PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT COMMUNICATION ATTORNEY WORK PRODUCT DO NOT DISTRIBUTE WITHOUT PRIOR AUTHORIZATION OF CALDERWOOD & HARKNESS LLP
CALDERWOOD & HARKNESS LLP 1750 K Street NW, Suite 800 Washington, DC 20006
MEMORANDUM
TO: Beatrice Holloway, Responsible Partner, M&A (New York Office) Stefan Lohse, General Counsel / Chefjustitiar, Halcyon Semiconductor AG
FROM: Margaret "Peggy" Ashworth, Of Counsel, National Security & CFIUS (Washington, DC) Lt. Col. (Ret.) David Caruso, Senior Counsel, Government Contracts & Export Controls (Washington, DC)
DATE: December 4, 2023
RE: Third-Party Compliance Monitor Selection and Scope of Monitoring Obligations — CFIUS Case No. CFIUS-023-07-3841; Halcyon Semiconductor AG / Marlowe Asset Management Photonics Inc.
MATTER NO.: 1032-00004
CONFIDENTIALITY NOTICE: This memorandum is protected by the attorney-client privilege and constitutes attorney work product prepared in anticipation of litigation and in connection with the provision of legal advice. This document contains confidential and privileged information intended solely for the use of the addressees identified above. Do not copy, forward, or distribute this memorandum, in whole or in part, without the prior written authorization of Calderwood & Harkness LLP. Any unauthorized disclosure may result in a waiver of applicable privileges.
Right-click to update Table of Contents
I. EXECUTIVE SUMMARY
The purpose of this memorandum is to analyze the candidates identified for the position of third-party compliance monitor as required under the draft National Security Agreement ("NSA") (designated NSA-2024-0019) to be entered into among Halcyon Semiconductor Aktiengesellschaft ("HSAG"), Halcyon US Holdings Inc. ("Halcyon Holdings"), Marlowe Asset Management Photonics Inc. ("VPI"), and the United States government, acting through the Committee on Foreign Investment in the United States ("CFIUS") — specifically, the Departments of the Treasury, Defense, and Energy — and to recommend a preferred candidate for formal submission to CFIUS for approval.
As background, CFIUS communicated four preliminary national security concerns to the transaction parties on October 20, 2023, following the conclusion of the initial 45-day review period and during the ongoing 45-day investigation. An initial draft NSA was circulated by the CFIUS Staff Chairperson on November 3, 2023. The first formal NSA negotiation session was held on November 9, 2023, with subsequent sessions continuing through December 2023. Among the core mitigation measures set forth in the draft NSA is the requirement that the parties appoint a third-party compliance monitor, approved by CFIUS and the designated monitoring agencies, to verify ongoing compliance with all NSA obligations.
Based on our comprehensive evaluation of four qualified candidates, we recommend that HSAG propose Whitmore Compliance Group LLC, with Gerald Whitmore (former FBI Counterintelligence Division, approximately 25 years of federal law enforcement and counterintelligence experience) serving as the principal monitor. Whitmore Compliance Group represents the strongest candidate across all evaluation criteria, including professional qualifications, active TS/SCI security clearance status, relevant sector experience in the semiconductor and defense industries, demonstrated familiarity with CFIUS monitoring frameworks and processes, organizational depth and staffing, verified independence from all transaction parties, and cost competitiveness at a proposed annual fee of $1.2 million per annum.
We note that CFIUS approval of the proposed monitor is targeted for the December 8, 2023 negotiation session, and that the selection and formal agreement on the monitor must be completed before the NSA can be finalized and executed. Accordingly, we respectfully request that HSAG management — specifically, Dr. Ehrhardt, Katarina Brückner, and Stefan Lohse — confirm approval of this recommendation by no later than December 6, 2023, so that the candidate may be formally presented to CFIUS at the scheduled session.
II. BACKGROUND
A. Transaction Overview
Halcyon Semiconductor Aktiengesellschaft ("HSAG") is a German publicly traded semiconductor company listed on the Frankfurt Stock Exchange (XETRA ticker: HLC), with its principal executive offices located at Industriestraße 44, 01099 Dresden, Saxony, Federal Republic of Germany. As of June 1, 2023, HSAG maintained a market capitalization of approximately €14.8 billion. For fiscal year 2022, HSAG reported consolidated revenue of €6.12 billion and adjusted EBITDA of €1.37 billion, reflecting its position as one of Europe's leading semiconductor manufacturers with operations spanning power electronics, automotive semiconductors, and industrial control systems.
The transaction at issue involves HSAG's proposed acquisition of 100% of the outstanding equity of Marlowe Asset Management Photonics Inc. ("VPI"), a Delaware C-corporation originally incorporated on February 14, 2009, with its corporate headquarters located at 7400 Ridgeline Parkway, Colorado Springs, Colorado 80919. In addition to its corporate offices, VPI operates a 45,000-square-foot gallium-nitride-on-silicon-carbide ("GaN-on-SiC") fabrication facility located at 9200 Innovation Boulevard, Albuquerque, New Mexico 87113, which serves as the company's primary manufacturing site for advanced GaN power amplifier chips.
