ANNEX B — TECHNOLOGY CONTROL PLAN
Annex B to the National Security Agreement Reference: NSA-2024-0019
Effective Date: January 19, 2024 (Date of Execution of the National Security Agreement)
PARTIES TO THIS TECHNOLOGY CONTROL PLAN
Halcyon Semiconductor Aktiengesellschaft ("HSAG") Industriestraße 44, 01099 Dresden, Saxony, Germany
Halcyon US Holdings Inc. ("Halcyon US Holdings") 160 Greentree Drive, Suite 101, Dover, DE 19904
Marlowe Asset Management Photonics Inc. ("VPI") 7400 Ridgeline Parkway, Colorado Springs, CO 80919
The United States of America, acting through:
The U.S. Department of the Treasury
The U.S. Department of Defense
The U.S. Department of Energy
(collectively, the "U.S. Government Parties")
Monitoring Agency: Defense Counterintelligence and Security Agency ("DCSA")
Third-Party Compliance Monitor: Whitmore Compliance Group LLC, 1300 Crystal Drive, Suite 710, Arlington, VA 22202; Principal: Gerald Whitmore
Right-click to update Table of Contents
SECTION 1 — PURPOSE AND SCOPE
1.1 Purpose
This Technology Control Plan ("TCP" or "Plan") is adopted pursuant to Section 6.2 of the National Security Agreement, Reference NSA-2024-0019 (the "NSA"), executed on January 19, 2024, by and among HSAG, Halcyon US Holdings, VPI, and the U.S. Government Parties. The TCP constitutes an integral component of the NSA and is binding upon all Parties to the NSA to the same extent and with the same force and effect as the NSA itself.
The primary objective of this TCP is to establish comprehensive administrative, physical, technical, and procedural safeguards designed to protect Controlled Technical Data, Classified Information, and other sensitive information and technology maintained by VPI from unauthorized access, use, disclosure, or transfer to Non-U.S. Persons, including HSAG Personnel who are not authorized recipients of such information. The TCP is intended to ensure that the acquisition of VPI by HSAG does not result in any compromise of U.S. national security through the unauthorized transfer or disclosure of controlled information, technology, or intellectual property.
This TCP is further designed to ensure VPI's continued and uninterrupted compliance with all applicable U.S. export control laws and regulations, including, without limitation, the International Traffic in Arms Regulations ("ITAR"), codified at 22 C.F.R. Parts 120 through 130, as administered by the Directorate of Defense Trade Controls ("DDTC") of the U.S. Department of State, and the Export Administration Regulations ("EAR"), codified at 15 C.F.R. Parts 730 through 774, as administered by the Bureau of Industry and Security ("BIS") of the U.S. Department of Commerce. Compliance with these regulations is essential to VPI's ability to continue performing classified and controlled work for the U.S. Department of Defense and other U.S. government customers.
In establishing these safeguards, this TCP seeks to achieve the appropriate balance between the protection of national security interests and the enablement of legitimate business operations and parent-subsidiary information exchange for non-controlled purposes. Nothing in this TCP is intended to prevent or restrict the flow of Permitted Business Information between VPI and HSAG to the extent necessary for HSAG to exercise its legitimate rights as the ultimate parent company of VPI, provided that such information exchange occurs in strict compliance with the procedures and limitations set forth herein.
1.2 Scope of Application
This TCP applies to all VPI operations, facilities, employees, contractors, consultants, and agents, wherever located. The obligations and restrictions set forth herein are binding upon each such individual and entity to the fullest extent of their involvement with VPI's controlled information, technology, and facilities.
This TCP further applies to all HSAG entities worldwide, including, without limitation:
(a) Halcyon Semiconductor Aktiengesellschaft, Industriestraße 44, 01099 Dresden, Saxony, Germany, and all subsidiaries, affiliates, divisions, and controlled entities thereof;
(b) Halcyon US Holdings Inc., 160 Greentree Drive, Suite 101, Dover, DE 19904, as the direct U.S. holding company of VPI;
(c) Halcyon US Inc., 11501 Alterra Parkway, Suite 300, Austin, TX 78758 (EIN 81-3056429), as an affiliated U.S. operating entity of HSAG; and
(d) Any other HSAG subsidiary, affiliate, joint venture partner, or associated entity, whether existing as of the Effective Date or established thereafter.
This TCP covers the following VPI facilities:
(a) VPI Corporate Headquarters: 7400 Ridgeline Parkway, Colorado Springs, CO 80919, which serves as VPI's principal administrative, engineering, and management office; and
(b) VPI Controlled Facility (Fabrication Facility): 9200 Innovation Boulevard, Albuquerque, NM 87113, a 45,000-square-foot gallium nitride on silicon carbide (GaN-on-SiC) semiconductor fabrication facility. This facility holds a Facility Security Clearance at the SECRET level, is assigned CAGE Code 7VK92, and contains classified processing areas designated as Sections C-7 through C-12.
This TCP encompasses all VPI technical data, technology, software, and information subject to U.S. export controls, including, without limitation, items and technical data controlled under ITAR Category XI(a)(3) of the United States Munitions List ("USML"), items classified under EAR Export Control Classification Numbers ("ECCNs") 3A001, 3A991, and 3E001, and any other applicable USML categories or ECCNs that may apply to VPI's current or future products, technology, or technical data.
This TCP further encompasses VPI's intellectual property portfolio, consisting of:
(a) Forty-seven (47) granted U.S. patents;
(b) Twelve (12) pending U.S. patent applications; and
(c) Thirty-one (31) registered internal trade secrets relating primarily to proprietary GaN epitaxial recipes and die-level reliability screening processes.
This TCP applies to all fourteen (14) active U.S. Department of Defense contracts (prime contracts and subcontracts), which carry an aggregate contract backlog of approximately one hundred ninety-three million dollars ($193,000,000) as of the Effective Date, and to any future U.S. government contracts entered into by VPI during the term of this TCP.
