Contract analysis

I. Executive Summary On October 20, 2023, the Committee on Foreign Investment in the United States ("CFIUS" or the "Committee") communicated four preliminary national security concerns regarding the proposed acquisition of one hundred percent (100%) of the outstanding equity interests of Marlowe Asset Management Photonics Inc. ("VPI") by Halcyon Semiconductor Aktiengesellschaft ("HSAG"), to be effected through its wh

1. Foreign Access to Classified Defense Programs: The risk that HSAG, as a German parent company with no U.S. security clearances, would have the ability to access, influence, or compromise VPI's classified defense programs.

2. Potential Transfer of ITAR/EAR-Controlled Technology to Non-U.S. Persons: The risk that VPI's defense articles controlled under the International Traffic in Arms Regulations ("ITAR") and dual-use technologies controlled under the Export Administration Regulations ("EAR") could be transferred, whether deliberately or inadvertently, to HSAG's non-U.S. personnel, subsidiaries, or affiliates — including HSAG's China s

3. Cybersecurity Risks from Integration with HSAG IT Infrastructure: The risk that post-closing integration of VPI's information technology systems with HSAG's global IT infrastructure could create cybersecurity vulnerabilities, potentially exposing classified and controlled unclassified information ("CUI") to foreign intelligence services or unauthorized access.

4. Continuity of Critical DoD Supply Chain: The risk that foreign ownership could disrupt VPI's ability to serve as a reliable supplier of critical defense components — GaN power amplifier chips for defense radar, satellite communications, and missile defense systems — or lead to decisions that deprioritize government work in favor of commercial opportunities. It is important to note that CFIUS's communication of pre

II. Background and Procedural Context A. Transaction Overview HSAG is acquiring one hundred percent (100%) of the outstanding equity of VPI for a base purchase price of $1.42 billion, payable in cash, on a cash-free, debt-free basis with a normalized net working capital target of $34.6 million. The maximum aggregate consideration, including an earnout component, is $1.505 billion. The earnout comprises $85 million in

III. Analysis of Concern No. 1: Foreign Access to Classified Defense Programs A. Statement of the Concern In its October 20, 2023 communication, CFIUS expressed concern that, following the closing of the transaction, HSAG — as a German parent company with no U.S. security clearances — would have the ability to access, influence, or compromise VPI's participation in classified defense programs. The Committee's concern

1. Board Reconstitution. We propose reconstituting VPI's board of directors as a five-member board with the following composition: (a) Three (3) "Security Board Members," each of whom must be a U.S. citizen holding or eligible for a security clearance at the TS/SCI level. At least one of the three Security Board Members must be an independent Security Director — i.e., an individual who is not affiliated with either H

2. Government Security Committee (GSC). We propose establishing a Government Security Committee composed solely of the three Security Board Members. The GSC would have exclusive authority over: (a) All classified and ITAR-controlled programs, including decisions to bid on, accept, perform, modify, or terminate classified contracts; (b) Personnel security decisions, including hiring, termination, and reassignment of c

3. Facility Security Clearance Maintenance. We propose confirming in the NSA that VPI will retain its existing Facility Security Clearance at the SECRET level (CAGE Code 7VK92) following the closing of the transaction. To accomplish this, we recommend that the NSA be structured to function as the equivalent of a Special Security Agreement under NISPOM § 117.56(d), which DCSA has accepted in analogous transactions inv

4. Proposed Security Board Members. We recommend identifying the following candidates for the three Security Board Member positions: (a) Col. (Ret.) Bryce Hendrickson, USAF — VPI's current Vice President of Government Programs and Facility Security Officer. Col. Hendrickson holds an active TS/SCI clearance, has served as VPI's FSO since 2015, and has deep institutional knowledge of all VPI classified programs. His co

5. FSO Retention. We recommend confirming in the NSA that Col. (Ret.) Bryce Hendrickson will remain as VPI's Facility Security Officer following the closing of the transaction, maintaining continuity of security oversight. The FSO is the individual responsible for day-to-day compliance with NISPOM requirements, and DCSA places significant weight on FSO continuity in FOCI transitions. Col. Hendrickson's retention shou

6. Facility Access Restrictions. We propose that the NSA include specific provisions prohibiting HSAG personnel — including HSAG-designated board members, officers, employees, agents, and contractors — from accessing VPI's classified facilities without prior written approval from both DCSA and the GSC. Specifically: (a) Sections C-7 through C-12 of the Albuquerque fabrication facility — which house the classified cle

IV. Analysis of Concern No. 2: Potential Transfer of ITAR/EAR-Controlled Technology to Non-U.S. Persons A. Statement of the Concern CFIUS raised concern regarding the risk that VPI's defense articles controlled under the ITAR and dual-use technologies controlled under the EAR could be transferred — whether deliberately or inadvertently — to HSAG's non-U.S. personnel, subsidiaries, or affiliates following the closing

