MEMORANDUM
PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT
TO: Stefan Lohse, Chefjustitiar, Halcyon Semiconductor Aktiengesellschaft
CC: Beatrice Holloway, Partner, Calderwood & Harkness LLP Margaret "Peggy" Ashworth, Of Counsel, Calderwood & Harkness LLP
FROM: Lt. Col. (Ret.) David Caruso, Senior Counsel, Government Contracts & Export Controls, Calderwood & Harkness LLP Priya Venkataraman, Associate, International Trade & Sanctions, Calderwood & Harkness LLP
DATE: November 17, 2023
RE: Facility Security Clearance Transition Plan — Marlowe Asset Management Photonics Inc. (CAGE Code 7VK92) — Maintaining FCL Under Foreign Ownership Following Acquisition by Halcyon Semiconductor AG
MATTER: Halcyon Semiconductor AG / Marlowe Asset Management Photonics Inc. — CFIUS Filing & Mitigation (CFIUS Case No. CFIUS-023-07-3841)
Right-click to update Table of Contents
I. Executive Summary
The purpose of this memorandum is to outline the legal and regulatory requirements for maintaining Marlowe Asset Management Photonics Inc.'s ("VPI") existing Facility Security Clearance ("FCL") at the SECRET level following the consummation of Halcyon Semiconductor Aktiengesellschaft's ("HSAG") proposed $1.42 billion acquisition of 100% of VPI's outstanding equity (the "Acquisition"). This memorandum is intended to serve as a comprehensive transition plan for preserving VPI's FCL through the change-of-ownership process and ensuring uninterrupted performance of VPI's classified U.S. government contracts.
VPI currently holds an FCL at the SECRET level, assigned CAGE Code 7VK92. VPI's Facility Security Officer ("FSO") is Col. (Ret.) Bryce Hendrickson, USAF, who serves concurrently as VPI's Vice President, Government Programs. Col. Hendrickson holds an active TS/SCI clearance and has served as FSO since VPI first obtained its FCL. His continued service in this role is central to the transition strategy outlined herein.
The Acquisition by HSAG — a publicly traded German Aktiengesellschaft listed on the Frankfurt Stock Exchange (XETRA: HLC), headquartered at Industriestraße 44, 01099 Dresden, Saxony, Germany — will introduce Foreign Ownership, Control, or Influence ("FOCI") over VPI within the meaning of the National Industrial Security Program Operating Manual ("NISPOM"), codified at 32 C.F.R. Part 117. Because VPI holds an active FCL, the introduction of FOCI must be mitigated through an approved FOCI mitigation instrument in order for VPI to maintain its clearance and continue performing on classified contracts.
The National Security Agreement designated NSA-2024-0019, currently under negotiation as part of the Committee on Foreign Investment in the United States ("CFIUS") review under Case No. CFIUS-023-07-3841, will function as the equivalent of a Special Security Agreement ("SSA") under the NISPOM. The NSA incorporates board governance provisions, facility access restrictions, a technology control plan, cybersecurity requirements, data segregation mandates, personnel continuity obligations, and third-party compliance monitoring that collectively satisfy — and in certain respects exceed — the requirements of a standalone SSA. The Defense Counterintelligence and Security Agency ("DCSA") has been participating in the CFIUS review as a co-lead and designated monitoring agency and is therefore familiar with the transaction and the proposed mitigation framework.
Based on our analysis, we reach the following key conclusions:
1. VPI's FCL can be maintained post-closing provided the FOCI mitigation measures embodied in the NSA are fully implemented prior to or contemporaneously with the consummation of the Acquisition.
2. DCSA must be notified and approve the FOCI mitigation instrument before the change in ownership is consummated. DCSA's approval of the NSA as the functional equivalent of an SSA is a precondition to FCL continuity.
3. Col. (Ret.) Bryce Hendrickson must be retained as FSO. His institutional knowledge of VPI's classified programs and his existing relationships with DCSA and sponsoring government agencies make his continued service essential to a smooth transition.
4. Coordination between the NSA provisions and DCSA FOCI requirements is essential to avoid duplicative or conflicting compliance obligations. Calderwood & Harkness will serve as the primary liaison between CFIUS monitoring agencies and DCSA throughout the transition process.
Several additional facts underscore the significance and complexity of this transition:
• VPI's primary cleared facility is located at 9200 Innovation Boulevard, Albuquerque, New Mexico 87113 — a 45,000-square-foot GaN-on-SiC (gallium nitride on silicon carbide) fabrication facility containing classified work areas in clean room Sections C-7 through C-12. VPI's corporate headquarters are located at 7400 Ridgeline Parkway, Colorado Springs, Colorado 80919.
• Of VPI's 486 total employees, 212 (approximately 43.6%) hold active U.S. government security clearances at the SECRET level or higher. These cleared personnel are essential to VPI's continued performance on classified contracts and represent a significant national security asset.
• VPI currently holds 14 active Department of Defense contracts (both prime contracts and subcontracts) with an aggregate remaining backlog of approximately $193 million. All 14 contracts require VPI to maintain an active FCL at the SECRET level or higher. Loss of VPI's FCL would result in contract default, potential termination for cause, debarment risk, and substantial damage to VPI's business value and the strategic rationale underlying the Acquisition.
This memorandum is organized as follows: Section II provides background on VPI's current FCL status, personnel, and classified contracts. Section III sets forth the applicable legal and regulatory framework. Section IV presents the FOCI analysis for HSAG. Section V details how the NSA provisions serve as SSA-equivalent FOCI mitigation. Section VI addresses DCSA coordination and notification requirements. Section VII discusses FSO retention and succession planning. Section VIII covers contracting agency notifications. Section IX identifies key risks and proposed mitigation strategies. Section X provides a detailed action item list and timeline. Section XI offers our conclusions and recommendations.