1.3 Relationship to Other NSA Provisions
This TCP operates in conjunction with, and is intended to complement, the following additional annexes to the NSA:
(a) NSA Annex C — Governance Provisions and Security Board Charter, which establishes the composition, authority, and responsibilities of the Government Security Committee and the VPI Board of Directors;
(b) NSA Annex D — Cybersecurity Requirements, which establishes the technical cybersecurity standards and protocols applicable to VPI's information technology systems;
(c) NSA Annex F — Facility Access Procedures, which establishes the detailed procedures governing physical access to VPI facilities by HSAG Personnel and other non-VPI visitors; and
(d) All other annexes, exhibits, and schedules to the NSA as may be relevant to the subject matter of this TCP.
In the event of any conflict or inconsistency between the provisions of this TCP and any other provision of the NSA or its annexes, the more restrictive provision shall control and take precedence in all cases. The Parties acknowledge that the protection of national security interests is the paramount objective of the NSA and this TCP, and any ambiguity shall be resolved in favor of greater protection of Classified Information, Controlled Technical Data, and other sensitive information.
Nothing in this TCP shall be construed to supersede, modify, or diminish any obligations arising under existing U.S. law, regulation, executive order, or U.S. government contract provision. To the extent that any applicable law, regulation, or contract provision imposes requirements more stringent than those set forth herein, such more stringent requirements shall apply and shall be deemed incorporated into this TCP by reference.
SECTION 2 — DEFINITIONS
2.1 Incorporation of NSA Annex A Definitions
All capitalized terms used in this TCP that are not separately defined herein shall have the meanings ascribed to them in NSA Annex A — Definitions, which is incorporated herein by reference. In the event of any conflict between a definition set forth in NSA Annex A and a definition set forth in this Section 2, the definition set forth in this Section 2 shall control for purposes of this TCP.
2.2 TCP-Specific Definitions
For purposes of this TCP, the following terms shall have the meanings set forth below:
"Classified Information" means any information that has been determined, pursuant to Executive Order 13526 (or any successor or predecessor executive order), to require protection against unauthorized disclosure in the interest of national security, and that has been marked or designated as such in accordance with applicable classification guidance. As of the Effective Date, VPI holds a Facility Security Clearance at the SECRET level, administered by DCSA, and two hundred twelve (212) of VPI's four hundred eighty-six (486) employees hold active U.S. government security clearances at various levels. Classified Information includes, without limitation, all information marked as CONFIDENTIAL, SECRET, or TOP SECRET, as well as any Sensitive Compartmented Information ("SCI") or Special Access Program ("SAP") information to which VPI or its personnel may have access.
"Controlled Technical Data" means any technical data, technology, software, source code, blueprints, specifications, drawings, manufacturing processes, test procedures, or other technical information that is subject to export controls under the ITAR (22 C.F.R. Parts 120 through 130) or the EAR (15 C.F.R. Parts 730 through 774). This includes, without limitation, technical data relating to defense articles classified under ITAR Category XI(a)(3) of the USML, and technology and items classified under EAR ECCNs 3A001, 3A991, and 3E001. Controlled Technical Data also includes Controlled Unclassified Information ("CUI") as defined in 32 C.F.R. Part 2002 and marked or designated in accordance with applicable CUI guidance.
"Defense Article" means any item or technical data designated in 22 C.F.R. § 121.1 (the United States Munitions List), as further defined in 22 C.F.R. § 120.6. For purposes of this TCP, Defense Articles include VPI's GaN power amplifier chips and associated technical data classified under USML Category XI(a)(3), which covers electronic equipment specifically designed, modified, or configured for military applications, including certain microwave and millimeter-wave semiconductor devices and modules.
"Dual-Use Items" means commodities, software, and technology that have both commercial and military or proliferation applications and that are controlled under the EAR. For purposes of this TCP, Dual-Use Items include VPI items classified under ECCNs 3A001 (certain microwave and millimeter-wave semiconductor devices and components), 3A991 (electronic devices and components not controlled by 3A001), and 3E001 (technology for the development or production of items controlled by 3A001), as well as any other EAR-controlled items produced, maintained, or used by VPI.
"Export" has the meaning set forth in the ITAR at 22 C.F.R. § 120.17 and in the EAR at 15 C.F.R. § 734.13, as applicable. For purposes of this TCP, "Export" includes, without limitation, any actual shipment or transfer of a defense article or controlled item out of the United States, any disclosure or transfer of technical data or technology to a Non-U.S. Person, whether within or outside the United States (commonly referred to as a "deemed export"), and any release of technology or source code to a Non-U.S. Person, including through visual inspection, oral exchange, or application of personal knowledge or technical experience acquired in the United States.
"Government Security Committee" or "GSC" means the committee established under NSA Annex C, composed of the three Security Board Members appointed to VPI's reconstituted Board of Directors: Col. (Ret.) Bryce Hendrickson, Adrienne Delacroix, and the independent Security Director to be appointed pursuant to Section 3.4 of NSA Annex C. The GSC has authority over all matters relating to VPI's classified and controlled operations, export compliance, facility security, and TCP implementation.
"HSAG Personnel" means any employee, officer, director, agent, consultant, contractor, secondee, or other representative of HSAG, Halcyon US Holdings Inc., Halcyon US Inc., or any other HSAG subsidiary, affiliate, or associated entity worldwide, other than individuals who are employees of VPI. For the avoidance of doubt, HSAG Personnel includes the two HSAG-designated members of VPI's Board of Directors, but does not include the three Security Board Members (GSC members) or VPI's independent directors.
"Non-U.S. Person" means any natural person who is not a "U.S. person" as that term is defined in the ITAR at 22 C.F.R. § 120.15 and in the EAR at 15 C.F.R. § 772.1. A Non-U.S. Person includes any foreign national, foreign government, foreign governmental entity, foreign political party, international organization, or foreign corporation, business association, partnership, trust, society, or any other foreign entity or group that is not incorporated or organized to do business in the United States, as well as any person known to be acting as an agent, representative, or employee of a foreign person. For purposes of this TCP, HSAG officers and employees who are not U.S. citizens or lawful permanent residents are Non-U.S. Persons, including, without limitation, Dr. Maximilian Ehrhardt (citizen of the Federal Republic of Germany, CEO/Vorstandsvorsitzender of HSAG), Katarina Brückner (citizen of the Federal Republic of Germany, CFO/Finanzvorstand of HSAG), and all other non-U.S. HSAG employees and agents.
