1. Introduction

Research security and export controls have become increasingly important in universities, laboratories, defence institutions, biotechnology companies, semiconductor research, space research and other technology-intensive sectors.

The basic legal problem is:

How can India facilitate legitimate scientific research and international collaboration while preventing sensitive technology, technical data, software, materials or expertise from being diverted to military, nuclear, chemical, biological or other prohibited end uses?

India does not presently have one comprehensive “Research Security Act.” Instead, research-security obligations arise from a combination of:

• the Foreign Trade (Development and Regulation) Act, 1992 (FTDR Act);
• Foreign Trade Policy 2023;
• SCOMET — Special Chemicals, Organisms, Materials, Equipment and Technologies;
• the Weapons of Mass Destruction and their Delivery Systems (Prohibition of Unlawful Activities) Act, 2005 (WMD Act);
• the WMD Rules, 2016;
• the Atomic Energy Act, 1962;
• the Chemical Weapons Convention Act, 2000;
• Customs legislation;
• intellectual-property and confidentiality law;
• contractual research restrictions; and
• applicable national-security and cybersecurity requirements.

The FTDR Act itself contains a dedicated Chapter IVA dealing with controls on export of specified goods, services and technology, including transfer controls and catch-all controls.

2. What is “research security”?

Research security means protecting legitimate research from:

1. unauthorised acquisition;
2. espionage;
3. theft of intellectual property;
4. unauthorised technology transfer;
5. diversion to weapons programmes;
6. foreign interference;
7. cyber compromise;
8. unauthorised access to controlled technical information; and
9. transfer of sensitive research to prohibited end users or destinations.

It is broader than traditional export control.

For example, export control may ask:

"Can this technology legally be sent to Country X?"

Research security may additionally ask:

"Who has access to the research, who funds it, who owns the resulting IP, who can download the technical data, and could the research be diverted to an unlawful military or WMD programme?"

3. What is an “export”?

A common misconception is:

Export = physically shipping an object outside India.

That is too narrow.

Modern export-control systems regulate not only physical goods but potentially:

• technology;
• technical data;
• software;
• technical assistance;
• services;
• design information;
• manufacturing information;
• controlled know-how.

India's Department of Atomic Energy expressly explains that transfer of controlled technology can occur through transfer from a person/place in India to a person/place outside India and, in specified circumstances, through transfers involving persons or places outside India under Indian control.

Therefore, research institutions must examine information transfers, not merely physical shipments.

4. The SCOMET system

The centrepiece of India's strategic export-control regime is SCOMET.

SCOMET means:

Special Chemicals, Organisms, Materials, Equipment and Technologies.

It covers specified:

• dual-use goods;
• military items;
• nuclear-related items;
• chemicals;
• biological materials;
• software; and
• technologies.

The Government describes SCOMET as India's national export-control list for dual-use items, munitions and nuclear-related items, including software and technology.

SCOMET is notified under Appendix 3 to Schedule 2 of ITC (HS) Classification of Export and Import Items.

5. Why SCOMET matters to research institutions

Consider a university laboratory developing:

• advanced drones;
• satellite components;
• high-performance computing technology;
• encryption systems;
• advanced sensors;
• specialised biological materials;
• controlled chemicals;
• nuclear-related technology.

The researchers may believe:

"We are conducting basic academic research, so export law does not apply."

That conclusion can be dangerous.

The legal analysis depends upon:

• the precise technology;
• its technical specifications;
• intended use;
• destination;
• end user;
• whether it appears on SCOMET;
• whether an exemption applies; and
• whether catch-all controls are triggered.

6. Research and the definition of “technology”

SCOMET is particularly significant because "technology" can encompass technical information required for the development, production or use of controlled items.

The SCOMET material's glossary expressly addresses activities such as:

• design;
• design research;
• design analysis;
• design concepts;
• assembly;
• testing of prototypes;
• pilot production;
• design data; and
• integration.

This has direct implications for research institutions.

A researcher may never physically export a machine but could potentially transfer controlled technical information through:

• technical drawings;
• source code;
• design specifications;
• research papers containing controlled technical details;
• engineering files;
• technical presentations;
• training;
• remote access;
• collaborative R&D.