II. Background — VPI's Current Facility Security Clearance
A. FCL Status and History
Marlowe Asset Management Photonics Inc. was incorporated in the State of Delaware on February 14, 2009, by Dr. Nathan Trevorrow, a pioneer in gallium nitride semiconductor technology, and has been continuously organized and existing under Delaware law since that date. VPI was founded to commercialize Dr. Trevorrow's research in GaN-on-SiC high-electron-mobility transistor ("HEMT") technology for defense and commercial radio frequency ("RF") applications.
VPI first obtained its Facility Security Clearance in 2011 in connection with early-stage development contracts awarded by the U.S. Air Force Research Laboratory ("AFRL") at Kirtland Air Force Base, New Mexico. VPI has maintained an active FCL without interruption since that date. Concurrently with obtaining its FCL, VPI registered with the U.S. Department of State's Directorate of Defense Trade Controls ("DDTC") under the International Traffic in Arms Regulations ("ITAR"), 22 C.F.R. Parts 120–130, and has maintained its DDTC registration continuously since 2011 under Registration No. M-24817.
VPI's current FCL status and identifiers are as follows:
VPI's sponsoring agencies — the U.S. government agencies that have validated VPI's need for an FCL in connection with classified contract work — include the U.S. Army Program Executive Office, intelligence, Electronic Warfare & Sensors ("PEO IEW&S"), the U.S. Air Force Research Laboratory ("AFRL"), and the Missile Defense Agency ("MDA"). These sponsoring agencies have each independently determined that VPI requires access to classified information at the SECRET level or higher in order to perform on their respective contracts.
VPI's cleared facility is located at 9200 Innovation Boulevard, Albuquerque, New Mexico 87113. This facility comprises a 45,000-square-foot GaN-on-SiC fabrication plant that includes both unclassified production areas and classified work areas. The classified work areas are located in clean room Sections C-7 through C-12, which are subject to physical security controls including intrusion detection systems, access control mechanisms (biometric readers with two-factor authentication), closed-circuit video surveillance, and alarm monitoring by a DCSA-approved central monitoring station. These classified areas are inspected by DCSA on a regular basis, and VPI has maintained a satisfactory security rating in all DCSA vulnerability assessments conducted since the FCL was first granted.
B. Current Facility Security Officer
Col. (Ret.) Bryce Hendrickson, USAF, serves as VPI's Vice President, Government Programs and Facility Security Officer. Col. Hendrickson retired from the United States Air Force after a 26-year career that included assignments in signals intelligence, electronic warfare, and program management for classified acquisition programs. He joined VPI in 2011, shortly after the company obtained its FCL, and has served continuously as FSO since that date.
Col. Hendrickson holds an active TS/SCI (Top Secret / Sensitive Compartmented Information) security clearance. As FSO, he is responsible for all aspects of VPI's industrial security program, including:
• Personnel security: Processing security clearance applications, conducting initial and periodic reinvestigations, managing adverse information reporting, and maintaining the Joint Personnel Adjudication System ("JPAS") / Defense Information System for Security ("DISS") records for all 212 cleared employees.
• Physical security: Overseeing physical security measures at the Albuquerque cleared facility, including access controls, intrusion detection, visitor management, and classified material storage and destruction.
• FOCI matters: Serving as VPI's primary point of contact with DCSA on all matters related to foreign ownership, control, or influence, including the current FOCI mitigation process arising from the proposed Acquisition.
• Classified contract support: Coordinating with contracting agencies and prime contractors on DD Form 254 (Contract Security Classification Specification) requirements, classified visit authorizations, and classified information handling.
Col. Hendrickson's deep institutional knowledge of VPI's classified programs, his established relationships with DCSA field personnel and sponsoring agency security offices, and his dual role as VP of Government Programs and FSO make him an indispensable figure in the FCL transition process. As discussed in Section VII below, his retention is a critical element of this transition plan.
C. Cleared Personnel
Of VPI's 486 total employees, 212 hold active U.S. government security clearances. The breakdown by clearance level is as follows:
The following key VPI executives hold active security clearances:
• Dr. Nathan Trevorrow, Founder and Chief Executive Officer — holds an active TS/SCI clearance. Dr. Trevorrow is the technical visionary behind VPI's GaN-on-SiC HEMT technology and is personally involved in several classified programs, including the MDA T/R module development effort.
• Marissa Sung-Avila, President and Chief Operating Officer — holds an active SECRET clearance. Ms. Sung-Avila oversees day-to-day operations, including management of the Albuquerque fabrication facility.
• Col. (Ret.) Bryce Hendrickson, Vice President, Government Programs and Facility Security Officer — holds an active TS/SCI clearance, as described in Section II.B above.
• Adrienne Delacroix, Independent Director — holds an active SECRET clearance. Ms. Delacroix is a member of VPI's current Board of Directors and is proposed to serve as one of the three Security Board Members under the reconstituted board structure required by the NSA (discussed in Section V.A below). Her clearance will need to be upgraded to TS/SCI eligibility to serve effectively in this role.
The following key VPI and board-level personnel do not hold U.S. government security clearances and will need to be appropriately excluded from access to classified information under the FOCI mitigation framework:
• Derek Wainsborough, Chief Financial Officer — no clearance.
• Franklin Yee, Ridgecrest Capital Partners board designee — no clearance.
• Olivia Hartmann, Cascadian Ventures board designee — no clearance.
It is important to note that the individual security clearances held by VPI's 212 cleared employees are dependent upon VPI maintaining an active FCL. Under the NISPOM, individual personnel security clearances are granted to employees of cleared contractors and are predicated on the contractor's FCL remaining in good standing. If VPI's FCL were to be suspended or revoked, the individual clearances of all 212 employees would be placed in an inactive status, rendering them unable to access classified information or perform on classified contracts.
D. Active Government Contracts Requiring FCL
VPI currently holds 14 active Department of Defense contracts, consisting of both prime contracts and subcontracts, all of which require VPI to maintain an active FCL at the SECRET level or higher. The five largest contracts by remaining backlog are summarized below:
The remaining nine contracts have an aggregate remaining backlog of approximately $47.6 million, bringing VPI's total classified contract backlog to approximately $240.6 million. All 14 contracts contain DD Form 254 security classification specifications requiring VPI to maintain an FCL at the SECRET level. Several of the contracts (including the MDA and AFRL contracts) involve access to information classified at the TOP SECRET level or to Sensitive Compartmented Information, which is handled by personnel holding the appropriate clearances under the oversight of Col. Hendrickson.
