Contract analysis

I. Executive Summary This memorandum has been prepared by the Calderwood & Harkness LLP national security and international trade team for the purpose of preparing the firm's negotiation team in advance of the first National Security Agreement ("NSA") negotiation session, currently scheduled for November 9, 2023, at the offices of the U.S. Department of the Treasury, 1500 Pennsylvania Avenue NW, Washington, D.C. The

1. Secure CFIUS clearance with mitigation terms that are commercially viable for HSAG and do not render the acquisition uneconomic.

2. Preserve the operational value of VPI — a $1.42 billion acquisition — by maintaining VPI's ability to perform on its existing government contracts and pursue new program opportunities.

3. Protect HSAG's ability to realize commercial synergies from the acquisition, particularly in the area of non-defense 5G infrastructure GaN technology, which was a core component of the strategic rationale presented to HSAG's supervisory board.

4. Maintain VPI's $193 million government contract backlog and position VPI for the CY2024 and CY2025 earnout milestones (up to $85 million in aggregate), which are conditioned upon achievement of government-contract revenue targets. The negotiation counterparts for the November 9 session include CFIUS staff from the co-lead agencies, DoD and DOE, with Treasury chairing. The parties' counsel includes Harrison Whitfie

II. Transaction Background (Brief Summary) The following summary is provided for reference and context. The full transaction description is set forth in the parties' joint voluntary notice filed with CFIUS on July 14, 2023, and in the supplemental information submissions dated August 11 and September 22, 2023. A. Transaction Structure and Consideration HSAG is acquiring 100% of the outstanding equity of VPI for aggre

III. Issue 1: Board Composition and Security Board Member Qualifications A. CFIUS Draft Position The draft NSA (§§3.1–3.9 and Annex A) requires that VPI's board of directors be reconstituted immediately upon closing to consist of five members: three "Security Board Members" and two HSAG designees. The CFIUS draft imposes the following requirements on this governance structure: • All three Security Board Members must

1. Clearance Level. HSAG requests that Security Board Members need only hold, or be eligible for, security clearances at the SECRET level, rather than TS/SCI. This request is grounded in the fact that VPI's FCL is at the SECRET level. VPI does not currently hold a TOP SECRET facility clearance, and none of VPI's current classified programs require access to TS/SCI information at the board level. While certain individ

2. HSAG Designee Access. HSAG's two designees should have full and unrestricted access to all unclassified VPI business information, including financial data, operational metrics, customer pipeline information (for unclassified programs), and commercial (non-ITAR) technical information. This access is essential for HSAG to exercise its ownership rights, fulfill its fiduciary obligations under German corporate law, an

3. Independent Security Director Selection. The independent Security Director should be mutually agreed upon by HSAG and CFIUS, rather than unilaterally selected by CFIUS. HSAG acknowledges CFIUS's legitimate interest in ensuring that the independent Security Director possesses appropriate qualifications and experience. However, HSAG — as the entity bearing the cost of the Security Director's compensation and as VPI'

4. Proposed Candidates. HSAG proposes Col. (Ret.) Bryce Hendrickson (current TS/SCI clearance holder and FSO) and Adrienne Delacroix (current SECRET clearance holder, former Deputy Director of the Defense Technology Security Administration, 22 years of DoD experience) as two of the three Security Board Members. HSAG would work with CFIUS to identify a mutually acceptable independent Security Director as the third mem

5. Financial Reporting Access. HSAG designees should have access to aggregated, unclassified financial information about VPI's classified programs — specifically, revenue, cost of goods sold, gross margin, and operating margin data, presented in aggregate across all classified programs without program-specific detail. This access is necessary for HSAG to prepare consolidated financial statements in compliance with IF