The aggregate purchase price for the acquisition is $1.42 billion on a cash-free, debt-free basis, with a net working capital target of $34.6 million, payable in 100% cash consideration. The Stock Purchase Agreement further provides for an earnout of up to $85 million in additional consideration, subject to the achievement of specified performance milestones, resulting in maximum aggregate consideration of $1.505 billion. The acquisition is being effected through Halcyon US Holdings Inc. ("Halcyon Holdings"), a Delaware C-corporation formed on June 5, 2023, for the specific purpose of serving as the U.S. acquisition vehicle (Employer Identification Number: 93-2841067). The Stock Purchase Agreement was executed by all parties on June 10, 2023.
VPI's current equity holders include Ridgecrest Ventures (majority), Cascadian Capital Partners (minority), and certain members of VPI's management team and board of directors holding equity participation through option and restricted stock unit programs.
B. VPI's Sensitive Activities Triggering the Monitor Requirement
VPI designs and manufactures advanced gallium-nitride (GaN) power amplifier chips used in defense radar systems, satellite communications platforms, and next-generation 5G wireless infrastructure. VPI's GaN-on-SiC technology represents a critical capability in the U.S. defense industrial base, particularly for applications requiring high-power, high-frequency radio frequency (RF) performance in demanding thermal and environmental conditions.
VPI holds both classified and unclassified contracts with the U.S. Department of Defense. As of the date of this memorandum, VPI maintains fourteen (14) active DoD contracts and subcontracts with an aggregate backlog of approximately $193 million. The most significant of these engagements include:
• U.S. Army PEO intelligence, Electronic Warfare & Sensors (PEO IEW&S): GaN power amplifier modules for the AN/TPS-80 Ground/Air Task-Oriented Radar (G/ATOR) system — $52.3 million remaining contract value;
• Air Force Research Laboratory (AFRL): Research, development, and production of millimeter-wave (mmWave) power amplifiers for advanced electronic warfare and communications applications — $41.7 million remaining contract value;
• Missile Defense Agency (MDA): GaN-based transmit/receive (T/R) modules for missile defense radar systems — $38.9 million remaining contract value;
• Ironclad Defense Systems Inc. (subcontract; prime contractor: U.S. Navy NAVSEA): GaN components for naval shipboard radar and electronic warfare systems — $34.1 million remaining contract value; and
• Department of Homeland Security, Science and Technology Directorate (DHS S&T): RF components for border surveillance sensor systems — $26.0 million remaining contract value.
VPI's products include defense articles controlled under Category XI(a)(3) of the United States Munitions List (USML) subject to the International Traffic in Arms Regulations (ITAR), as well as dual-use components classified under Export Control Classification Number (ECCN) 3A001 of the Commerce Control List (CCL) subject to the Export Administration Regulations (EAR). VPI is registered with the Directorate of Defense Trade Controls (DDTC) under Registration No. M-24817 and currently holds three (3) active DSP-5 export licenses.
VPI maintains a Facility Security Clearance (FCL) at the SECRET level, issued by the Defense Counterintelligence and Security Agency (DCSA), with CAGE Code 7VK92. Of VPI's total workforce of 486 employees, 212 employees hold active U.S. government security clearances at various levels, representing approximately 43.6% of the workforce. This concentration of cleared personnel underscores the depth of VPI's involvement in classified defense programs and the sensitivity of the national security considerations at stake.
With respect to intellectual property, VPI holds 47 issued U.S. patents and 12 pending patent applications. Of these, 23 patents were developed under government-funded contracts and are subject to government march-in rights under the Bayh-Dole Act (35 U.S.C. § 200 et seq.) and applicable contract provisions. VPI also maintains 31 registered internal trade secrets relating to proprietary GaN epitaxial growth recipes, die-level reliability screening processes, and related manufacturing know-how, which represent core competitive advantages in the GaN semiconductor market.
VPI's status as a "TID U.S. business" engaged in the design and fabrication of critical technologies — specifically, GaN semiconductors classified under ECCN 3A001 — triggered a mandatory CFIUS filing obligation under the Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA) and its implementing regulations at 31 C.F.R. Part 800.
C. CFIUS Process to Date
The parties filed a voluntary joint notice with CFIUS on July 14, 2023, pursuant to 31 C.F.R. Part 800. The filing was assigned CFIUS Case Number CFIUS-023-07-3841. CFIUS accepted the filing as complete, and the initial 45-day review period commenced on July 21, 2023.