The loss of VPI's FCL would have immediate and catastrophic consequences for these contracts. Specifically:
• VPI would be unable to access classified information necessary for contract performance, resulting in material breach of all 14 contracts.
• Contracting officers would be authorized to terminate the contracts for default under FAR 52.249-8 (Fixed-Price) or FAR 52.249-6 (Cost-Reimbursement), as applicable.
• VPI could face debarment or suspension proceedings under FAR 9.406 if the loss of FCL were attributable to the company's failure to maintain adequate FOCI mitigation.
• Prime contractors for which VPI serves as a subcontractor (notably Ironclad Defense Systems Inc.) could be exposed to their own performance risks, potentially giving rise to indemnification claims against VPI under the applicable subcontract terms.
For these reasons, maintaining VPI's FCL through the change-of-ownership process is a critical condition to the Acquisition and a threshold business objective for both HSAG and VPI.
III. Legal and Regulatory Framework
A. National Industrial Security Program (NISP) and NISPOM
The National Industrial Security Program ("NISP") was established by Executive Order 12829, signed by President George H.W. Bush on January 6, 1993, as amended. The NISP provides the single, integrated, cohesive industrial security program for the protection of classified information disclosed to or developed by contractors, licensees, or grantees of the U.S. government. Executive Order 12829 designated the Secretary of Defense as the Executive Agent for the NISP and charged the Executive Agent with issuing implementing regulations.
The NISP is implemented through the National Industrial Security Program Operating Manual ("NISPOM"), which was promulgated as a federal regulation at 32 C.F.R. Part 117, effective February 24, 2021 (replacing the prior DoD Manual 5220.22-M). The NISPOM establishes the requirements and procedures for safeguarding classified information that is disclosed to, or developed by, cleared contractor facilities. It governs all aspects of a contractor's security program, including facility security clearances, personnel security clearances, physical security, information security, and foreign ownership, control, or influence.
The Defense Counterintelligence and Security Agency ("DCSA") — formerly the Defense Security Service ("DSS") — serves as the cognizant security agency ("CSA") for industrial security under the NISP. DCSA is responsible for administering the FCL process, conducting facility security vulnerability assessments, adjudicating FOCI matters, and overseeing contractor compliance with the NISPOM. DCSA's Industrial Security Division maintains oversight of approximately 13,500 cleared contractor facilities nationwide.
Of particular relevance to the present transaction, NISPOM § 117.11 sets forth the requirements for FOCI determination and mitigation. Under § 117.11, a cleared contractor must report to DCSA any change in its ownership structure that may give rise to FOCI, and DCSA must determine whether the change requires FOCI mitigation and, if so, the appropriate type of mitigation instrument. A contractor that is found to be under FOCI may not hold an FCL unless the FOCI is effectively mitigated through an instrument approved by DCSA.
B. FOCI Mitigation Instruments Under NISPOM
FOCI is defined under the NISPOM as any situation in which a foreign interest has the power, direct or indirect, whether or not exercised, and whether or not exercisable through the ownership of a U.S. company's securities, by contractual arrangements or other means, to direct or decide matters affecting the management or operations of a cleared contractor in a manner that could:
(a) result in unauthorized access to classified information; or
(b) adversely affect the performance of classified contracts.
DCSA considers a range of factors in making its FOCI determination, including: the record of economic and government espionage by the country involved; the risk of unauthorized technology transfer; the type and sensitivity of the classified information involved; the nature and extent of the foreign interest; and the extent to which the cleared contractor's security procedures protect against unauthorized access.
When FOCI is identified, the NISPOM provides for several types of mitigation instruments, arranged in order of increasing restrictiveness:
1. Board Resolution. The least restrictive form of FOCI mitigation, a board resolution is appropriate when a foreign interest does not own voting equity in the cleared contractor but may otherwise be in a position to exert influence (e.g., through significant contract relationships or debt instruments). The board adopts a resolution acknowledging the foreign interest and committing to safeguard classified information.
2. Security Control Agreement ("SCA"). An SCA is used when a foreign interest is a minority owner (typically less than 50%) and imposes requirements on the contractor's board to ensure that the foreign interest cannot access classified information or unduly influence classified contract performance.
3. Special Security Agreement ("SSA"). An SSA is the most commonly used instrument for foreign acquisitions involving a majority or controlling ownership interest in a cleared contractor. Under an SSA, the foreign owner is permitted to retain certain business oversight of the cleared contractor — including receipt of financial information, participation in strategic planning for unclassified business lines, and appointment of non-cleared board members — while a Government Security Committee composed of cleared outside directors exercises exclusive authority over the contractor's classified activities, personnel security, and facility security. The SSA is the preferred instrument when the foreign owner is from an allied or friendly nation with which the United States maintains a bilateral industrial security agreement, as is the case with the Federal Republic of Germany.
4. Proxy Agreement. The most restrictive form of FOCI mitigation, a proxy agreement completely insulates the cleared contractor from the foreign owner. Under a proxy agreement, the foreign owner's voting rights are transferred to cleared U.S. citizen proxy holders, and the foreign owner is denied all access to the contractor's operations, including receipt of financial information beyond publicly available data. Proxy agreements are typically reserved for situations where the foreign owner is from a country that poses a heightened intelligence or espionage risk, or where the classified work involves the most sensitive categories of information (e.g., Special Access Programs, Sensitive Compartmented Information programs, or certain nuclear-related programs).
5. Voting Trust Agreement. Similar to a proxy agreement, a voting trust transfers the foreign owner's voting rights to cleared U.S. citizen trustees. Voting trusts are functionally equivalent to proxy agreements in terms of restrictiveness but differ in their legal structure.