IV. Issue 2: Technology Access and TCP Scope A. CFIUS Draft Position The draft NSA (§§4.1–4.14 and Annex B) requires the establishment of a comprehensive Technology Control Plan ("TCP") governing all transfers of VPI technical data. The CFIUS draft defines "technical data" broadly to encompass all ITAR-controlled data falling under Category XI(a)(3) of the United States Munitions List and all EAR-controlled data clas

1. Narrowed Definition of Controlled Technical Data. The definition of "controlled technical data" should be narrowed to encompass only items that are actually controlled under ITAR Category XI(a)(3) and EAR ECCNs 3A001 and 3E001. The current draft's inclusion of ECCN 3A991 in the controlled-data definition is overbroad, as 3A991 items are subject to only limited export controls (Anti-Terrorism reasons only) and are

2. Controlled/Uncontrolled Distinction. The TCP should clearly distinguish between controlled and non-controlled VPI technology. VPI's product portfolio includes a significant body of purely commercial 5G wireless infrastructure technology — including power amplifier designs for commercial base stations, thermal management techniques for commercial applications, and GaN epitaxial growth processes optimized for commer

3. Joint R&D for Commercial Technology. The TCP should permit joint research and development activities between VPI and Halcyon US Inc. (the Austin, Texas design center) on uncontrolled commercial GaN technology, subject to appropriate screening procedures to ensure that controlled technical data is not inadvertently included. The Austin facility does not hold a facility clearance and does not perform classified work

4. Government-Licensed Technology. Of VPI's 47 granted patents, 23 were developed under government-funded contracts and are subject to march-in rights under 35 U.S.C. §203 and the rights provisions of DFARS 252.227-7038. The U.S. government already holds license rights to the technical data underlying these patents. TCP restrictions should focus on genuinely proprietary VPI technology that is not already accessible t

5. Existing Export Licenses. VPI currently holds valid DSP-5 licenses for deliveries of certain defense articles to the United Kingdom and Australia, both of which are close U.S. allies and members of the Five Eyes intelligence-sharing community. The TCP should not impede VPI's ability to fulfill obligations under these existing export licenses. VPI's ability to perform on its foreign military sales and direct commer

V. Issue 3: Monitor Scope and Independence A. CFIUS Draft Position The draft NSA (§§6.1–6.15 and Annex D) establishes a comprehensive third-party compliance monitoring regime with the following principal elements: • A third-party compliance monitor (the "Monitor") is to be appointed, with broad access to all VPI facilities, all HSAG U.S. facilities, all personnel of both entities, all records (including electronic re

1. Scope of Access. The Monitor's access should be limited to VPI facilities and VPI personnel, and to those HSAG U.S. personnel who interact with VPI in connection with matters covered by the NSA (e.g., HSAG designees on VPI's board, HSAG personnel involved in financial reporting or IT administration). The Monitor should not have access to HSAG's German headquarters, non-U.S. operations, or HSAG facilities and perso

2. Audit Frequency. HSAG proposes that the Monitor conduct one annual comprehensive compliance audit and one mid-year spot check per year, rather than the quarterly spot checks contemplated by the CFIUS draft. A quarterly cycle imposes significant operational burden on VPI personnel, who must devote substantial time to preparing for and participating in Monitor visits, and the incremental compliance value of quarterl

3. Inspection Notice. HSAG requests that all Monitor visits be conducted with at least 48 hours' advance notice, except in emergency circumstances where the CFIUS monitoring agencies have identified a specific, credible threat or indication of a violation. Unannounced inspections are disruptive to VPI's manufacturing operations — the Albuquerque fab operates on a continuous production schedule for defense-grade wafer

4. Report Sharing. Monitor reports should be simultaneously shared with HSAG (through Calderwood & Harkness as HSAG's U.S. counsel) to allow HSAG to review the Monitor's findings and submit a written response or rebuttal before the report is finalized and submitted to CFIUS agencies. This is a matter of fundamental fairness: the monitored parties should have the opportunity to correct factual errors, provide context

