The Pentagon Gave 30 Universities Two Weeks to Audit Their Foreign Partnerships. The Deadline Is August 31 — and Eligibility for Federal Research Funding Is the Stake.

Two weeks is not enough time to audit a research university's foreign partnerships. Everyone involved knows this.

On August 17, 2026, the Department of War announced that it had ordered 30 U.S. academic institutions to conduct comprehensive research security audits of their foreign academic, financial, and research relationships, evaluate whether sensitive or export-controlled information may have been exposed, implement mitigation measures including termination of problematic arrangements, and report the results to the Department by August 31, 2026.

The Department did not publicly name the institutions. Officials speaking anonymously indicated the list includes Harvard University, the Massachusetts Institute of Technology, Johns Hopkins University, and New York University. The consequence for failing to complete the audit and act on it was stated plainly: institutions risk their eligibility for future federal research funding.

Emil Michael, Under Secretary of War for Research and Engineering, framed it in one sentence: "The Department of War has zero tolerance for academic partnerships that compromise our national security."

The Department coordinated the action with the House and Senate Armed Services Committees, the House and Senate Appropriations Committees, and the House Select Committee on the Chinese Communist Party — a combination that signals this is not a one-cycle enforcement action but the front edge of a durable policy.

What the Section 1286 list actually is

The order's operative reference is Section 1286 of the FY2019 National Defense Authorization Act, which directed the Secretary of Defense to work with the academic community to limit undue foreign influence on DoD-funded research while preserving open fundamental research.

Under that authority, DoD maintains a list of foreign entities determined to be engaged in problematic activity — misappropriation of U.S.-funded technology, military-civil fusion, or affiliation with foreign defense establishments. The FY2025 list identifies roughly 130 organizations across China, Russia, and Iran. The entries are not limited to obvious defense contractors. They range from electronic measurement laboratories to general scientific research academies and university systems whose Western-facing profile is entirely civilian.

That breadth is what makes the two-week deadline hard. A large research university's relationship inventory is not a single database. It is distributed across:

• Sponsored research agreements and subawards
• Master research collaboration agreements at the school or center level
• Visiting scholar and postdoctoral appointments
• Memoranda of understanding signed by deans, institutes, or individual departments
• Gift and endowment records under Section 117 of the Higher Education Act
• Materials transfer agreements and data use agreements
• Joint degree programs, exchange programs, and satellite campuses
• Individual faculty consulting and foreign talent program participation

Most institutions can query the first two categories in an afternoon. The remaining six are exactly where an unreviewed relationship with a listed entity is most likely to be sitting, and they are the categories least likely to live in the sponsored programs office's system of record.

The Confucius Institute clause is the sharper edge

The order also requires review of relationships with organizations associated with rebranded or successor Confucius Institutes.

The history matters. China established Confucius Institutes in 2004 as nonprofit language and cultural centers hosted on foreign campuses. After Congress conditioned certain federal funding on their closure, nearly all U.S. institutes shut down — formally. What happened next at a meaningful number of institutions was that the underlying relationship with the Chinese partner university or with Hanban's successor organization (the Chinese International Education Foundation, or CIEF) continued under a new name, a new structure, or a direct partner-to-partner agreement without the Confucius Institute branding.

The Department is explicitly asking about that continuation. An institution that closed its Confucius Institute in 2021 and reports "no Confucius Institute" has not answered the question asked. The question is whether funding, personnel, programming, or agreements associated with that institute persist in another form.

This is a documentation problem as much as a substance problem. The predecessor relationship may be entirely benign. If the institution cannot produce a clear trace of what was terminated, what was transferred, and what continues, it will not be able to demonstrate that.

What a compliant response actually contains

Read the order's three required elements literally, because they are three distinct deliverables:

1. The audit. A documented review of flagged partnerships, not an attestation that a review occurred. The distinguishing feature of a defensible audit is that it names the scope searched, the systems queried, the date range covered, and the relationships found — including relationships found and cleared.

2. The exposure assessment. A determination of whether sensitive or export-controlled information may have been disclosed. This is where institutions most often produce a weak answer, because it requires mapping relationships against actual technical content: ITAR-controlled articles and technical data, EAR-controlled technology above EAR99, and any DoD-funded work with a Distribution Statement other than A. The fundamental research exclusion at 15 CFR 734.8 protects a great deal of university work — but it does not protect work performed under publication or access restrictions, and it does not protect the export of controlled equipment or software regardless of the research classification.

3. The mitigation plan, including termination. The order does not ask whether the institution intends to mitigate. It requires that mitigation be implemented, up to and including severing the relationship. A response that describes a future governance process is not responsive to what was asked.

What institutions that did not get a letter should do

Thirty institutions received this order. There are far more than thirty U.S. institutions with meaningful DoD research funding and meaningful foreign partnerships. The coordination with four congressional committees plus the Select Committee on the CCP is the strongest available signal that the sample expands.

Three actions are worth taking now, at a pace that is actually achievable:

Build the relationship inventory before you are asked for it. The single greatest determinant of how a research security inquiry goes is whether the institution can produce a complete, current, queryable inventory of foreign relationships across all eight categories listed above. Institutions that have this can respond in days. Institutions that do not will spend the entire response window building it, and will produce something incomplete under deadline pressure.

Run the Section 1286 list, the Entity List, the 1260H list, and the Unverified List against that inventory on a schedule. These lists change. A relationship cleared in 2024 may involve an entity added in 2026. Quarterly re-screening is the defensible cadence; annual is the minimum.

Reconcile your research security program against the requirements you already have. NSPM-33 implementation guidance, the CHIPS and Science Act Section 10634 research security program requirement, NIH's Foreign Component and Other Support disclosure rules, the malign foreign talent recruitment program certification, and Section 117 gift reporting all address overlapping ground with different definitions and different reporting triggers. We covered the disclosure stack in the Section 117 certification analysis, and NIH's own tightening in the MFTRP certification piece. An institution that treats these as separate compliance silos will produce inconsistent answers across them, and inconsistency across federal disclosures is its own exposure.

The strategic read for principal investigators

If you are a PI at one of the thirty, the practical effect over the next several weeks is that your institution's research office will be consumed by this, and any request you have that is not on the critical path will queue behind it. Plan submission support accordingly.

If you hold or are seeking DoD funding anywhere, understand that the eligibility framing in this order is institution-level, not award-level. The Department did not threaten specific contracts. It referenced eligibility for future federal research funding at the institution. That is a far broader instrument, and it means an individual PI's clean record does not insulate their proposals from an institutional finding.

And if you are building an international collaboration right now — a joint publication, a visiting scholar appointment, a shared instrument facility — do the entity screening before the agreement, not after. The cost of screening a partner in advance is an hour. The cost of unwinding a partnership under a two-week federal deadline, with a mitigation plan due and funding eligibility in question, is measured in years of institutional capacity.

The fundamental research exclusion still exists. Open science with foreign colleagues is still lawful and still valuable. What has changed is that the burden of demonstrating which category a given relationship falls into now sits squarely on the institution, on a clock the institution does not set.