7. Basic classification principle

A research institution should therefore ask four questions:

Question 1

What exactly is being transferred?

Goods, software, technology, technical data, services or expertise?

Question 2

Is it controlled?

Does it fall under SCOMET or another specialised regime?

Question 3

Where is it going?

Destination-country risk matters.

Question 4

Who will receive it and what will they do with it?

End-user and end-use analysis is essential.

8. Licensing

Where a SCOMET item requires authorisation, export generally requires the relevant government authorisation unless a specific exemption or general authorisation applies.

DGFT's current framework provides different mechanisms depending on the category and circumstances.

For example, DGFT's Handbook of Procedures contains procedures for Global Authorisation for Intra-Company Transfers (GAICT) covering specified SCOMET items, including software and technology.

The strategic-trade framework also provides specific policies for:

• repeat orders;
• stock and sale;
• repairs;
• intra-company transfers;
• demonstrations/displays;
• certain dual-use items.

The exact exemption or general authorisation must be checked against the current SCOMET list and applicable DGFT procedures.

9. Catch-all controls

One of the most important research-security provisions is the catch-all mechanism.

An item does not necessarily have to appear on SCOMET for export controls to become relevant.

Under the FTDR framework, export of non-SCOMET items can be regulated where the exporter:

• has been notified by DGFT; or
• knows or has reason to believe that the item could be used in or diverted to a WMD programme, missile system or specified military end use, including use by terrorists or non-state actors.

The Delhi High Court recently reproduced and considered these provisions in A R Sales Pvt. Ltd. v. Union of India & Ors.

This is extremely important for researchers.

Example

Suppose a university develops an ordinary-looking piece of equipment.

It is not listed on SCOMET.

However, the researcher knows that the foreign recipient intends to incorporate it into a prohibited weapons programme.

The absence of the item from SCOMET does not necessarily make the transfer lawful.

10. WMD Act, 2005

The Weapons of Mass Destruction and their Delivery Systems (Prohibition of Unlawful Activities) Act, 2005 is another central component of India's export-control system.

Its purpose is to prohibit unlawful activities involving:

• weapons of mass destruction;
• delivery systems;
• related materials;
• equipment;
• technology; and
• relevant services.

The WMD Rules, 2016 specifically connect controlled items with SCOMET and other specialised control lists.

11. Technology-transfer controls under the WMD Act

Section 13 of the WMD Act is particularly important.

The Department of Atomic Energy explains that:

• Section 13(2) prohibits certain technology transfers relating to prohibited relevant activities; and
• Section 13(3) permits restrictions on transfer of notified technology. 

Technology transfer may occur through:

a person/place within India to a person/place outside India,

and the statute also addresses certain transfers involving persons controlled by Indian citizens/residents.

Research implication

A research institution should not assume:

"The research data belongs to the university, therefore it can be freely shared."

Ownership and export-control legality are separate questions.

12. Deemed or intangible transfers

One of the most difficult areas is the transfer of technology without shipment of a physical product.

For example:

Scenario

An Indian laboratory gives a foreign researcher access to a restricted technical database.

No physical item leaves India.

Nevertheless, the information itself may constitute controlled technology.

Similarly:

• uploading controlled design files to an overseas cloud server;
• giving foreign collaborators access to controlled source code;
• emailing technical drawings;
• remote access to controlled databases;
• providing technical training;

may create export-control concerns.

The exact legal characterization depends upon the applicable control regime and facts; institutions should therefore conduct a technology-classification analysis before transferring sensitive technical information.

13. Foreign research collaboration

International collaboration is not inherently unlawful.

Indeed, India's export-control framework is designed to allow legitimate international trade and technological cooperation while controlling proliferation risks.

The Department of Atomic Energy expressly states that robust export control is intended to prevent proliferation while allowing legitimate trade in strategic and dual-use goods, services and technology to continue.

Therefore:

Foreign collaboration ≠ prohibited activity.

But:

Foreign collaboration + controlled technology + sensitive end use = potential export-control issue.

