Section 117 Is Becoming a Data-Governance Problem

At many universities, the answer depends on which office you ask.

Section 117 (20 U.S.C. § 1011f) requires colleges and universities that receive federal financial assistance to report foreign gifts and contracts worth $250,000 or more, in total, from a single foreign source in a calendar year. Reports are due January 31 or July 31, and the statute makes them public records.

The statute itself asks for dollar amounts and the country each gift is tied to, with more detail for gifts that come with conditions. The Department’s reporting instructions go further. They ask for the name and address of every foreign source. According to AAU, the Department assured institutions and donors in writing for years that this information would stay confidential and be used only to verify compliance.

That changed this year, when the Department moved to publish the names. After several postponements, it set the release for October 2.

The suit names the Departments of Education and State and their secretaries. (State has helped administer Section 117 under an agreement with Education since February 2026.) AAU argues that the statute does not call for publishing private donors’ personal information. It says the Constitution protects donors from compelled public exposure of their charitable associations. And it says the Department reversed course without notice to donors and without the rulemaking the law requires. The Department has described the publication as consistent with Section 117’s transparency requirements.

The court found AAU likely to succeed on its claim that publishing, after six years of written assurances to the contrary, was arbitrary and capricious. It also found that publication could cause irreparable harm, since a published name cannot be taken back.

Many foreign-source problems start when these five activities get treated as one.

Collection is information coming in. It might be a gift agreement in advancement, a wire transfer in finance, a sponsored-research contract, a faculty appointment, or a department’s agreement with a foreign university. Each one raises the same basic questions. What was captured, from whom, and why? Who can see it?

Screening checks a party against authoritative lists, such as the OFAC Specially Designated Nationals List or the BIS Entity List, when the relationship calls for it. A screen produces a result. A person still has to decide what that result means.

Institutional review is where people with authority decide what a relationship means. Is the counterparty part of a government? Does the money come with conditions? Does the project need research-security or export-control review? Should the decision go up the chain? Review is a human judgment, and it should leave a record.

Federal reporting means sending the Department what Section 117 and its current instructions require, on the statutory schedule. The law that requires the report also sets its limits.

Publication means making information public. It is a separate act with its own legal authority, and right now it is the subject of a lawsuit. Reporting something to the government does not, by itself, make it public.

A compliance system has to track these as separate states of the same record. Put a screening hit, a reviewer’s note, a reported field, and a published field in one spreadsheet column, and the distinctions disappear. The institution can no longer show what it decided, what it submitted, or what was ever meant to be public.

Section 117 used to look like a finance task. Add up the foreign gifts and contracts, file twice a year, move on. The data behind those filings is now far more sensitive.

It starts with identity. Universities report donor names and addresses to the Department, including for donors who asked to keep their gift anonymous. Then come the judgment calls. Is the counterparty a company, a university, a government agency, a state-owned enterprise, or an intermediary acting for someone else? Which country is it tied to? Each answer is a classification that someone made, on some date, under some rule.

Then there is access. Who inside the university can see a donor’s identity, and why? And there is history. What was submitted, what was corrected later, and what was made public are three different facts.

The rules keep moving, too. In 2026 alone, the Department launched a new reporting portal, proposed changes to what reports collect, opened a process for correcting past filings, and announced a string of publication dates. A reviewer who classified a counterparty in 2023 applied 2023 instructions. If the institution cannot show which rule applied at the time, that call becomes hard to defend.

If those answers live in five systems and three inboxes, a federal records request will turn into a scramble.

In practice, Section 117 now sits right next to research security. In mid-July, the Department published a list of reported foreign sources that also appear on U.S. government lists, and the State Department wrote to the boards of R1 universities about funding from counterparties on cautionary and restricted government lists. Recent federal records requests have also gone well beyond gift ledgers, asking for faculty agreements, research collaborations, and records of foreign talent program participation. We walked through one of those requests in an earlier analysis.

The same foreign organization may appear in a donation record, a sponsored-research agreement, a faculty affiliation, an export-control review, and a restricted-party screening result. Those records should not live as five unrelated facts.

When they do, the university answers the same question five times, sometimes five different ways. Advancement might log a counterparty as a private foundation while research administration treats the same organization as state-affiliated. Both offices may be right under the rule each one applies. The problem is that nobody can see the two answers side by side, or explain the difference when someone asks.

Linking the records gives a full picture of the relationship. The legal questions stay separate:

None of this requires waiting for the court. These ten capabilities hold up under any outcome:

All ten come down to one habit. Keep the fact, the decision, and the disclosure apart, and give each one an owner and an audit trail.

SecurePoint Education is built on a simple premise: compliance decisions should not disappear into spreadsheets, email threads, and one-time searches.

Today it handles the screening and review steps described above. For each person or organization it screens, it keeps the result, the reviewer’s decision, when it was made, and why.

Decisions about what to report, and what may be made public, belong to the institution and its counsel. SecurePoint’s job is to keep the screening and review evidence those decisions rest on.

The court will decide whether the Department can publish these names, and on what terms. Whatever it decides, the harder test comes later. Months or years from now, a regulator, a court, a board, or a donor may ask why a report said what it said, and what happened to the information behind it. The universities that can answer will be the ones that kept the record.