For the present transaction, the SSA model is the appropriate framework because: (i) HSAG will acquire 100% ownership of VPI, requiring robust FOCI mitigation; (ii) Germany is a NATO ally with which the United States maintains a General Security of Information Agreement and a bilateral industrial security agreement, supporting use of the less restrictive SSA rather than a proxy agreement; (iii) VPI's classified work, while significant, is at the SECRET level (with some TS/SCI access handled on a program-specific basis), which falls within the scope of activities typically managed under an SSA; and (iv) the SSA structure permits HSAG to exercise legitimate business oversight of VPI's commercial operations while ensuring that classified activities remain under the exclusive control of cleared U.S. persons.
As discussed further in Section V, the NSA negotiated under the CFIUS process incorporates all substantive elements of an SSA and will serve as the equivalent FOCI mitigation instrument for DCSA purposes.
C. Interaction Between CFIUS NSA and DCSA FOCI Mitigation
Under established interagency practice, a CFIUS National Security Agreement can serve as the functional equivalent of a Special Security Agreement when it incorporates all necessary FOCI mitigation provisions required under the NISPOM. This approach has been employed in numerous prior transactions involving foreign acquisitions of cleared contractors and has the advantage of consolidating the FOCI mitigation obligations into a single, integrated compliance instrument rather than requiring the contractor to comply with both a CFIUS NSA and a separate DCSA-administered SSA.
The legal basis for this integrated approach derives from the coordination requirements built into the CFIUS process itself. When a proposed transaction involves a target company that holds an FCL, DCSA is routinely consulted during the CFIUS review and investigation phases. In the present transaction, DCSA has been designated as a co-lead monitoring agency under the NSA (NSA-2024-0019), alongside the Department of Defense's Office of the Under Secretary of Defense for Acquisition and Sustainment and the Department of Energy's Office of intelligence and Counterintelligence. DCSA has participated actively in the drafting and negotiation of the NSA's FOCI-related provisions and has had the opportunity to ensure that those provisions adequately address its industrial security concerns.
The NSA provisions regarding board governance (Government Security Committee, Security Board Members), facility access restrictions, technology control, data segregation, cybersecurity, and personnel security substantively overlap with, and in several respects exceed, the requirements of a standard SSA. The cross-reference table in Appendix 2 to this memorandum maps each NSA provision to the corresponding NISPOM SSA requirement, demonstrating comprehensive coverage.
The principal advantage of using the NSA as the sole FOCI mitigation instrument is the avoidance of duplicative compliance obligations. If VPI were required to maintain both the NSA and a separate SSA, it would face the administrative burden of complying with two potentially overlapping (and possibly inconsistent) instruments, each with its own reporting, audit, and governance requirements. By consolidating these obligations into the NSA, VPI can maintain a unified compliance framework, and DCSA can exercise its monitoring function through the NSA's compliance architecture rather than through a parallel SSA process.
It is important to note, however, that DCSA retains independent authority under the NISPOM and 32 C.F.R. Part 117 to suspend or revoke VPI's FCL regardless of the NSA's status. DCSA's acceptance of the NSA as the FOCI mitigation instrument does not divest DCSA of its statutory and regulatory authority to take independent action if it determines that FOCI is not being adequately mitigated. This residual authority operates as an additional safeguard and underscores the importance of maintaining a cooperative and transparent relationship with DCSA throughout the transition and post-closing period.
D. Regulatory Reporting Requirements
The NISPOM imposes specific reporting obligations on cleared contractors in connection with changes of ownership that may give rise to FOCI. These obligations are separate from, and in addition to, the CFIUS notification and review process under 50 U.S.C. § 4565 and 31 C.F.R. Part 800.
Under NISPOM § 117.11(d), a cleared contractor is required to report to DCSA any change in its ownership or control that may affect its FCL or introduce FOCI. This obligation applies regardless of whether the transaction has been submitted to CFIUS for review. The reporting obligation is triggered by the execution of a definitive agreement and must be fulfilled sufficiently in advance of closing to allow DCSA to review and approve the proposed FOCI mitigation framework.
In addition to the general reporting obligation, the following specific filings are required:
• Standard Form 328 (Certificate Pertaining to Foreign Interests). The SF-328 is the standard form used to disclose foreign ownership, control, or influence over a cleared contractor. VPI must update and file its SF-328 to reflect HSAG's 100% ownership through Halcyon US Holdings Inc. The updated SF-328 must be submitted to DCSA before the change of ownership is consummated.
• DCSA Industrial Security Letter Guidance. DCSA has issued periodic Industrial Security Letters ("ISLs") providing guidance on change-of-ownership reporting timelines and procedures. Under current DCSA guidance, cleared contractors are strongly encouraged to notify DCSA of a proposed change of ownership at least 30 days prior to the anticipated closing date, and preferably earlier. The 30-day advance notification period allows DCSA to conduct its review of the FOCI mitigation instrument and, where necessary, request supplemental information or modifications before the change of ownership becomes effective.
• Post-Closing Confirmation. Following the consummation of the change of ownership, the cleared contractor must submit a post-closing notification letter to DCSA confirming the effective date of the transaction, the FCL status, the identity of the FSO, and the status of the FOCI mitigation instrument.
These reporting requirements are discussed in greater detail in Section VI, which provides a step-by-step guide to the DCSA coordination and notification process.
IV. FOCI Analysis — Halcyon Semiconductor AG
A. Nature and Extent of Foreign Ownership
Following the consummation of the Acquisition, HSAG will own 100% of VPI's outstanding equity. The acquisition will be structured as a stock purchase through HSAG's wholly owned Delaware subsidiary, Halcyon US Holdings Inc. ("HUSHI"), which was formed on June 5, 2023, specifically for the purpose of serving as the U.S. acquisition vehicle. HUSHI is registered with the Delaware Division of Corporations and has a registered agent located at 160 Greentree Drive, Suite 101, Dover, Delaware 19904. HUSHI's Employer Identification Number is 93-2841067. HUSHI does not currently conduct any operations and has no employees, assets, or liabilities other than those related to the proposed Acquisition.