1. Technology Control Plan (TCP). We propose developing a comprehensive Technology Control Plan as a formal annex to the NSA. The TCP would establish binding obligations and procedures governing the handling, storage, access, and transfer of all ITAR- and EAR-controlled technical data within VPI, and would prohibit any transfer of such data to any non-U.S. person without prior U.S. government authorization (a DDTC li

2. Data Segregation. We propose that VPI's IT systems be physically and logically separated from HSAG's global network at all times. This means: (a) No shared cloud infrastructure — VPI may not use any cloud services, platforms, or storage that are shared with, managed by, or accessible to HSAG or any HSAG affiliate; (b) No shared email systems — VPI personnel must use VPI-branded, VPI-administered email systems that

3. Deemed Export Controls. We propose establishing internal protocols and training programs to ensure that no foreign national employee of HSAG or any HSAG affiliate is given access to VPI controlled technical data in any form — whether in documents, electronic files, verbal discussions, or visual observations — without a valid export authorization. These protocols would include: (a) Pre-meeting review procedures for

4. DDTC and BIS Compliance Continuity. We propose confirming in the NSA and in our response to CFIUS that VPI will maintain its DDTC registration (Registration No. M-24817) following the closing of the transaction, with a change-of-ownership notification filed under ITAR § 122.4(a) within sixty (60) days of closing. We further propose addressing the need to amend VPI's three (3) active DSP-5 export licenses to reflec

5. Firewall for China Operations. We propose including in the NSA an explicit, freestanding prohibition — going beyond the general export control compliance obligations described above — that specifically bars any sharing of VPI technical data, products, components, know-how, trade secrets, or other proprietary information with Halcyon Semiconductor (Shanghai) Co., Ltd. or any other HSAG entity located in, or substan

6. Trade Secret Protections. In addition to the export control measures described above, we propose enhanced internal controls specifically addressing VPI's thirty-one (31) registered trade secrets, which include the company's most competitively sensitive and strategically valuable technology — particularly the proprietary GaN epitaxial recipes and die-level reliability screening processes. These enhanced controls, a

V. Analysis of Concern No. 3: Cybersecurity Risks from Integration with HSAG IT Infrastructure A. Statement of the Concern CFIUS expressed concern that post-closing integration of VPI's information technology systems with HSAG's global IT infrastructure could create cybersecurity vulnerabilities that might expose classified information, controlled unclassified information, and proprietary technical data to foreign in

1. IT System Separation. We propose that VPI's IT systems — including all three network tiers (classified, unclassified-but-controlled, and general corporate) — remain physically and logically separated from HSAG's global network at all times. This separation would be absolute and without exception for the classified and unclassified-but-controlled networks. Specifically: (a) No shared cloud infrastructure — VPI may

2. NIST SP 800-171 Compliance. We propose that VPI maintain full compliance with NIST SP 800-171 for all information systems that process, store, or transmit CUI. This commitment would include: (a) Annual self-assessments of VPI's NIST SP 800-171 compliance, with results documented in a System Security Plan ("SSP") and a Plan of Action and Milestones ("POA&M") for any identified gaps; (b) Triennial third-party assess

3. Annual Penetration Testing. We propose that VPI undergo annual penetration testing of its IT systems — including both external and internal penetration tests — conducted by a qualified, independent cybersecurity firm. The penetration testing firm would be selected from a list approved by the GSC and DCSA. The scope of testing would cover VPI's unclassified-but-controlled network and general corporate network (the

4. Incident Reporting. We propose a mandatory incident reporting obligation requiring VPI to notify DCSA within seventy-two (72) hours of discovering any cybersecurity incident affecting VPI's information systems, whether classified or unclassified. This obligation would apply to any incident involving: (a) Unauthorized access to VPI systems or data; (b) Loss, theft, or compromise of CUI, ITAR-controlled technical da

5. Cybersecurity Requirements Annex. We propose developing a detailed Cybersecurity Requirements annex to the NSA that consolidates all cybersecurity-related obligations into a single, comprehensive document. The annex would address: (a) Technical security controls aligned with NIST SP 800-171; (b) IT system separation requirements; (c) Access controls and authentication requirements; (d) Data encryption standards (a

6. HSAG Access Controls for Limited Business Information Sharing. We recognize that, as the parent company of VPI post-closing, HSAG will have legitimate needs to receive certain categories of VPI information for business purposes — principally financial reporting data required for HSAG's consolidated financial statements under IFRS, tax compliance data, and high-level business performance metrics. We propose that an

VI. Analysis of Concern No. 4: Continuity of Critical DoD Supply Chain A. Statement of the Concern CFIUS raised concern about the continuity and reliability of VPI as a supplier of critical defense components — specifically, GaN power amplifier chips for defense radar, satellite communications, electronic warfare, and missile defense systems — following the acquisition by a foreign owner. This concern reflects the Co