerors that are colleges must now represent that they host no such institute or hold a waiver [6]. In that rule, DoD said it had issued no waivers and did not expect to issue any before the authority ends [6].

How much DoD contract money goes to universities?

Not much, by the contract count. In the 2025 rule, DoD reported that the Federal Procurement Data System showed 104 contract awards to nine unique institutions of higher education across fiscal 2021 through 2023, all to entities classed as other than small [6]. That count covers contracts and purchase orders only; grants are outside it [6]. That matters for primes: a university’s eligibility problem can show up in a teaming agreement or a subaward long before it shows up in a DFARS representation.

The programs

The audits are run by the research and engineering office under Under Secretary Emil Michael [1]. “The Department of War has zero tolerance for academic partnerships that compromise our national security,” Michael said [1]. Jewell called universities “critical partners in executing a wide range of Department of War research programs” [1].

Which universities got the Pentagon audit notice?

The department did not publish names. A U.S. official gave DefenseScoop the full list [2]:

  • Georgetown University; Massachusetts Institute of Technology; Harvard University; Johns Hopkins University; Cornell University; Duke University; Emory University; New York University
  • University of California campuses at Berkeley, San Diego and Los Angeles; University of Southern California; Portland State University
  • University of Texas at Austin; Oklahoma State University; Northeastern State University in Tahlequah, Okla.; Drake University
  • Penn State University; University of Cincinnati; University of Minnesota; University of Illinois Urbana-Champaign; Illinois Institute of Technology; Southern Illinois University Carbondale
  • University of North Carolina at Chapel Hill; University of South Carolina; Virginia Polytechnic Institute and State University; University of Delaware; Stony Brook University
  • Worcester Polytechnic Institute; Bryant University

Neither the official nor the release said why these 30 were picked [2]. The list runs from Harvard and MIT to much smaller schools such as Bryant, Drake and Northeastern State [2].

DefenseScoop reports that DoD last year published an updated Section 1286 list of 130 academic and research institutions in China, Russia and Iran that it found were misappropriating U.S.-funded technology work [2]. The release ties the audits to that list and to the rebranded Confucius Institute groups [1]. Confucius Institutes operated on U.S. campuses from 2004 into the early 2020s, before mass closures under government scrutiny, DefenseScoop reports [2].

What the schools must produce is set out in the release: an audit of each identified foreign collaboration, an assessment of how exposed sensitive or export-controlled research is, and a mitigation plan, which may include ending partnerships [1]. It does not say what standard DoD will use to judge the reports.

The politics

The department framed the move as a joint effort with Congress. The release names the House and Senate Armed Services committees, the House and Senate Appropriations committees and the House Select Committee on the Chinese Communist Party as partners [1]. It quotes no member of Congress.

Congress has kept adding to the record. The House-passed fiscal 2027 NDAA, H.R. 8800, which cleared the chamber on July 22, includes two related sections [7]. Section 1089K would require a report to Congress on colleges that have both received DoD funding and hosted a Confucius Institute [7]. Section 579F would bar fiscal 2027 DoD funds from going to elementary or secondary schools that host a “Confucius Institute or Classroom,” other than aid paid directly to students [7]. This site covered the House vote on H.R. 8800 in July (earlier coverage).

The original 2018 statute also carries a counterweight that the new audits do not mention. Section 1286 requires that the initiative’s rules be “consistent with policies that protect open and scientific exchange in fundamental research” [3]. How the department squares a 14-day audit, and the threat to future funding, with that clause is not addressed in the release [1, 3].

Next milestone

Reports from the 30 institutions are due Aug. 31, 2026 [1]. The release does not say when DoD will rule on them or whether it will publish results [1].

The Confucius Institute waiver authority ends Oct. 1, 2026, the first day of fiscal 2027, and any waiver issued before then stops applying on that date [6]. The House report requirement in section 1089K waits on a final fiscal 2027 NDAA [7].

Readout

Questions on this brief, answered from the cited record

Which universities did the Pentagon order to audit their foreign ties?
DefenseScoop, citing a U.S. official, lists 30 schools including MIT, Harvard, Johns Hopkins, Cornell, Duke, Georgetown, four University of California campuses and the University of Texas at Austin [2]. The department's own release gives the number but not the names [1].
When are the university research security audits due?
Each notified institution must report its findings and actions to the department by Aug. 31, 2026 [1].
What happens if a university does not complete the audit?
The release ties completion to keeping eligibility for future federal research funding [1]. Separately, the fiscal 2024 NDAA requires DoD to give a proposer suspected of noncompliance at least 30 days to fix it and a way to appeal a funding decision based on the Section 1286 list [4].
What is the Section 1286 list?
It is a list of foreign academic institutions that DoD maintains under the research-security initiative created by section 1286 of the fiscal 2019 NDAA [3, 4]. DefenseScoop reports the most recent version names 130 institutions in China, Russia and Iran [2].
When does the Confucius Institute waiver expire for DoD funding?
Oct. 1, 2026. After that date, no waiver lets a U.S. college that hosts a Confucius Institute receive DoD funds, and DoD said in August 2025 that it had issued none [6].

Sources

  1. Department of War Orders Research Security Audits at 30 Academic InstitutionsU.S. Department of War, August 17, 2026
  2. Pentagon probes 30 U.S. academic institutions for potential ties to adversariesDefenseScoop, August 17, 2026
  3. Public Law 115-232, John S. McCain National Defense Authorization Act for Fiscal Year 2019, section 1286U.S. Government Publishing Office (govinfo), August 13, 2018
  4. Public Law 118-31, National Defense Authorization Act for Fiscal Year 2024, sections 1223 and 1224U.S. Government Publishing Office (govinfo), December 22, 2023
  5. Public Law 118-159, National Defense Authorization Act for Fiscal Year 2025, section 238U.S. Government Publishing Office (govinfo), December 23, 2024
  6. Defense Federal Acquisition Regulation Supplement: Limitation on Certain Institutes of Higher Education (DFARS Case 2024-D023), final ruleFederal Register, August 25, 2025
  7. H.R. 8800, National Defense Authorization Act for Fiscal Year 2027 (Engrossed in House)U.S. Government Publishing Office (govinfo), July 22, 2026

Note on sourcing

The department's release does not name the 30 institutions. The list in this brief is as reported by DefenseScoop, which said a U.S. official shared it; the department had not published it as of publication. Neither the release nor DefenseScoop says why each school was selected, which foreign entities are involved, or how much Pentagon research money each school receives. The count of 130 institutions on the most recent Section 1286 list is DefenseScoop's figure. The release does not cite the statutory authority for conditioning future funding on the audits; the statutes described here are the ones Congress has written on the subject, and this brief does not draw on the department's internal implementing policies. None of the named universities had commented publicly as of publication.