The interposition of HUSHI as the direct U.S. parent of VPI does not alter the FOCI analysis. DCSA looks through intermediate holding companies to the ultimate foreign parent when assessing the nature and extent of FOCI. Here, the ultimate foreign parent is HSAG, and the relevant FOCI analysis therefore focuses on HSAG's characteristics.
HSAG is a publicly traded Aktiengesellschaft (stock corporation) organized under the laws of the Federal Republic of Germany. The following table summarizes HSAG's key corporate and financial details:
HSAG's shares are widely held by institutional and retail investors, and no single shareholder holds more than 7% of HSAG's outstanding shares. There is no government ownership of HSAG, either by the German federal government, any German state (Land) government, or any other sovereign entity. This fact is significant because DCSA accords heightened scrutiny to FOCI situations involving government-controlled foreign entities.
HSAG's senior management team relevant to the Acquisition includes:
• Dr. Maximilian Ehrhardt, Chief Executive Officer (Vorstandsvorsitzender) — German citizen; no U.S. security clearance.
• Katarina Brückner, Chief Financial Officer (Finanzvorstand) — German citizen; no U.S. security clearance.
• Stefan Lohse, General Counsel (Chefjustitiar) — German and U.S. dual citizen; LL.M., Georgetown University Law Center; admitted to the bar in New York and Germany; no U.S. security clearance. Mr. Lohse is the recipient of this memorandum and is serving as HSAG's lead internal counsel for the Acquisition and CFIUS process.
B. Existing U.S. Operations
HSAG currently maintains a U.S. subsidiary, Halcyon US Inc. (EIN: 81-3056429), which operates a fabless semiconductor design center at 11501 Alterra Parkway, Suite 300, Austin, Texas 78758. Halcyon US Inc. employs approximately 320 persons and focuses on the design and development of commercial power management integrated circuits and analog/mixed-signal semiconductors for the automotive, industrial, and consumer electronics markets.
Critically, Halcyon US Inc. does not perform any classified work and does not hold a Facility Security Clearance. It has no history of involvement with classified or export-controlled defense programs, and it has not previously been subject to FOCI mitigation measures. The Austin design center does not handle ITAR-controlled technical data or EAR-controlled defense articles, and its operations are entirely within the commercial semiconductor space.
HSAG's lack of prior FOCI mitigation history means that neither HSAG nor its existing U.S. subsidiary has an established track record with DCSA. While this is not inherently problematic, it does mean that DCSA will be evaluating HSAG as a first-time foreign owner of a cleared contractor. Calderwood & Harkness will work proactively with DCSA to ensure that HSAG's good-faith commitment to FOCI mitigation is clearly communicated and that the comprehensive nature of the NSA framework provides DCSA with the assurances it requires.
C. China Operations Consideration
HSAG operates a Chinese subsidiary, Halcyon Semiconductor (Shanghai) Co., Ltd. ("Halcyon Shanghai"), which generated revenue of approximately $81.4 million in FY2022, representing approximately 1.3% of HSAG's consolidated global revenue. Halcyon Shanghai's activities are limited to the design and sale of consumer-grade power management integrated circuits for the Chinese domestic market. These products are standard commercial-off-the-shelf components used in consumer electronics devices (smartphones, tablets, and personal computing devices) and do not involve GaN technology, defense-related semiconductors, dual-use components, or any products related to VPI's product lines.
DCSA will likely subject Halcyon Shanghai to heightened scrutiny as part of its FOCI analysis. The presence of a Chinese subsidiary in the corporate family of a foreign acquirer of a cleared contractor has historically been a focal point for DCSA, given the U.S. government's well-documented concerns about Chinese economic espionage, technology transfer, and intelligence collection targeting U.S. defense and dual-use technology. CFIUS has already examined HSAG's China operations in detail during the review and investigation phases. In response to the CFIUS Staff's First Request for Information ("RFI"), HSAG submitted a Supplemental Exhibit on China Operations on August 18, 2023, which included detailed descriptions of Halcyon Shanghai's business activities, product lines, key customers, supply chain relationships, research and development activities, cybersecurity infrastructure, and personnel. The CFIUS Staff, including DCSA representatives, reviewed this submission and incorporated appropriate mitigation provisions into the NSA.
The NSA's provisions regarding data segregation (Annex D — Cybersecurity Requirements), technology control (Annex B — Technology Control Plan), and facility access restrictions (Annex F — Facility Access Procedures) collectively address DCSA's concerns about the potential for classified or controlled unclassified information to flow from VPI to any non-U.S. HSAG operation, including Halcyon Shanghai. Specifically:
• VPI's information technology systems must be physically and logically separated from the HSAG global network, with no shared cloud infrastructure, no common email domains, and no shared identity management systems.
• The Technology Control Plan prohibits the transfer of VPI technical data — including ITAR Category XI(a)(3) defense articles and EAR-controlled items — to any non-U.S. person without prior U.S. government authorization.
• Facility access procedures prohibit HSAG personnel (including Halcyon Shanghai employees) from accessing VPI classified areas without prior DCSA and GSC approval, which would be granted only in extraordinary circumstances and subject to rigorous conditions.
In our assessment, these mitigation measures adequately address the concerns associated with HSAG's China operations. We anticipate that DCSA will focus on this issue during its review and may request additional assurances or documentation, which we will be prepared to provide.
D. FOCI Determination
Based on the foregoing analysis, the conclusion is unambiguous: the Acquisition creates a clear FOCI situation. HSAG, a German corporation, will acquire 100% of VPI's equity through HUSHI, giving HSAG the direct and immediate power to direct or decide all matters affecting VPI's management and operations. This is the paradigmatic case of FOCI requiring mitigation under the NISPOM.
FOCI mitigation is required in order for VPI to maintain its FCL following the consummation of the Acquisition. Without an approved FOCI mitigation instrument in place, DCSA would be obligated to suspend or revoke VPI's FCL upon the effective date of the change of ownership.