14. Research contracts and security clauses

Universities and research institutions conducting sensitive research should consider contractual safeguards such as:

• end-use restrictions;
• end-user identification;
• restrictions on onward transfer;
• confidentiality;
• access controls;
• publication review;
• ownership of IP;
• termination rights;
• audit rights;
• sanctions compliance;
• export-control compliance;
• notification of change in end use.

These contractual controls do not replace statutory export licences.

A contract saying:

"The parties agree to comply with applicable law"

cannot itself authorise a prohibited export.

15. End-user verification

Research-security compliance must examine the end user, not merely the destination country.

For example, the recipient may be:

• a university;
• private company;
• government laboratory;
• defence organisation;
• military entity;
• research institute;
• intermediary.

The institution should establish:

1. legal identity;
2. physical address;
3. beneficial ownership where relevant;
4. actual research purpose;
5. ultimate end user;
6. intended end use;
7. possibility of onward transfer.

This is particularly important because a seemingly legitimate university or commercial entity can potentially act as an intermediary.

16. End-use certificates

Export-control processes commonly use End-Use/End-User Certificates (EUCs).

The purpose is to establish:

• who receives the item;
• what it will be used for;
• whether it will be transferred onward;
• whether the recipient accepts restrictions.

DGFT's SCOMET guidance contains specific EUC requirements and identifies common mistakes in EUCs.

For research institutions, an EUC should be treated as a substantive compliance document rather than a routine formality.

17. Internal Compliance Programme

A sophisticated research institution should have an Internal Compliance Programme (ICP).

DGFT's SCOMET procedures recognise ICPs as an important compliance mechanism; in certain authorisation procedures, applicants must demonstrate an approved/certified ICP or compliance with the relevant parent-company ICP.

An effective research-security ICP should include:

Classification

Identify controlled goods, software and technology.

Screening

Screen:

• recipients;
• end users;
• destinations;
• intermediaries.

Licensing

Determine whether:

• individual authorisation;
• general authorisation;
• exemption; or
• no licence

applies.

Recordkeeping

Maintain:

• licence;
• EUC;
• correspondence;
• classification analysis;
• shipping records;
• access logs;
• research agreements.

Training

Researchers, administrators and procurement teams should understand export controls.

18. Universities and academic freedom

A particularly difficult issue is the relationship between research security and academic freedom.

Universities traditionally favour:

• open publication;
• international collaboration;
• unrestricted academic exchange;
• sharing of knowledge.

Export-control law, however, may require restrictions on certain technology.

The correct legal approach is not:

"All research should be secret."

Nor is it:

"Academic research is automatically exempt."

Instead, institutions should distinguish:

Fundamental/basic research

Often oriented toward open scientific knowledge.

Applied research

May involve specific technological applications.

Controlled technology

May be subject to export restrictions regardless of the academic setting.

The legal question must therefore be determined by the nature of the information and applicable control law, not simply the fact that a university produced it.

19. Publication of research

Publication presents a difficult issue.

Suppose an Indian researcher prepares a paper containing technical information concerning a controlled technology.

The researcher intends to publish it internationally.

Questions include:

• Is the information controlled technology?
• Is it already publicly available?
• Does a specific SCOMET provision/exemption apply?
• Would publication disclose controlled technical information?
• Is prior government authorisation required?
• Does the relevant legislation contain a research/publication exclusion?

These questions must be resolved before publication, rather than after dissemination.

20. Case law: A.R. Sales Pvt. Ltd. v. Union of India

A particularly useful contemporary case is:

A R Sales Pvt. Ltd. v. Union of India & Ors.

Delhi High Court, 2024.

The case concerned export of aircraft engines/components and the applicability of SCOMET requirements.

The Court considered the Foreign Trade Policy provisions dealing with:

• SCOMET;
• dual-use items;
• non-SCOMET items;
• catch-all controls;
• end use.

The Court also directed DRDO to conduct physical inspection to determine the nature of the goods.

Legal significance

The case demonstrates that classification cannot always be determined merely from the commercial description of the product.

The actual:

• technical characteristics;
• application;
• end use;
• SCOMET classification

may matter.

This principle is highly relevant to research institutions developing dual-use technology.

21. D.G. Exports v. Union of India

In M/s D.G. Exports v. Union of India & Ors., Delhi High Court considered the treatment of SCOMET goods and export authorisation requirements.