"Permitted Business Information" means non-controlled business, financial, and administrative information that may be shared between VPI and HSAG in accordance with the procedures and limitations set forth in Section 5 of this TCP. The scope of Permitted Business Information is defined in Section 5.1.
"Technology Control Officer" or "TCO" means the individual designated by VPI, in accordance with Section 8 of this TCP, with day-to-day responsibility for TCP implementation, administration, and compliance monitoring. The TCO reports to the Government Security Committee.
"Third-Party Monitor" or "Monitor" means Whitmore Compliance Group LLC, a limited liability company organized under the laws of the Commonwealth of Virginia, with offices at 1300 Crystal Drive, Suite 710, Arlington, VA 22202. The Third-Party Monitor is the independent compliance monitor appointed under Section 9.1 of the NSA, with Gerald Whitmore serving as Principal. The Third-Party Monitor is responsible for conducting annual comprehensive TCP compliance audits and reporting to the CFIUS monitoring agencies.
"VPI Controlled Facility" means the VPI fabrication facility located at 9200 Innovation Boulevard, Albuquerque, NM 87113, including all buildings, structures, clean rooms, laboratories, offices, storage areas, and grounds comprising that facility. The VPI Controlled Facility includes the classified processing areas designated as Sections C-7 through C-12, which are authorized for the processing and storage of information classified at the SECRET level. The VPI Controlled Facility is assigned CAGE Code 7VK92 and holds a Facility Security Clearance at the SECRET level as administered by DCSA.
SECTION 3 — CATEGORIES OF CONTROLLED INFORMATION AND TECHNOLOGY
3.1 Classification Framework
VPI shall implement and maintain a three-tier classification system for all information, technology, and data maintained by or accessible to VPI. This classification framework is designed to ensure that appropriate safeguards are applied to each category of information based on its sensitivity and the legal and regulatory requirements applicable to its protection. All VPI information shall be categorized into one of the following three tiers:
Tier 1 — Classified Information. Information classified at the SECRET level or above, pursuant to Executive Order 13526 or applicable predecessor or successor executive orders. Tier 1 information is governed by the National Industrial Security Program Operating Manual ("NISPOM"), codified at 32 C.F.R. Part 117, the NSA, this TCP, and all applicable classification guidance and security directives issued by DCSA or other U.S. government classification authorities. Access to Tier 1 information is restricted exclusively to VPI personnel who: (i) hold active U.S. government security clearances at the appropriate level; (ii) have a demonstrated and documented need-to-know for the specific classified information at issue; and (iii) have been specifically authorized by the Facility Security Officer and the Government Security Committee to access such information. Under no circumstances shall any HSAG Personnel access, receive, review, or be made aware of the substance of any Tier 1 information.
Tier 2 — Controlled Technical Data. Technical data, technology, software, and information that is subject to U.S. export controls under the ITAR or the EAR, but that is not classified pursuant to Executive Order 13526 or its predecessors. Tier 2 information includes, without limitation, technical data relating to Defense Articles classified under USML Category XI(a)(3), technology and items classified under EAR ECCNs 3A001, 3A991, and 3E001, Controlled Unclassified Information marked in accordance with CUI program requirements, and proprietary manufacturing processes, design specifications, and test methodologies that are controlled for export. Access to Tier 2 information is restricted to authorized U.S. persons within VPI who have been granted access by the TCO and who have executed the required TCP Non-Disclosure Agreement set forth in Appendix 3. No Non-U.S. Person, including any HSAG Personnel who is a Non-U.S. Person, may access Tier 2 information without prior written authorization from the applicable U.S. government licensing authority (DDTC for ITAR items; BIS for EAR items) and prior written approval of the GSC.
Tier 3 — Proprietary but Uncontrolled. VPI proprietary business information that is not subject to export controls under the ITAR or EAR and is not classified pursuant to Executive Order 13526. Tier 3 information includes, without limitation, non-technical financial data (revenues, expenses, budgets, forecasts), human resources data (aggregate headcount, compensation benchmarks, benefits administration), general corporate governance materials, market analysis, customer relationship information relating to non-government and non-classified commercial programs, and other general business operations information. Tier 3 information may constitute Permitted Business Information and may be shared with HSAG Personnel in accordance with the procedures set forth in Section 5 of this TCP, subject to the scrubbing and review protocols established therein.
All VPI employees and contractors shall be trained on this three-tier classification framework and shall be individually responsible for properly categorizing and safeguarding information in accordance with its designated tier. The TCO shall issue classification guidance as necessary and shall resolve any disputes or uncertainties regarding the appropriate classification tier for specific information. Any uncertainty that cannot be resolved by the TCO shall be escalated to the GSC and, if necessary, to DCSA or the applicable export-control authority.
3.2 VPI ITAR-Controlled Items
VPI is registered with the Directorate of Defense Trade Controls under DDTC Registration No. M-24817 and has maintained this registration continuously since 2011. VPI's DDTC registration encompasses all of VPI's activities relating to the manufacture, export, and brokering of defense articles and defense services as defined in the ITAR.
VPI's principal ITAR-controlled products are classified under USML Category XI(a)(3) and consist of gallium nitride (GaN) power amplifier chips and associated modules specifically designed, developed, and manufactured for use in defense radar systems, satellite communications systems, electronic warfare systems, and other military applications. These products are Defense Articles within the meaning of 22 C.F.R. § 120.6 and are subject to all ITAR licensing and control requirements applicable to USML Category XI items.
The controlled technical data associated with VPI's ITAR-controlled products includes, without limitation:
(a) Design data, including circuit schematics, layout files, simulation models, and performance specifications for GaN power amplifier monolithic microwave integrated circuits (MMICs) and multi-chip modules (MCMs);
(b) Manufacturing process data, including epitaxial growth parameters, lithographic patterning specifications, metallization recipes, passivation procedures, and via-hole processing protocols for the GaN-on-SiC fabrication process;
(c) Testing and qualification data, including wafer-level probe test procedures, reliability screening protocols, environmental stress screening (ESS) procedures, and government-required qualification test plans and reports; and
(d) Integration data, including interface control documents, installation procedures, and performance characterization data necessary for the integration of VPI products into defense systems.