The recommended mitigation instrument is SSA-equivalent treatment through the NSA (NSA-2024-0019). As described in detail in Section V below, the NSA incorporates all substantive elements of a Special Security Agreement, including Government Security Committee governance, facility access restrictions, technology control, cybersecurity and data segregation, personnel continuity, and third-party compliance monitoring. DCSA has been actively involved in the development of these provisions through its participation in the CFIUS review process and its designation as a co-monitoring agency under the NSA.
The selection of the SSA model (rather than the more restrictive Proxy Agreement model) is appropriate and supportable because:
1. Allied Nation Status. Germany is a member of the North Atlantic Treaty Organization ("NATO") and is a signatory to bilateral industrial security agreements with the United States, including the General Security of Information Agreement ("GSOIA") between the United States and Germany, which provides for the reciprocal protection of classified information. DCSA's established practice is to permit SSA (rather than proxy) arrangements when the foreign owner is from a NATO ally or other friendly nation, absent exceptional circumstances.
2. No Government Ownership. HSAG is a publicly traded, widely held corporation with no government ownership. The absence of government ownership eliminates one of the primary concerns that might otherwise support the use of a more restrictive mitigation instrument.
3. Classification Level. VPI's FCL is at the SECRET level, and the majority of VPI's classified work involves SECRET-level information. While some VPI personnel hold TS/SCI clearances for access to specific programs, the overall classification profile of VPI's work is consistent with the SSA model.
4. Nature of Programs. VPI's classified work involves the development and fabrication of GaN-based RF semiconductor components for defense radar and electronic warfare systems. While this technology is sensitive and controlled, it does not fall within the categories of Special Access Programs or Restricted Data that would typically require a proxy arrangement.
V. NSA Provisions Serving as SSA-Equivalent FOCI Mitigation
This section describes the key provisions of the NSA (NSA-2024-0019) that serve as the functional equivalent of a Special Security Agreement for FOCI mitigation purposes under the NISPOM. For each provision, we identify the corresponding SSA requirement under the NISPOM and explain how the NSA provision satisfies or exceeds that requirement.
A. Board Governance — Government Security Committee
The NSA requires the reconstitution of VPI's Board of Directors following the consummation of the Acquisition. Under the NSA's governance provisions, the reconstituted VPI board will consist of five members:
• Three Security Board Members: Each Security Board Member must be a U.S. citizen who holds, or is eligible for and willing to obtain, a security clearance at the TS/SCI level. At least one Security Board Member must be designated as the independent Security Director — an individual who is independent of both VPI management and HSAG and who serves as the primary liaison with DCSA and the CFIUS monitoring agencies on all matters related to FOCI mitigation and classified program oversight. Security Board Members may not be employees, officers, directors, or agents of HSAG or any non-U.S. affiliate of HSAG.
• Two HSAG Designees: HSAG is permitted to designate two members to the VPI board who will represent HSAG's ownership interests. These HSAG designees may not hold or access classified information and may not participate in board discussions or decisions involving classified programs, personnel security matters, or other matters within the exclusive jurisdiction of the Government Security Committee.
The three Security Board Members will constitute the Government Security Committee ("GSC"). The GSC will have exclusive authority over all aspects of VPI's classified and ITAR-controlled programs, including:
(a) All classified contract performance, including negotiation, execution, modification, and termination of classified contracts and subcontracts;
(b) All personnel security matters, including the processing of security clearance applications, adverse information reporting, and decisions regarding the employment or termination of cleared personnel;
(c) All physical security matters at VPI's cleared facility, including access controls, intrusion detection, classified material handling, and facility security upgrades;
(d) Oversight of the Facility Security Officer and the authority to appoint or remove the FSO, subject to DCSA notification;
(e) Oversight of VPI's ITAR compliance program and DDTC registration;
(f) Oversight of the Technology Control Plan (NSA Annex B) and all export control matters; and
(g) All communications with DCSA, sponsoring agencies, and other U.S. government entities on matters related to VPI's FCL, FOCI mitigation, and classified programs.
The proposed Security Board Members are:
1. Col. (Ret.) Bryce Hendrickson — TS/SCI clearance (active). Col. Hendrickson will continue to serve as FSO and VP, Government Programs in addition to his role as a Security Board Member. His institutional knowledge and existing DCSA relationships make him an essential member of the GSC.
2. Adrienne Delacroix — SECRET clearance (active); upgrade to TS/SCI eligibility to be initiated. Ms. Delacroix is a current independent director of VPI and has served on VPI's board since 2017. Her familiarity with VPI's operations and governance structure, combined with her existing clearance, make her a strong candidate for the GSC. The clearance upgrade process should be initiated immediately so that her TS/SCI eligibility is in place by the time the GSC becomes operational.
3. Independent Security Director (To Be Identified). The NSA requires the appointment of an independent Security Director who is not affiliated with either VPI or HSAG. Calderwood & Harkness is currently assisting VPI in identifying suitable candidates. The candidate must be a U.S. citizen with prior experience in industrial security, defense contracting, or national security, and must hold or be eligible for a TS/SCI clearance. The proposed candidate must be submitted to both CFIUS and DCSA for approval before the GSC is constituted.
The GSC's charter is set forth in NSA Annex C — Governance Provisions & Security Board Charter. The charter defines the GSC's authority, quorum requirements (two of three members), meeting frequency (at least quarterly, with additional meetings as needed), record-keeping requirements, and reporting obligations to DCSA and the CFIUS monitoring agencies.
SSA Comparison: This board governance structure mirrors the standard SSA requirement for an outside director/officer arrangement and Government Security Committee. Under a standard SSA, the cleared contractor's board must include cleared outside directors who constitute a Government Security Committee with exclusive authority over classified programs. The NSA's governance provisions satisfy this requirement in full and, through the additional requirement of an independent Security Director approved by CFIUS and DCSA, provide an additional layer of independent oversight beyond what a standard SSA typically requires.