The case appears in reported Indian case-law searches concerning SCOMET controls.

Importance

The case illustrates that the legal characterisation of an exported product under the export-control regime can have direct consequences for whether an export licence is required.

For researchers, the lesson is:

Classification should be undertaken before the transfer, not retrospectively after customs or DGFT raises an objection.

22. CBI v. Dr. A.S. Narayana Rao

Cases involving SCOMET exports have also reached criminal courts.

CBI v. Dr. A.S. Narayana Rao is associated with proceedings concerning the export of SCOMET items and licensing issues. The case history reflects the criminal-law consequences that can arise from improper handling of controlled exports.

This demonstrates that export control is not merely an administrative/customs issue.

Depending upon the facts, violation can have:

• administrative;
• customs;
• civil;
• and criminal

consequences.

23. CBI v. R.K. Yadav

CBI v. R.K. Yadav is another reported case associated with SCOMET export licensing issues.

Its relevance lies in demonstrating that strategic export controls can generate criminal-investigation issues where authorities suspect unlawful handling or export of controlled materials.

For research institutions, this reinforces the importance of maintaining documentary evidence showing:

• classification;
• authorisation;
• end-user verification;
• lawful purpose;
• internal approvals.

24. Customs enforcement

Export control does not operate independently of customs.

Customs authorities may examine:

• description of goods;
• technical specifications;
• declared value;
• destination;
• licence;
• end user;
• documentation.

If a declared "laboratory component" turns out to be a controlled strategic component, customs authorities can raise serious questions.

The institution should therefore ensure that commercial documents accurately reflect the actual technical nature of the item.

25. Atomic-energy research

Nuclear research requires a specialised legal regime.

The Atomic Energy Act, 1962 and regulations administered by the Department of Atomic Energy govern specified nuclear materials, prescribed substances, equipment and technology.

The DAE specifically notes that export controls for nuclear-related items operate alongside the SCOMET framework and other statutory controls.

Therefore, a university conducting nuclear-related research cannot rely solely upon ordinary SCOMET analysis.

It must examine:

• Atomic Energy Act requirements;
• DAE notifications;
• prescribed substances/materials/equipment;
• technology-transfer restrictions;
• applicable licences and approvals.

26. Chemical research

India also has the Chemical Weapons Convention Act, 2000.

This is particularly important for laboratories working with:

• scheduled chemicals;
• toxic chemicals;
• chemical precursors;
• controlled production equipment.

Research institutions must distinguish legitimate scientific use from prohibited activities and comply with applicable declaration, transfer and regulatory requirements.

27. Biological research

Biotechnology creates similar concerns.

Sensitive research can involve:

• pathogenic organisms;
• toxins;
• genetic engineering;
• advanced biological manufacturing;
• diagnostic technology;
• dual-use biological research.

The regulatory analysis may involve several overlapping regimes rather than one single statute.

Therefore, a biological research institution should perform:

technology + material + end-use + end-user + destination

analysis.

28. Defence research

Defence-related research is particularly sensitive.

SCOMET Category 6 covers specified military items, and DGFT announced in 2024 that the Department of Defence Production was authorised as licensing authority for export of Category 6 items for military end use in the circumstances specified by the updated framework.

Research institutions working with:

• weapons;
• military electronics;
• defence aerospace;
• military communications;
• propulsion;
• targeting systems;
• military software

should therefore establish the applicable licensing authority before transferring technical information or products abroad.

29. Space and aerospace research

Aerospace technology illustrates the concept of dual use.

The same technology may have:

Civilian use

Aircraft, satellites, navigation, communications.

Military use

Missiles, reconnaissance, targeting, military communications.

Therefore, the label:

"civilian research"

does not by itself remove export-control obligations.

The recent A R Sales litigation demonstrates how technical classification and actual application can become central to SCOMET analysis.

30. Cybersecurity and research security

Modern research security is increasingly connected with cybersecurity.

A research institution may hold:

• source code;
• engineering drawings;
• unpublished research;
• experimental results;
• genomic data;
• defence data;
• AI models;
• chip designs.