VPI currently holds three (3) active DSP-5 export licenses authorizing the delivery of specified ITAR-controlled items to NATO allies in the United Kingdom and Australia. These export licenses were issued prior to the transaction giving rise to the NSA and are administered solely by VPI's export compliance program under the supervision of the TCO. The DSP-5 licenses are subject to amendment to reflect the change of ownership of VPI resulting from the HSAG acquisition, and VPI shall file appropriate amendment notifications with DDTC in coordination with the TCO and GSC. No HSAG Personnel shall have authority to administer, modify, or direct the use of any ITAR export license held by VPI.
3.3 VPI EAR-Controlled Items
In addition to its ITAR-controlled products, VPI manufactures, maintains, and develops items and technology that are controlled under the Export Administration Regulations. VPI's primary EAR-controlled items are classified under the following Export Control Classification Numbers:
(a) ECCN 3A001 — Certain microwave and millimeter-wave semiconductor devices and components, including GaN high-electron-mobility transistor (HEMT) discrete devices and broadband amplifier components designed for commercial radar, telecommunications infrastructure, and instrumentation applications;
(b) ECCN 3A991 — Electronic devices and components not controlled by ECCN 3A001, including certain lower-frequency GaN devices, passive components, and substrates used in VPI's commercial product lines; and
(c) ECCN 3E001 — Technology for the development or production of items controlled by ECCN 3A001, including proprietary manufacturing know-how, process technology, and engineering methodologies relating to the design and fabrication of microwave and millimeter-wave semiconductor devices.
VPI's EAR-controlled items include dual-use GaN components developed for fifth-generation (5G) telecommunications infrastructure applications, including base station power amplifiers and massive multiple-input multiple-output (MIMO) antenna front-end modules. While these products are designed for commercial applications, the underlying technology and certain performance parameters subject them to EAR controls.
3.4 VPI intellectual Property
VPI maintains a substantial portfolio of intellectual property that is critical to both its commercial operations and its performance under U.S. government contracts. The VPI intellectual property portfolio subject to this TCP consists of the following:
United States Patents. VPI holds forty-seven (47) granted U.S. patents, organized into three principal patent families:
(a) GaN-on-SiC Epitaxial Growth Process Patent Family — Eight (8) patents, with the earliest priority date in 2012. This patent family covers proprietary methods and apparatus for the metal-organic chemical vapor deposition (MOCVD) growth of high-quality AlGaN/GaN heterostructures on semi-insulating silicon carbide substrates, including novel nucleation layer techniques, buffer layer optimization methods, and in-situ monitoring processes.
(b) HEMT Gate Structure Optimization Patent Family — Nineteen (19) patents, with the earliest priority date in 2015. This patent family covers advanced gate structure designs for GaN high-electron-mobility transistors, including T-gate fabrication techniques, field-plate geometries, gate-recess etch processes, and passivation methods that enhance power density, gain, and reliability at microwave and millimeter-wave frequencies.
(c) mmWave Broadband Matching Network Patent Family — Twenty (20) patents, with the earliest priority date in 2018. This patent family covers novel wideband impedance matching network topologies and design methodologies for millimeter-wave power amplifier modules, including on-chip and off-chip matching approaches, thermal management techniques, and multi-stage amplifier architectures.
Pending U.S. Patent Applications. VPI has twelve (12) pending U.S. patent applications across the three patent families described above, including several continuation and continuation-in-part applications relating to recent technological advances in VPI's GaN HEMT platform.
Government-Funded Patents. Twenty-three (23) of VPI's forty-seven (47) granted U.S. patents were developed in whole or in part under U.S. government-funded contracts. These patents are subject to the government's rights under 35 U.S.C. § 203, which provides for march-in rights in certain circumstances, and under applicable DFARS clauses, including DFARS 252.227-7038 (Patent Rights — Ownership by the Contractor). The U.S. government retains a nonexclusive, nontransferable, irrevocable, paid-up, royalty-free license to practice or have practiced each such patent on behalf of the United States throughout the world.
Trade Secrets. VPI maintains thirty-one (31) registered internal trade secrets, which are documented and tracked in VPI's internal trade secret registry. These trade secrets relate primarily to proprietary GaN epitaxial growth recipes (including specific precursor flow rates, growth temperatures, reactor pressures, and layer thickness parameters), die-level reliability screening processes (including proprietary accelerated life testing protocols and failure analysis methodologies), and other proprietary manufacturing know-how that provides VPI with competitive advantages in the GaN semiconductor market. VPI's trade secrets are protected through a combination of physical security, information security, employee confidentiality agreements, and the access controls established by this TCP.
3.5 Government Contract Information
VPI holds fourteen (14) active contracts with the U.S. Department of Defense, comprising both prime contracts and subcontracts, with an aggregate contract backlog of approximately one hundred ninety-three million dollars ($193,000,000) as of the Effective Date. These contracts span multiple DoD agencies and programs and involve varying levels of information classification and data rights restrictions.
The five largest active contracts, by remaining contract value, are as follows:
Contract-specific technical data and deliverables associated with each of these contracts are governed by the applicable DFARS data rights clauses incorporated into each individual contract, including DFARS 252.227-7013 (Rights in Technical Data — Noncommercial Items), DFARS 252.227-7014 (Rights in Noncommercial Computer Software and Noncommercial Computer Software Documentation), and DFARS 252.227-7018 (Rights in Noncommercial Technical Data and Computer Software — Small Business Innovation Research Program), as applicable. The specific data rights provisions of each contract are identified in Appendix 2 to this TCP.
A complete listing of all fourteen active DoD contracts, including contract numbers, contracting agencies, classification levels, applicable data rights clauses, and novation requirements, is set forth in Appendix 2 to this TCP.