B. Facility Access Restrictions
NSA Annex F — Facility Access Procedures establishes rigorous restrictions on the access of HSAG personnel to VPI's facilities. The key provisions are as follows:
• Classified Facilities. HSAG personnel, including HSAG directors, officers, employees, agents, and consultants, may not access VPI's classified facilities — specifically, the Albuquerque fabrication facility's clean room Sections C-7 through C-12 and any other areas designated as classified work areas — without prior written approval from both DCSA and the GSC. Such approval will be granted only in extraordinary circumstances and subject to conditions that may include escort requirements, scope limitations, and debriefing obligations.
• Unclassified Facilities. HSAG personnel may access VPI's unclassified areas, including the Colorado Springs headquarters and unclassified portions of the Albuquerque fabrication facility, upon at least five business days' advance written notice to the GSC and the FSO. All visits to unclassified areas must be accompanied by an escort designated by the FSO. Visitor logs must be maintained and made available to DCSA upon request.
• Prohibited Items. HSAG personnel visiting any VPI facility are prohibited from bringing into the facility any electronic recording devices, cameras, removable data storage media, or personal computing equipment, unless specifically authorized in writing by the FSO. All personal electronic devices must be stored in designated secure lockers at the facility entrance prior to entry.
• Foreign National Visitors. HSAG personnel who are foreign nationals (including German citizens) are subject to additional restrictions under the NISPOM's foreign national visitor provisions, including the requirement for a Foreign Visit Request processed through the Defense Threat Reduction Agency ("DTRA") Visit Authorization System.
These facility access restrictions satisfy the NISPOM requirement that foreign owners be denied unauthorized access to classified information and controlled areas within cleared facilities. The provisions go beyond a standard SSA's requirements by extending access restrictions to unclassified areas and imposing advance notice and escort requirements even for visits to non-classified portions of VPI's facilities.
C. Technology Control Plan
NSA Annex B — Technology Control Plan ("TCP") establishes comprehensive controls on the transfer of VPI's technology and technical data. The TCP operates in conjunction with VPI's existing ITAR and EAR compliance program and supplements the restrictions imposed by those regulatory regimes.
The TCP prohibits the transfer of VPI technical data to any non-U.S. person without prior U.S. government authorization. The term "VPI technical data" is broadly defined to include:
(a) Defense articles controlled under ITAR Category XI(a)(3), which encompasses certain semiconductor devices and electronic components designed or modified for defense applications;
(b) Dual-use items controlled under EAR Export Control Classification Numbers 3A001 (certain microprocessor microcircuits, microcomputer microcircuits, and microcontroller microcircuits), 3A991 (specific electronic components not controlled by 3A001), and 3E001 (technology for the development or production of items controlled by 3A001); and
(c) Any other VPI technical data, including trade secrets, proprietary manufacturing processes, and engineering data, that is generated in connection with classified or export-controlled programs.
The TCP requires VPI to maintain a Technology Control Officer ("TCO") — a U.S. citizen holding an active security clearance — who is responsible for implementing and monitoring compliance with the TCP. The TCO reports to the GSC and coordinates with the FSO on all matters involving the intersection of export controls and personnel/facility security.
The TCP integrates with VPI's existing DDTC registration (No. M-24817) and EAR compliance program. VPI will continue to process all export licenses through DDTC (for ITAR items) and the Bureau of Industry and Security ("BIS") (for EAR items) in accordance with existing procedures, with the additional oversight layer provided by the TCO and the GSC.
SSA Comparison: The TCP is equivalent to the technology control plan typically required under a standalone SSA. Under a standard SSA, the cleared contractor must develop and implement a technology control plan that prevents the unauthorized transfer of classified and export-controlled information to the foreign owner. The NSA's TCP satisfies this requirement and provides additional specificity regarding the categories of controlled items, the role of the TCO, and the integration with existing export control compliance programs.
D. Data Segregation and Cybersecurity
NSA Annex D — Cybersecurity Requirements establishes mandatory cybersecurity and data segregation measures designed to prevent electronic access to VPI's classified and controlled unclassified information by HSAG or any non-U.S. entity within the HSAG corporate family.
The key provisions include:
• NIST SP 800-171 Compliance. VPI must maintain compliance with the National Institute of Standards and Technology Special Publication 800-171, "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations," as required under DFARS 252.204-7012 and the NISPOM. VPI's compliance status must be documented in an annual System Security Plan and Plan of Action & Milestones, submitted to DCSA and the third-party compliance monitor.
• Network Separation. VPI's information technology systems must be physically and logically separated from the HSAG global network. This includes: (i) no shared local area networks, wide area networks, or virtual private networks between VPI and HSAG; (ii) no shared cloud infrastructure, including no shared tenancies in public or private cloud environments; (iii) no shared email systems or collaboration platforms; and (iv) no shared identity and access management systems. VPI must maintain its own independent IT infrastructure, managed by cleared U.S. person IT administrators under the oversight of the FSO.
• Annual Penetration Testing. VPI must engage a DCSA-approved third-party cybersecurity firm to conduct annual penetration testing of VPI's IT infrastructure. The scope of penetration testing must include external and internal network assessments, social engineering assessments, and wireless security assessments. The results of each penetration test must be reported to DCSA and the third-party compliance monitor within 30 days of completion.
• Incident Reporting. VPI must report any cybersecurity incident — including any unauthorized access to, or exfiltration of, classified or controlled unclassified information — to DCSA within 72 hours of detection. VPI must also notify the CFIUS monitoring agencies and the third-party compliance monitor of any such incident within the same 72-hour window.
These cybersecurity requirements directly address DCSA's concerns about electronic access to classified and controlled unclassified information by a foreign parent. In the modern threat environment, electronic exploitation of corporate networks is a primary vector for unauthorized access to classified information, and DCSA places significant emphasis on network separation and cybersecurity as essential components of FOCI mitigation. The NSA's cybersecurity provisions are comprehensive and exceed the requirements typically imposed under a standalone SSA, which may address cybersecurity in more general terms.