5. Monitor Selection. HSAG proposes Whitmore Compliance Group LLC ("WCG") as the third-party Monitor. WCG is led by Gerald Whitmore, a former supervisory special agent of the FBI's Counterintelligence Division, who holds a TS/SCI clearance and has extensive experience serving as a compliance monitor in CFIUS mitigation agreements, including three semiconductor-sector NSAs executed between 2020 and 2023. WCG is locate

6. Monitor Term. The Monitor's engagement should align with the term of the NSA. The draft's reference to an "indefinite" Monitor engagement is a function of the indefinite NSA term and should be addressed as part of the term/sunset discussion (Issue 8). In any event, the Monitor engagement agreement should include provisions for periodic performance reviews and, if warranted, replacement of the Monitor by mutual agr

VI. Issue 4: Cost Allocation for Monitor and Compliance A. CFIUS Draft Position The draft NSA (§§6.16–6.19) addresses cost allocation for monitoring and compliance as follows: • All costs associated with the third-party Monitor — including fees, expenses, travel, and any other costs — are to be borne exclusively by HSAG (through VPI). • The draft does not specify a fee amount or a fee structure; instead, it contempla

1. Fixed Annual Fee. HSAG proposes to negotiate a fixed annual fee with the selected Monitor (WCG), targeting an annual fee in the range of $1.0 million to $1.2 million. This range is consistent with the precedent analysis of comparable semiconductor-sector NSAs, in which annual monitor fees ranged from $800,000 to $1.8 million, with a median of $1.1 million.

2. Payment Structure. HSAG proposes a quarterly payment structure, with payments of $250,000 to $300,000 per quarter, to facilitate cash flow management at the VPI subsidiary level and to align Monitor payments with VPI's quarterly financial reporting cycle.

3. Escalation. Annual fee adjustments should be limited to a Consumer Price Index ("CPI") adjustment, not subject to uncapped escalation at the Monitor's discretion. The engagement agreement should specify the CPI index to be used (HSAG proposes the U.S. Bureau of Labor Statistics CPI-U, All Urban Consumers) and should cap annual increases at the CPI change, with no minimum annual increase.

4. Government Costs. HSAG's cost obligations should be limited to the third-party Monitor's fees and expenses and VPI's internal compliance costs. HSAG should not bear the costs of CFIUS's own internal agency monitoring and enforcement activities, which are ordinary government operational costs funded through congressional appropriations. There is no statutory authority for CFIUS to charge the costs of its own person

5. Scope Reduction. The Monitor fee should be subject to renegotiation if the scope of monitoring is reduced or NSA obligations are narrowed over time (e.g., as a result of a periodic review under the term/sunset provisions discussed in Issue 8). A fixed fee negotiated at the outset of the NSA should not remain at the same level if the Monitor's workload is subsequently reduced due to demonstrated compliance and rela

6. Tax Treatment. Internal compliance costs at VPI should be treated as ordinary and necessary business expenses and should be deductible for U.S. federal income tax purposes. While this is primarily a matter of VPI's tax position rather than an NSA drafting issue, the NSA should not contain any language that would characterize compliance costs as "penalties" or "fines" (which would be non-deductible under IRC §162(f

VII. Issue 5: Personnel Retention Requirements A. CFIUS Draft Position The draft NSA (§§5.1–5.8) includes key personnel retention requirements with the following principal elements: • Certain VPI personnel designated as "key personnel" must remain employed at VPI for a minimum period following the closing of the acquisition. • "Key personnel" are defined as: (i) Dr. Nathan Trevorrow, Chief Executive Officer; (ii) Mar

1. Retention Period. HSAG proposes that the mandatory retention period be set at 18 months, rather than 36 months. An 18-month period provides sufficient time for HSAG to integrate VPI's operations, establish relationships with VPI's government customers, and develop a pipeline of successor candidates, while avoiding the operational and legal complications associated with an excessively long mandatory retention perio

2. Key Personnel Identification. HSAG accepts the identification of Dr. Trevorrow, Ms. Sung-Avila, and Col. Hendrickson as the three key personnel. These individuals were identified in VPI's CFIUS submission as holding the most critical roles for purposes of classified program management, facility security, and government customer relationships.