SECTION 4 — PROHIBITIONS AND RESTRICTIONS
4.1 Absolute Prohibitions
The following prohibitions are absolute and apply without exception under all circumstances. No authorization, license, waiver, or approval from any person or entity, including the GSC, DCSA, or any other U.S. government authority, shall be construed to modify or create exceptions to the prohibitions set forth in subsections (a) and (b) below, except as expressly provided by applicable U.S. law or regulation:
(a) Prohibition on Disclosure of Classified Information to HSAG Personnel. No VPI Classified Information (Tier 1 information) shall be disclosed, shared, transmitted, transferred, or made accessible, in whole or in part, directly or indirectly, to any HSAG Personnel under any circumstances. This prohibition applies regardless of the security clearance status, citizenship, or need-to-know of any HSAG Personnel, and regardless of whether such disclosure is requested or directed by HSAG management, Halcyon US Holdings, or any other HSAG entity. This prohibition extends to oral disclosures, written communications, electronic transmissions, visual disclosures, and any other form of communication or access.
(b) Prohibition on Unauthorized Disclosure of Controlled Technical Data. No VPI Controlled Technical Data (Tier 2 information) shall be disclosed, shared, transmitted, transferred, or made accessible, in whole or in part, directly or indirectly, to any Non-U.S. Person — including any HSAG Personnel who is a Non-U.S. Person — without the prior written authorization of the applicable U.S. government licensing authority (DDTC for ITAR-controlled items; BIS for EAR-controlled items) and the prior written approval of the Government Security Committee. Any such disclosure without the required authorizations constitutes a violation of this TCP, the NSA, and applicable U.S. export control laws, and may result in criminal and civil penalties as described in Section 11.4.
(c) Prohibition on Deemed Exports. No deemed export of ITAR-controlled technical data or EAR-controlled technology shall be made to any Non-U.S. Person present at any VPI facility, whether such Non-U.S. Person is an employee, contractor, consultant, visitor, or other individual. VPI shall take all measures necessary to prevent any unauthorized deemed export, including the physical and procedural controls described in Sections 6 and 7 of this TCP.
(d) Prohibition on Unauthorized Trade Secret Transfers. No VPI trade secret — including any of the thirty-one (31) registered internal trade secrets identified in VPI's trade secret registry — shall be transferred, disclosed, or made accessible to any HSAG entity or any HSAG Personnel without the prior written approval of the Government Security Committee and, where the trade secret constitutes or incorporates Controlled Technical Data, the prior written authorization of the applicable U.S. government export control authority.
4.2 Restrictions on HSAG Personnel Access
The following restrictions apply to all HSAG Personnel with respect to their access to VPI information, facilities, and personnel:
(a) Board Designee Access Restrictions. The two (2) HSAG-designated members of VPI's Board of Directors may not access, receive, review, or be briefed on any Tier 1 (Classified Information) or Tier 2 (Controlled Technical Data) information. HSAG board designees shall receive only the redacted versions of board materials prepared in accordance with Section 5.2(c) of this TCP, and shall be excluded from any portions of board meetings during which Tier 1 or Tier 2 information is discussed. The GSC shall ensure appropriate procedural safeguards to implement this restriction, including the conduct of classified and controlled sessions of board meetings from which HSAG designees are excluded.
(b) Controlled Facility Access Restrictions. HSAG Personnel may not access the VPI Controlled Facility in Albuquerque, New Mexico, including the classified Sections C-7 through C-12, without the prior written approval of both DCSA and the GSC, as detailed in NSA Annex F — Facility Access Procedures. Any approved access shall be limited to unclassified and non-controlled areas of the facility, shall require continuous escort by VPI cleared personnel, and shall be subject to all visitor protocols established in Section 7 of NSA Annex F and Section 6 of this TCP.
(c) Headquarters Access. HSAG Personnel may access VPI's Colorado Springs headquarters for non-controlled business purposes, subject to the following conditions: (i) the TCO must receive a minimum of forty-eight (48) hours' advance written notice of the proposed visit; (ii) a VPI escort must accompany the HSAG Personnel at all times within the facility; (iii) no Controlled Technical Data shall be accessible, visible, displayed, or discussed in any area where HSAG Personnel are present; and (iv) the visit must comply with all visitor protocols established in Section 6 of this TCP and in NSA Annex F.
(d) Controlled-Data Area Restrictions. No HSAG Personnel may be present in any VPI area — whether at the Colorado Springs headquarters, the Albuquerque Controlled Facility, or any other VPI location — where Controlled Technical Data is displayed, processed, discussed, accessed, or stored, unless the individual: (i) is a U.S. person as defined in the ITAR and EAR; (ii) has been specifically authorized in writing by both the TCO and the GSC; (iii) has executed the TCP Non-Disclosure Agreement set forth in Appendix 3; and (iv) has a legitimate, documented need for such access that has been reviewed and approved by the GSC. Even where all such conditions are satisfied, access to Tier 1 (Classified Information) remains absolutely prohibited under Section 4.1(a).
4.3 Deemed Export Controls
VPI shall establish and maintain a comprehensive deemed export compliance program designed to ensure that no ITAR-controlled technical data or EAR-controlled technology is released, disclosed, or made accessible to any Non-U.S. Person employed by or visiting VPI, except pursuant to a valid and applicable export license or license exception. The deemed export compliance program shall be administered by the TCO in coordination with VPI's existing export compliance infrastructure and shall include, at a minimum:
(a) A current and complete log of all Non-U.S. Persons with any form of access to VPI facilities, including HSAG Personnel, foreign national employees of VPI (if any), foreign national visitors, and any other Non-U.S. Person who enters any VPI facility for any purpose;
(b) Procedures to ensure that no unauthorized deemed export occurs, including visual barriers, area restrictions, escort requirements, and IT access controls designed to prevent Non-U.S. Persons from accessing Controlled Technical Data;
(c) Regular review and updating of deemed export assessments for all Non-U.S. Persons present at VPI facilities; and
(d) Prompt investigation and reporting of any suspected unauthorized deemed export in accordance with Section 11 of this TCP.