E. Personnel Security and Continuity
The NSA imposes personnel security and continuity requirements that are designed to ensure stability and expertise in VPI's security program during and after the ownership transition. The key provisions are as follows:
• Key Personnel Retention. The following VPI key personnel must remain employed by VPI for a minimum of 24 months following the closing date, or their replacements must be approved by the GSC and DCSA: (i) Dr. Nathan Trevorrow, Founder and CEO; (ii) Marissa Sung-Avila, President and COO; and (iii) Col. (Ret.) Bryce Hendrickson, VP Government Programs and FSO. The 24-month retention period is intended to ensure continuity of leadership during the critical post-closing integration period and to provide DCSA with assurance that the individuals responsible for VPI's classified programs and security apparatus will remain in place.
• FSO Retention. Col. Hendrickson's continued service as FSO is specifically addressed in the NSA as a condition of FOCI mitigation. The retention of the FSO is critical for FCL continuity because the FSO is the individual responsible for day-to-day implementation of the FOCI mitigation measures, and any change in the FSO requires DCSA notification and approval. Col. Hendrickson's institutional knowledge of VPI's classified programs, his established relationships with DCSA field personnel, and his familiarity with the security requirements of VPI's 14 active classified contracts make him uniquely qualified to serve as FSO during the transition period.
• Cleared Employee Continuity. All 212 of VPI's cleared employees will continue under VPI's existing security program following the change in ownership. No changes to individual security clearances result from the change in ownership itself, provided that VPI's FCL is maintained. The individual clearance records of all 212 employees will remain in DISS, and their clearance status will be unaffected so long as VPI's FCL remains active and DCSA has approved the FOCI mitigation framework.
• Restrictions on Personnel Actions. HSAG may not, without the prior approval of the GSC, terminate, reassign, or materially alter the responsibilities of any cleared VPI employee whose duties involve classified programs or facility security.
F. Third-Party Compliance Monitoring
The NSA requires the appointment of an independent third-party compliance monitor to oversee VPI's compliance with the NSA's FOCI mitigation provisions. Whitmore Compliance Group LLC ("WCG") has been selected and approved for this role. The key details of the monitoring arrangement are as follows:
WCG will conduct annual compliance audits covering all aspects of VPI's FOCI mitigation obligations under the NSA, including:
(a) Board governance and GSC functioning, including review of GSC meeting minutes, resolutions, and reports;
(b) Facility access controls and visitor log compliance;
(c) Technology Control Plan implementation, including review of export license applications, technology transfer records, and TCO reports;
(d) Cybersecurity and data segregation, including review of NIST SP 800-171 compliance documentation, penetration test results, and incident reports;
(e) Personnel security and continuity, including verification of key personnel retention and cleared employee status; and
(f) Any other matters identified by DCSA or the CFIUS monitoring agencies as requiring review.
WCG will report directly to the CFIUS monitoring agencies, including DCSA, and will have unrestricted access to VPI's facilities, records, and personnel for the purpose of conducting its audits. WCG's audit reports will be shared with the GSC and, at DCSA's discretion, with VPI's FSO.
SSA Comparison: The role of the third-party compliance monitor is equivalent to, and in significant respects exceeds, the role of an outside director or compliance officer who monitors FOCI mitigation under a standalone SSA. Under a standard SSA, the Government Security Committee and the outside directors provide the primary oversight mechanism, supplemented by DCSA's own periodic inspections. The NSA's third-party monitoring requirement adds an independent, external compliance layer that provides continuous professional oversight beyond what a standard SSA requires. The monitor's TS/SCI clearance and FBI counterintelligence background ensure that the monitoring function is performed by an individual with deep expertise in the national security and counterintelligence dimensions of FOCI mitigation.
G. Pre-Notification of Material Changes
The NSA requires HSAG to notify CFIUS (including DCSA) at least 30 days before any material change to VPI's business, corporate structure, or operations. Material changes subject to this pre-notification requirement include, but are not limited to:
(a) Any divestiture, sale, transfer, or reorganization of VPI or any significant portion of VPI's assets or business lines;
(b) Any new foreign subcontracting arrangement involving VPI's classified or export-controlled programs;
(c) Any change to the identity or composition of VPI's cleared personnel, including the departure or reassignment of any of the three key personnel subject to the 24-month retention requirement;
(d) Any change to VPI's board composition, including the replacement of any Security Board Member or HSAG designee;
(e) Any change to VPI's facility security arrangements, including the relocation of classified work areas, the establishment of new cleared facilities, or material modifications to physical security controls; and
(f) Any change to VPI's DDTC registration status or export control compliance program.
This pre-notification requirement parallels the NISPOM's requirement that cleared contractors report to DCSA any changes that may affect the FCL or FOCI status. By incorporating this obligation into the NSA, the provision ensures that DCSA receives advance notice of material changes through both the CFIUS monitoring framework and VPI's direct NISPOM reporting obligations.
H. Penalty Provisions
The NSA includes robust enforcement provisions designed to ensure compliance with its FOCI mitigation requirements. Under NSA § 12.3, violations of the NSA may result in:
• Civil Penalties. Civil monetary penalties of up to $250,000 per violation per day for each day that the violation continues. Penalties may be imposed by the CFIUS monitoring agencies following notice and an opportunity to respond.
• Injunctive Relief. The U.S. government may seek injunctive relief in federal district court to compel compliance with the NSA's provisions, to prevent further violations, or to protect classified information from unauthorized access.
• Mandated Divestiture. In the event of a material or persistent violation that cannot be adequately remedied, the President may order HSAG to divest its ownership interest in VPI pursuant to the authority granted under Section 721 of the Defense Production Act of 1950, as amended (50 U.S.C. § 4565).
These penalty provisions operate in addition to DCSA's independent authority under the NISPOM to suspend or revoke VPI's FCL for FOCI mitigation failures. The combination of NSA penalties and DCSA's FCL authority creates a multi-layered enforcement framework that provides strong incentives for full and continuous compliance.