If attackers obtain that information, there may be:

1. IP loss;
2. national-security implications;
3. export-control concerns;
4. contractual liability;
5. data-protection consequences.

Therefore, research security should include:

• role-based access;
• multi-factor authentication;
• encryption;
• network segmentation;
• audit logs;
• controlled downloads;
• incident response;
• secure cloud configurations.

31. Foreign nationals in Indian research laboratories

Another sensitive issue concerns access by foreign researchers.

The mere presence of a foreign national in an Indian laboratory is not automatically unlawful.

But where the individual receives access to controlled technology, the institution should determine whether the transfer is regulated under the applicable export-control framework.

The institution should therefore maintain:

• project-level access controls;
• nationality/access assessments where legally relevant;
• confidentiality agreements;
• export-control classification;
• restricted-data zones.

The aim should be targeted control, not discriminatory treatment.

32. Cloud computing and research data

Suppose:

An Indian research institution stores controlled technical files on a cloud server accessible by researchers located overseas.

The institution should ask:

• Where is the data stored?
• Who can access it?
• From which countries?
• Is the information controlled technology?
• Is remote access an export/transfer under the relevant regime?
• What contractual controls exist with the cloud provider?

This demonstrates why export control is no longer limited to shipping departments.

IT departments and research offices are now part of export-control compliance.

33. Research-security compliance model

A research institution can adopt the following framework:

Step 1 — Identify

What research is being conducted?

Step 2 — Classify

Does the research output contain:

• controlled goods;
• software;
• technology;
• technical data?

Step 3 — Screen

Who is receiving it?

Step 4 — Examine destination

Is the destination subject to restrictions?

Step 5 — Examine end use

Could the technology contribute to:

• WMD;
• missile;
• military;
• terrorist;
• prohibited activities?

Step 6 — Determine licence

Is:

• DGFT authorisation;
• DDP/other specialised authorisation;
• DAE approval;
• another licence

required?

Step 7 — Document

Maintain evidence of the compliance decision.

Step 8 — Monitor

Monitor onward transfer and changed end use.

34. Red-flag indicators

A research institution should investigate circumstances such as:

• recipient refuses to provide end-use information;
• unusual urgency;
• inconsistent technical description;
• request for excessive technical detail;
• unexplained intermediary;
• unusual destination;
• request to conceal the ultimate recipient;
• repeated changes to end use;
• requests for source code rather than object code;
• requests for manufacturing instructions;
• unusual payment arrangements;
• attempts to circumvent licensing.

These are not automatically evidence of unlawful conduct, but they justify enhanced due diligence.

35. Difference between export control and research security

36. Principle of proportionality

Research-security controls should be risk-based.

Not every research project requires the same restrictions.

For example:

Low risk

Open publication of ordinary mathematics.

Moderate risk

Advanced engineering with potential industrial applications.

High risk

Controlled aerospace, biological, nuclear or defence technology.

The institution should avoid imposing excessive restrictions on ordinary academic research while ensuring that genuinely sensitive technology is protected.

37. International collaboration and India's multilateral commitments

India's export-control system is influenced by international non-proliferation arrangements.

The Government states that India is a member of:

• Missile Technology Control Regime (MTCR);
• Wassenaar Arrangement;
• Australia Group;

and harmonises relevant control lists with these regimes and the Nuclear Suppliers Group framework.

This is significant for researchers because international research collaboration may involve technologies controlled under internationally harmonised categories.

38. Recent regulatory development

India's strategic-trade-control framework continues to evolve.

DGFT updated the SCOMET list in 2024, incorporating developments in multilateral export-control regimes and policy changes. It also streamlined licensing responsibilities and introduced/expanded general-authorisation mechanisms for specified categories.

Therefore, a research institution should not rely indefinitely on an old SCOMET classification or old university policy.

The current DGFT list and applicable Handbook of Procedures should be checked whenever a sensitive technology is proposed for transfer.

39. Case-law principles in one table

The reported SCOMET case-law database includes these and other cases concerning DGFT, customs and export authorisation.

40. Important legal principles from the case law

Principle 1 — Substance over label

A product's commercial description is not necessarily decisive.

The actual technical characteristics and intended use matter.

A R Sales illustrates this point.