With respect to Stefan Lohse, HSAG General Counsel, the Parties acknowledge that Mr. Lohse holds dual citizenship in the Federal Republic of Germany and the United States of America and is admitted to the practice of law before the New York State Bar. For purposes of the deemed export analysis under the ITAR and EAR, Mr. Lohse shall be treated as a U.S. person to the extent that he holds U.S. citizenship. Notwithstanding his U.S. person status for deemed export purposes, Mr. Lohse shall nonetheless be required to obtain written authorization from both the GSC and the TCO before receiving any Tier 2 (Controlled Technical Data) information, in recognition of his role as HSAG General Counsel and his fiduciary obligations to HSAG. Mr. Lohse shall not, under any circumstances, receive access to Tier 1 (Classified Information) in any capacity.
4.4 Restrictions on Cross-Border R&D Collaboration
VPI and HSAG may not conduct any joint research and development activities — whether formal or informal, whether contractual or collaborative — involving any Controlled Technical Data unless and until the following conditions have been satisfied:
(a) Appropriate export authorizations have been obtained from DDTC (for ITAR-controlled items) or BIS (for EAR-controlled items), as applicable;
(b) The Government Security Committee has reviewed and granted written approval for the proposed collaboration; and
(c) All applicable conditions and provisos of the export authorization have been documented and communicated to all participants in the proposed collaboration.
Any proposed cross-border R&D collaboration between VPI and HSAG or any HSAG affiliate shall be submitted to the TCO for preliminary review and assessment. The TCO shall determine whether the proposed collaboration involves or would require the transfer of Controlled Technical Data and shall prepare a written recommendation for the GSC. If the TCO determines that Controlled Technical Data is involved, the GSC shall review the proposal and, if it determines that the collaboration may proceed, shall authorize VPI to prepare and submit the appropriate export license application to DDTC or BIS. No cross-border R&D activity may commence until all required authorizations are in place.
Without limiting the generality of the foregoing, the following specific prohibitions shall apply:
(a) VPI shall not share any aspect of its proprietary GaN epitaxial growth process technology — including MOCVD growth parameters, nucleation layer techniques, buffer layer specifications, and related manufacturing know-how — with any HSAG non-U.S. R&D center without a valid DDTC or BIS license and the written consent of the GSC;
(b) VPI shall not share any HEMT gate structure design data — including gate-recess etch profiles, field-plate geometries, passivation recipes, and related design optimization methodologies — with any HSAG non-U.S. R&D center without a valid DDTC or BIS license and the written consent of the GSC; and
(c) VPI shall not share any mmWave power amplifier architecture data — including broadband matching network topologies, multi-stage amplifier design parameters, thermal management techniques, and related system integration know-how — with any HSAG non-U.S. R&D center without a valid DDTC or BIS license and the written consent of the GSC.
SECTION 5 — PERMITTED INFORMATION SHARING
5.1 Definition of Permitted Business Information
The Parties recognize that, as the ultimate parent company of VPI, HSAG has legitimate business needs that require the exchange of certain categories of business information between VPI and HSAG. This TCP does not prohibit the sharing of information that does not constitute Classified Information, Controlled Technical Data, or protected trade secrets, provided that such sharing occurs in compliance with the procedures and safeguards established in this Section 5.
For purposes of this TCP, "Permitted Business Information" consists of the following categories of information, to the extent that such information does not contain, incorporate, reveal, or enable the derivation of any Classified Information, Controlled Technical Data, or VPI trade secrets:
(a) Financial Information. Financial statements (audited and unaudited), operating budgets, capital expenditure plans, revenue and expense forecasts, cash flow projections, and management financial reports, provided that such documents do not contain or reveal specific technical performance data, classified program financial details, or controlled technology cost parameters that would reveal export-controlled technical information;
(b) General Business Strategy. Strategic planning documents, market analysis and competitive intelligence (relating to commercial markets), customer relationship information pertaining to non-government and non-classified commercial programs, and business development plans for non-controlled product lines;
(c) Human Resources Data. Aggregate headcount information, compensation benchmarking data, benefits administration information, and organizational charts, provided that such data excludes individual security clearance status, classified program assignments, and personnel assignments to controlled-data projects;
(d) Legal and Compliance Reporting. General legal compliance reports, litigation status summaries, regulatory filing information, and corporate governance documentation, provided that such reports do not contain or reveal Classified Information, Controlled Technical Data, or information relating to specific classified programs or export-controlled activities; and
(e) Corporate Governance Information. Information necessary for HSAG to exercise its legitimate shareholder rights as parent company, including board meeting notices, shareholder voting materials, annual meeting documentation, and corporate organizational documents, subject to the board material restrictions set forth in Section 5.2(c).
5.2 Procedures for Sharing Permitted Business Information
VPI may share Permitted Business Information with HSAG through the following approved channels, and only through these channels:
(a) Dedicated Communication Channels. All electronic communications of Permitted Business Information between VPI and HSAG shall occur through separate, dedicated communication channels — including dedicated email accounts and file-sharing platforms — that are fully segregated from VPI's controlled-data IT systems and classified IT systems. The specifications and configuration requirements for these dedicated communication channels are set forth in NSA Annex D. No controlled-data IT system or classified IT system may be connected to, or share any infrastructure with, the dedicated communication channels used for sharing Permitted Business Information with HSAG.
(b) Quarterly Financial Reporting. VPI shall prepare and deliver to HSAG quarterly financial reporting packages, prepared under the direction of VPI's Chief Financial Officer, Derek Wainsborough. Prior to delivery to HSAG, each quarterly financial reporting package shall be reviewed by the TCO to confirm that no Controlled Technical Data, Classified Information, or trade secret information has been inadvertently included. The TCO shall document the results of each such review in the information-sharing log maintained pursuant to Section 5.3.
(c) Bifurcated Board Materials. Board materials for VPI Board of Directors meetings shall be prepared in two versions:
(i) A full version containing all information relevant to the board's deliberations, including Tier 1 and Tier 2 information as necessary, which shall be distributed only to the Security Board Members (GSC members) and VPI's independent directors who hold appropriate clearances and authorizations; and
(ii) A redacted version from which all Tier 1 (Classified Information) and Tier 2 (Controlled Technical Data) information has been removed, which shall be distributed to the HSAG-designated board members. The redacted version shall contain only Tier 3 (Proprietary but Uncontrolled) information and shall be reviewed and approved by the TCO prior to distribution.