3. Voluntary Departures. Voluntary departures by key personnel (i.e., resignations initiated by the individual) should not constitute a violation of the NSA, provided that HSAG and VPI made good-faith, commercially reasonable efforts to retain the individual. The NSA should not impose strict liability for an event that is not within HSAG's control — specifically, an individual's decision to leave. Employment law prin

4. Replacement Approval. The replacement approval process should be streamlined to require GSC approval only, with notification to DCSA. The dual-approval requirement (GSC plus DCSA) creates an unnecessary procedural burden that could delay the installation of qualified replacement personnel, which in turn could disrupt VPI's classified programs and government contract performance — the very outcome CFIUS is seeking

5. Retirement and Disability. If a key personnel member retires or becomes disabled, the event should trigger a 90-day cure period during which HSAG and VPI must identify and obtain approval for a qualified replacement. Retirement or disability should not be treated as an immediate NSA violation, as these are foreseeable life events for which a reasonable remediation period is appropriate. C. Red Lines • Maximum Rete

VIII. Issue 6: Cybersecurity Standards (NIST SP 800-171 vs. CMMC) A. CFIUS Draft Position The draft NSA (§§8.1–8.12 and Annex E) imposes comprehensive cybersecurity requirements on VPI, including: • VPI must maintain compliance with NIST Special Publication 800-171, Revision 2, "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations," for all covered defense information ("CDI") process

1. NIST SP 800-171 Compliance. HSAG accepts the requirement to maintain VPI's compliance with NIST SP 800-171, Revision 2. VPI is already substantially compliant, with only seven open items on its current Plan of Actions and Milestones, all of which are scheduled for remediation by Q1 2024. Acceptance of this requirement is straightforward.

2. CMMC Level 2 Timeline. HSAG proposes that the CMMC Level 2 certification timeline be aligned with DoD's own CMMC program rollout schedule. The CMMC program has been subject to repeated delays; the final rule implementing CMMC 2.0 has not yet been published, the CMMC Accreditation Body ("The Cyber AB") is still in the process of certifying CMMC Third-Party Assessment Organizations ("C3PAOs"), and DoD has not yet be

3. Incident Reporting. HSAG proposes a 72-hour incident reporting window, rather than the 24-hour window in the CFIUS draft. A 72-hour reporting window is consistent with the existing DFARS 252.204-7012 clause ("Safeguarding Covered Defense Information and Cyber Incident Reporting"), which requires reporting of cyber incidents to the DoD Cyber Crime Center (DC3) within 72 hours of discovery. The 72-hour period allows

4. IT Separation — Classified vs. Unclassified. HSAG accepts the requirement for complete physical and logical separation of VPI's classified IT systems and any systems processing ITAR- or EAR-controlled technical data from HSAG's global network. However, HSAG proposes that VPI be permitted to share unclassified enterprise resource planning ("ERP"), human resources ("HR"), and financial reporting systems with HSAG fo

5. IT Reporting Structure. HSAG proposes that VPI IT personnel be divided into two categories: (i) those with access to classified systems, who would report exclusively to the GSC and the FSO, and (ii) those responsible for unclassified administrative systems, who would maintain a primary reporting line to a VPI IT director with a dotted-line reporting relationship to HSAG IT for administrative and budgetary coordina

6. Penetration Testing. HSAG accepts the requirement for annual third-party penetration testing. However, HSAG proposes that VPI (through its IT security team and the GSC) select the penetration testing firm, subject to Monitor approval. The current draft's silence on the selection process implies that the Monitor selects the firm unilaterally, which could result in the selection of a firm unfamiliar with VPI's syste