Principle 2 — SCOMET is legally enforceable

SCOMET is not merely a voluntary industry guideline.

It operates within the statutory framework of the FTDR Act and Foreign Trade Policy.

Principle 3 — Non-SCOMET does not always mean unrestricted

Catch-all controls can regulate non-listed items where the statutory conditions are met.

Principle 4 — Technology transfers matter

Export control extends beyond physical goods to relevant technology transfers under the applicable laws.

Principle 5 — Compliance should be documented

An institution should be able to demonstrate why it concluded that a transfer was lawful.

41. Hypothetical case study

Facts

An Indian university develops an advanced satellite-navigation algorithm.

A foreign university asks for:

• source code;
• technical architecture;
• manufacturing specifications;
• testing data.

The foreign university says the research is for "civilian satellite applications."

Legal analysis

The Indian university should not immediately send the material.

It should first determine:

1. Classification

Does the algorithm/software constitute controlled technology?

2. SCOMET

Does it fall within a relevant SCOMET entry?

3. End use

What satellite system will use it?

4. End user

Who ultimately controls the foreign institution/project?

5. Destination

Is the destination subject to restrictions?

6. Catch-all

Is there knowledge or reason to believe the technology could be diverted to a prohibited military/WMD/missile end use?

7. Licence

Is DGFT or another authority's authorisation required?

8. Contract

What restrictions govern onward transfer?

Only after completing this assessment should the transfer take place.

42. Consequences of non-compliance

Depending upon the applicable law and facts, consequences can include:

• denial of export authorisation;
• suspension/cancellation of licence;
• confiscation;
• monetary penalties;
• customs action;
• prosecution;
• criminal liability;
• loss of government research privileges;
• contractual liability;
• reputational damage;
• national-security investigation.

The FTDR Act specifically contains provisions dealing with penalties, confiscation, suspension/cancellation of licences and offences within Chapter IVA and related provisions.

43. Best-practice research-security policy for universities

A university should establish a central Research Security and Export Control Committee.

Its functions could include:

A. Technology classification

Determine whether research outputs are controlled.

B. Foreign collaboration review

Review high-risk international collaborations.

C. End-user screening

Verify recipients.

D. Licence management

Coordinate DGFT/other approvals.

E. Data governance

Control sensitive technical information.

F. Cybersecurity

Protect research systems.

G. Training

Train researchers and administrative personnel.

H. Incident reporting

Create procedures for suspected unauthorised transfer.

44. Recommended compliance checklist

Before transferring sensitive research internationally, an institution should be able to answer yes to the following:

•  Has the technology/material been classified?
•  Has the current SCOMET list been checked?
•  Have specialised regimes such as nuclear/chemical controls been considered?
•  Has the end user been identified?
•  Has the ultimate end use been established?
•  Has the destination been checked?
•  Have catch-all controls been considered?
•  Has the need for an export authorisation been determined?
•  Has an EUC been obtained where required?
•  Has onward transfer been addressed?
•  Have access permissions been limited?
•  Has the transfer been documented?
•  Has the relevant research team been trained?

45. Conclusion

The legal architecture of research security and export controls in India is fundamentally a risk-management and national-security framework.

The most important statutory foundation is the Foreign Trade (Development and Regulation) Act, 1992, whose Chapter IVA specifically regulates exports and transfers of specified goods, services and technology.

The SCOMET list then identifies strategic goods, dual-use items, military items, nuclear-related items, software and technology subject to export controls.

The WMD Act, 2005 adds particularly important controls over WMD-related activities and technology transfers, while specialised legislation applies to nuclear and chemical areas.

The central legal lesson from the emerging case law is:

Research institutions cannot determine export-control obligations merely by asking whether an item is commercially available or whether the research is labelled “academic” or “civilian.” The technical characteristics, classification, destination, end user and intended end use must all be examined.

For an examination or dissertation, the strongest authorities to discuss are A R Sales Pvt. Ltd. v. Union of India, M/s D.G. Exports v. Union of India, Czarnikow Group Ltd. v. Commissioner of Customs, and the reported SCOMET-related criminal proceedings such as CBI v. Dr. A.S. Narayana Rao and CBI v. R.K. Yadav.