The TCO shall establish and maintain detailed procedures for the preparation and distribution of bifurcated board materials, including quality assurance checks to ensure the completeness and accuracy of the redaction process.
5.3 Scrubbing and Review Protocol
All information proposed for sharing with HSAG Personnel — regardless of the category or apparent classification of such information — must first be reviewed by the TCO or a TCO-designated reviewer to confirm the following:
(a) The information does not contain, incorporate, or reveal any Classified Information (Tier 1), including any information that has been derived from or that could be used to derive Classified Information;
(b) The information does not contain, incorporate, or reveal any ITAR-controlled or EAR-controlled technical data or technology (Tier 2), including any information that has been derived from or that could be used to derive such controlled technical data or technology; and
(c) The information does not contain, incorporate, or reveal any VPI trade secret, unless the Government Security Committee has specifically authorized the disclosure of such trade secret in writing, and any required export authorization has been obtained.
The TCO shall maintain a comprehensive log of all information reviewed and approved (or denied) for sharing with HSAG Personnel. The log shall include, for each entry: the date of the review; a description of the information reviewed; the identity of the intended recipient(s); the TCO's classification determination (Tier 1, Tier 2, or Tier 3); the TCO's determination (approved or denied); and the basis for the determination. The log shall be in the format set forth in Appendix 5 to this TCP.
In any case where the TCO is uncertain as to the proper classification of information proposed for sharing, or where the TCO determines that the information may contain elements of Tier 1 or Tier 2 information that are not clearly severable from otherwise shareable Tier 3 information, the matter shall be escalated to the Government Security Committee for resolution. If the GSC is unable to resolve the classification question, the matter shall be referred to DCSA (for Classified Information questions) or to the appropriate export-control authority (DDTC or BIS, for Controlled Technical Data questions) for a definitive determination. Pending resolution of any such classification question, the information shall not be shared with HSAG Personnel.
5.4 Earnout-Related Information
The acquisition agreement between HSAG and VPI's former shareholders provides for contingent earnout payments in an aggregate maximum amount of eighty-five million dollars ($85,000,000), consisting of a payment of up to fifty million dollars ($50,000,000) based on VPI's government-contract revenue performance for calendar year 2024, and a payment of up to thirty-five million dollars ($35,000,000) based on VPI's government-contract revenue performance for calendar year 2025.
VPI may share with HSAG sufficient information to enable the measurement and verification of the government-contract revenue milestones applicable to the earnout, subject to the following limitations:
(a) Earnout verification information shall be limited to: (i) aggregate and per-contract revenue figures; (ii) contract identifiers (contract numbers and contracting agency names); and (iii) milestone completion status (achieved or not achieved, with dates);
(b) No technical performance data, statements of work details, deliverable descriptions, or classified program information shall be included in or accompanying any earnout verification information;
(c) All earnout verification information shall be routed through Pinnacle Trust Company, N.A. (escrow agent), with offices at 400 South LaSalle Street, Suite 1100, Chicago, IL 60605, and through Arbor & Greenfield LLP (VPI's independent auditor), with offices at 1700 Lincoln Street, Suite 3200, Denver, CO 80203, which shall serve as neutral verifiers of the earnout calculations;
(d) Prior to release to the escrow agent and auditor, all earnout verification information shall be reviewed by the TCO in accordance with the scrubbing and review protocol set forth in Section 5.3; and
(e) HSAG shall not use earnout verification information for any purpose other than the verification and calculation of the earnout payments.
SECTION 6 — PHYSICAL SECURITY CONTROLS
6.1 Facility Segregation
VPI shall maintain strict physical segregation of its facilities in a manner that prevents unauthorized access to Classified Information, Controlled Technical Data, and other controlled materials. The physical security requirements for each VPI facility are as follows:
VPI Controlled Facility — Albuquerque, New Mexico. The VPI fabrication facility located at 9200 Innovation Boulevard, Albuquerque, NM 87113, is a 45,000-square-foot GaN-on-SiC semiconductor fabrication facility that holds a Facility Security Clearance at the SECRET level, administered by DCSA, and is assigned CAGE Code 7VK92. The VPI Controlled Facility contains both classified and unclassified controlled areas, which shall be segregated as follows:
(a) Classified Areas (Sections C-7 through C-12). Clean room Sections C-7 through C-12 are authorized for the processing, storage, and discussion of information classified at the SECRET level. Access to these areas is restricted exclusively to VPI personnel who hold active U.S. government security clearances at the SECRET level or above and who have a documented need-to-know for the specific classified information processed in these areas. No HSAG Personnel may access Sections C-7 through C-12 under any circumstances without the prior written approval of both DCSA and the Government Security Committee, as specified in NSA Annex F. Any such approval, if granted, shall be limited to specific, time-bounded visits under continuous escort by a cleared VPI employee and shall not include access to classified materials or classified processing activities.
(b) Unclassified Controlled Areas. The remaining areas of the Albuquerque facility that contain or process Controlled Technical Data (Tier 2 information), but that are not designated for classified processing, are classified as unclassified controlled areas. Access to these areas is restricted to authorized VPI employees who are U.S. persons and who have been granted access by the TCO. HSAG Personnel may access these areas only with the prior written approval of both the TCO and the GSC, and only under continuous escort by an authorized VPI employee.
(c) Administrative and Support Areas. Areas of the Albuquerque facility that do not contain or process Classified Information or Controlled Technical Data, such as reception areas, conference rooms designated for uncontrolled meetings, and cafeteria facilities, may be accessed by authorized visitors in accordance with the visitor protocols established in this Section and in NSA Annex F.
