Federal laws and regulations require the university to establish a program supporting foreign travel security, awareness and reporting. The foreign travel security program ensures awareness of personal responsibilities to properly safeguard U.S. government-funded research information for covered individuals who:
- Travel to international locations on official business.
- Embark on personal travel with an electronic device (personal or institutional) that has access to research data.
The program supports these travelers by:
- Ensuring they understand the relevant federal requirements.
- Recognizing travel concerns and potential threats specific to destination areas.
- Providing specific guidance to increase travel safety and information security.
- Providing a reporting mechanism, as required by law, for suspicious activities encountered by the traveler.
Suspicious activity reporting
Covered individuals should notify the Office of Research Security (ORS) as soon as is practical regarding any suspicious activities that occur before, during or after foreign engagements. Suspicious activities may include illicit attempts to recruit or solicit cooperation with a country or entity of concern, or unauthorized attempts to elicit controlled information, etc.
Coming Soon: Official USC research security policy
The university is developing an institutional research security policy that will include foreign travel security policy to provide guidance for covered individuals traveling out of the country. In the meantime, the Office of Research Security (ORS) will reach out directly to covered individuals with approved travel authorizations to provide travel assessment and support. The ORS will work with these covered individuals to ensure there are no export control, research security, U.S. government or sponsoring agency restrictions or requirements related to the planned travel.
Covered individuals planning personal travel to foreign countries should contact the ORS before travel occurs if you intend to take university assets with access to USG-funded or university-owned research data in any other format or medium.
Understanding foreign travel security
The United States Government has identified numerous foreign countries of concern (currently China, Iran, North Korea and Russia) and sanctioned/embargoed countries that pose a heightened risk to the integrity and security of research due to their potential for undue influence, misappropriation of research or other activities that could compromise U.S. national or economic security. This also extends to activities, individuals and entities that are subject to the jurisdiction of these countries, regardless of where they are located.
If you are a covered individual planning travel to one of these countries, the ORS will work closely with you to ensure you are well prepared to protect yourself and the institutional data and resources in your possession.
Research personnel traveling to other higher risk travel areas as defined by the University Travel Warning List should be aware of the unique safety and security challenges presented by these countries, and are encouraged to contact the ORS for support.
Our adversaries have a history of using foreign travel and collaborations to exploit U.S. researchers for access to controlled or classified research information. These adversaries frequently employ approaches that are very subtle and difficult to recognize.
If you are participating in foreign travel, conferences, seminars, speaking engagements, research collaborations or other similar events, we encourage you to review:
- The U.S. Defense Counterintelligence and Security Agency report on Targeting During Conferences, Conventions, and Tradeshows (pdf), which details indicators and best practices to avoid exploitation.
- The FBI’s Game of Pawns case study video, which demonstrates how the grooming process can occur over time.
Understanding these approaches will better prepare you to recognize and defend against these tactics.
The following federal travel resources can help covered individuals gain greater awareness of potential security challenges and threats in specific countries, register for travel alerts and warnings, and prepare for safe and secure travel:
- U.S. Department of State International Travel Resources
- U.S. Department of State Travel Advisories
- Smart Traveler Enrollment Program
- Overseas Security Advisory Council (OSAC) Crime Reports
- Centers for Disease Control Travelers Health
- Listing of U.S. Embassies, Consulates, Diplomatic Missions and Offices Providing Consular Services
Electronic device exploitation is a common tactic our adversaries use to access information on your electronic devices or gain access to other sensitive or controlled data sources you access. To avoid electronic device exploitation, it is very important to employ good cybersecurity practices.
As a first precaution, we strongly encourage you to take only the information you need for the purposes of an international trip and avoid taking electronic devices or other media that have research data on them that are irrelevant to your trip. We also encourage international travelers to reach out to your departmental information technology team, which may be able to offer you a loaner device.
Below are some best practices to follow during international travel to help you ensure your devices are not exploited by a foreign adversary. You can find additional electronic device Travel Tips here.
- Be wary of public wi-fi networks, especially when entering passwords or accessing institutional, personal and financial information online.
- Avoid using public computers.
- Avoid sending sensitive data or information via the internet abroad.
- Always search out a secure, known wi-fi network, such as Eduroam, which is available at partner institutions worldwide.
- If you use a public computer or someone else’s computer abroad, never access or share university intellectual data or export-controlled information.
Always use the university’s VPN while you are online abroad. VPN allows you to connect to the university network while you are off campus. It provides a secure connection that encrypts the information that passes between you and the university while the VPN is connected.
Important Note: Encryption and VPN Prohibition in China
National security laws in the People's Republic of China (State Council Directive No. 273) essentially prohibits the use of cybersecurity tools such as VPN and encryption without providing Chinese authorities with the decryption keys. DUO services are often blocked in China. Remotely accessing USC’s network does require the use of VPNs and encryption as part of normal business operations.
We strongly advise travelers to China NOT to take any sensitive information, encrypted laptops, or other devices with encryption capabilities, under any circumstances. Do NOT use encryption on any of your clean travel devices. This could potentially be grounds for harassment or arrest by Chinese authorities.
Disable wi-fi, GPS and Bluetooth functions, and unused apps on your devices when those functions are not in use. These services can be used to launch attacks against your device or locate and introduce malware.
Small devices such as cell phones, laptops, hard drives or flash drives and tablets are susceptible to theft or loss, especially while traveling. Take the following steps to safeguard your devices:
- When unattended, turn your devices off and keep them locked up.
- Make sure to log out of all programs or accounts.
If your phone or laptop is stolen, report it immediately to the ORS and local U.S. Embassy or Consulate. The Embassy can assist you in reporting the loss to the local police. Also, report the incident to your departmental IT support staff immediately.
Certain information, technology, software, items or services may be subject to U.S. export control regulations such as the Export Administration Regulations (EAR) and the International Traffic in Arms Regulations (ITAR), and Department of Energy 10 CFR Part 810 and NRC 10 CFR Part 110.
Currently the U.S. Department of Treasury’s Office of Foreign Assets Control (OFAC) has comprehensive sanctions for Cuba, Iran, North Korea, Syria, and the Crimea, Donetsk and Luhansk regions of Ukraine. OFAC maintains a real-time list of Sanctions Programs and Country Information on its website. If your official university trip or personal foreign travel involves an export-controlled component, an OFAC-sanctioned country or there is uncertainty, individuals are required to contact the USC Export Control Empowered Official for additional guidance before traveling.