VPI Corporate Headquarters — Colorado Springs, Colorado. The VPI corporate headquarters located at 7400 Ridgeline Parkway, Colorado Springs, CO 80919, is an unclassified facility that serves as VPI's principal administrative, engineering, and management office. While the Colorado Springs headquarters does not hold a Facility Security Clearance, it may contain Controlled Technical Data (Tier 2 information) in certain engineering and program management areas. HSAG Personnel may visit the Colorado Springs headquarters for non-controlled business purposes, subject to the following conditions:
(a) The TCO must receive a minimum of forty-eight (48) hours' advance written notice of any proposed visit by HSAG Personnel, including the names, affiliations, citizenships, and purposes of all proposed visitors;
(b) A VPI escort must accompany each HSAG Personnel visitor at all times within the facility;
(c) Prior to any visit by HSAG Personnel, the TCO shall ensure that no Controlled Technical Data is accessible, visible, displayed, or capable of being overheard in any area where HSAG Personnel will be present; and
(d) All visits by HSAG Personnel shall comply with the visitor protocols established in NSA Annex F and in this TCP.
6.2 Physical Access Controls
VPI shall implement and maintain a multi-tiered physical access control system at all VPI facilities. The access control system shall include, at a minimum, the following elements:
Badge Access System. VPI shall maintain an electronic badge access system with the following separate access levels:
(a) Level 1 — Classified Facility Access. Authorized for VPI cleared personnel only (personnel holding active U.S. government security clearances at the appropriate level with documented need-to-know). Level 1 badges shall provide access to classified Sections C-7 through C-12 of the Albuquerque Controlled Facility.
(b) Level 2 — Controlled-Data Area Access. Authorized for VPI employees who are U.S. persons and who have been granted access to Controlled Technical Data by the TCO. Level 2 badges shall provide access to unclassified controlled areas of VPI facilities where Controlled Technical Data is processed or stored.
(c) Green — General/Administrative Area Access. Authorized for all VPI employees, including those without access to Controlled Technical Data or Classified Information. Green badges provide access to administrative and support areas of VPI facilities.
(d) Level V — Visitor Access. Authorized for HSAG Personnel and other non-VPI visitors who have been approved for facility access in accordance with the visitor protocols established in this TCP and NSA Annex F. Level V badges provide access to general/administrative areas only and must be returned upon departure from the facility.
Visitor Logs. VPI shall maintain visitor logs at all entry points to all VPI facilities. Visitor logs shall record the name, affiliation, citizenship, purpose of visit, areas accessed, arrival time, departure time, and escort assignment for each visitor. Copies of all visitor logs shall be provided to the TCO on a monthly basis and to the Third-Party Monitor on an annual basis as part of the annual TCP compliance audit.
Secure Storage. All Controlled Technical Data in physical form (including printed documents, engineering drawings, manufacturing process records, test data, and any other tangible media containing Controlled Technical Data) shall be stored in GSA-approved security containers (meeting Federal Specification AA-F-358) when not in active use. Classified Information in physical form shall be stored in GSA-approved security containers meeting the requirements of 32 C.F.R. Part 117 (NISPOM) for the applicable classification level. Access to security containers shall be limited to authorized personnel, and container access logs shall be maintained by the designated custodian.
6.3 Secure Workspace Protocols
VPI shall implement and enforce the following workspace security protocols in all areas where Controlled Technical Data or Classified Information is processed, accessed, or stored:
(a) Clean Desk Policy. A strict clean desk policy shall be enforced in all areas where Controlled Technical Data is processed or accessed. All controlled materials shall be secured in GSA-approved containers or locked storage when not in active use by authorized personnel. No controlled materials shall be left unattended on desks, workstations, or other surfaces at any time, including during breaks, lunch periods, and after working hours.
(b) Personal Electronic Device Restrictions. No personal electronic devices — including personal mobile telephones, smartphones, tablets, smartwatches, fitness trackers, personal laptop computers, USB storage devices, portable hard drives, digital cameras, or any other electronic recording or communication device — shall be permitted in classified areas (Sections C-7 through C-12) or in controlled-data processing areas of any VPI facility. Secure storage lockers shall be provided at the entrance to restricted areas for the temporary storage of personal electronic devices during periods of authorized access.
(c) Controlled Data Removal Restrictions. Controlled Technical Data shall not be removed from designated secure areas — whether in physical form, electronic form, or any other medium — without the prior written authorization of the TCO. Any authorized removal of Controlled Technical Data from a secure area shall be documented, including the date, description of the material, purpose of removal, destination, responsible individual, and expected return date. The TCO shall maintain a log of all such authorized removals.
SECTION 7 — INFORMATION TECHNOLOGY AND CYBERSECURITY CONTROLS
7.1 IT System Segregation
VPI's information technology systems must be physically and logically separated from HSAG's global information technology network and from the information technology systems of all other HSAG entities. This segregation requirement is fundamental to the protection of Controlled Technical Data and Classified Information and shall be maintained throughout the term of this TCP. Specifically:
(a) VPI shall not share any IT infrastructure — including servers, storage systems, network equipment, switches, routers, firewalls, or cabling — with HSAG, Halcyon US Holdings, Halcyon US Inc., or any other HSAG entity;
(b) VPI's network shall not be connected to, federated with, or capable of direct communication with HSAG's global network, any HSAG domain, or any HSAG-administered network segment;
(c) VPI shall not participate in any federated identity management system, single sign-on framework, or shared directory service with any HSAG entity;
(d) VPI shall not utilize any shared cloud infrastructure — including shared cloud storage, shared cloud computing resources, shared cloud-based applications, or shared software-as-a-service platforms — with any HSAG entity; and
(e) VPI and HSAG shall not share any IT administrative personnel, IT security personnel, or IT management functions.
VPI shall maintain its own fully independent IT environment, including, at a minimum, the following systems:
(a) An independent email system, hosted on VPI-controlled infrastructure and administered by VPI IT personnel;
(b) An independent enterprise resource planning (ERP) system for financial management, procurement, manufacturing execution, and business operations;
(c) Independent engineering design tools and repositories, including computer-aided design (CAD) software, electronic design automation (EDA) tools, circuit simulation platforms, and engineering data management systems;
(d) An independent document management system for the storage, retrieval, and version control of all VPI documents, including controlled technical data and proprietary business information; and
(e) Independent collaboration platforms for internal VPI communications, project management, and team coordination.