During the review period, CFIUS issued its first Request for Information (RFI) on August 4, 2023, comprising 34 detailed questions addressing, among other topics, HSAG's relationships with German and European Union governmental entities, HSAG's cybersecurity infrastructure and policies, the planned approach to technology transfer and integration, and HSAG's commercial exposure to the Chinese semiconductor market, including sales channels, joint ventures, and supply chain dependencies involving entities in the People's Republic of China. A comprehensive supplemental response to the first RFI was filed on August 18, 2023.
The 45-day review period concluded on September 4, 2023, at which point CFIUS determined that the transaction warranted further investigation. A 45-day investigation was initiated on the same date. During the investigation, CFIUS issued a second RFI on September 22, 2023, consisting of 22 follow-up questions originating primarily from the Department of Defense and the Department of Energy, focusing on intellectual property transfer risks, VPI's supply chain dependencies, relationships with non-allied foreign governments and entities, and the adequacy of proposed mitigation measures. A response to the second RFI was filed on October 6, 2023.
On October 20, 2023, CFIUS communicated four preliminary national security concerns to the transaction parties through counsel:
(1) Foreign access to classified defense programs. Risk that HSAG or its non-U.S. affiliates, employees, or agents could obtain unauthorized access to classified information held by VPI in connection with its DoD contracts and facility security clearance.
(2) Potential transfer of ITAR/EAR-controlled technology to non-U.S. persons. Risk that the acquisition could result in the unauthorized transfer, export, or re-export of VPI technical data, manufacturing know-how, or defense articles controlled under the ITAR (USML Category XI) or EAR (ECCN 3A001) to HSAG personnel, German or EU governmental entities, or other non-U.S. persons.
(3) Cybersecurity risks from integration with HSAG IT infrastructure. Risk that integration of VPI's information technology systems with HSAG's global network could create vulnerabilities exploitable by foreign intelligence services or other threat actors, potentially compromising classified or controlled unclassified information.
(4) Continuity of critical DoD supply chain. Risk that the change of ownership could disrupt VPI's ability to perform its existing DoD contracts and maintain its position as a reliable supplier of GaN power amplifier components within the U.S. defense industrial base.
Following communication of these concerns, CFIUS circulated an initial draft NSA on November 3, 2023, setting forth proposed mitigation measures designed to address each of the identified national security concerns. The first NSA negotiation session between the parties and CFIUS was held on November 9, 2023, and subsequent negotiation sessions have continued through December 2023.
D. NSA Monitor Requirement
Article VII of the draft NSA (NSA-2024-0019) mandates the appointment of a "Third-Party Monitor" to independently verify compliance with all obligations set forth in the NSA. The monitor requirement is a core mitigation measure and reflects CFIUS's determination that independent, ongoing oversight is necessary to ensure the efficacy of the NSA's protective provisions given the sensitivity of VPI's classified programs, controlled technologies, and critical DoD supply chain position.
Under the draft NSA, the third-party monitor must satisfy the following threshold requirements:
(a) The monitor must be approved by CFIUS — specifically, by the Department of the Treasury (as CFIUS Chair), the Department of Defense, and the Department of Energy — as well as by the Defense Counterintelligence and Security Agency (DCSA), which serves as the designated monitoring agency under the NSA.
(b) The monitor must be independent of both HSAG (and all HSAG affiliates, including Halcyon Holdings) and VPI. The monitor may not have any prior or current business relationship, financial interest, or other affiliation with any party to the transaction that could compromise, or create the appearance of compromising, the monitor's objectivity.
(c) The monitor's principal must hold, or be eligible to obtain and willing to maintain, security clearances at the TS/SCI (Top Secret / Sensitive Compartmented Information) level, as the monitor's duties will require access to classified information and classified facilities in connection with the verification of NSA compliance.
(d) The appointment of the monitor must be formalized — including the execution of the monitor engagement agreement — prior to the execution of the final NSA. CFIUS has indicated that it will not execute the NSA without a confirmed, approved monitor in place.
The draft NSA further provides that the cost of the monitor shall be borne entirely by HSAG, and that the monitor's primary reporting obligation runs to the CFIUS monitoring agencies, not to HSAG or VPI, notwithstanding the funding arrangement.
III. MONITOR CANDIDATE EVALUATION
A. Candidate Selection Process
Calderwood & Harkness identified four potential third-party monitor candidates through a structured process that included: (i) consultation with CFIUS monitoring agency staff and government counterparts, including informal discussions with officials at DCSA, the Treasury Department's Office of Investment Security (OIS), and the Department of Defense regarding the qualifications and characteristics that CFIUS considers most important in monitor candidates for semiconductor and defense-sector transactions; (ii) outreach to government contracts counsel networks and former government officials with experience in CFIUS mitigation matters; and (iii) review of publicly available information on monitors appointed in comparable semiconductor and defense-sector NSAs from 2019 through 2023, including professional backgrounds, organizational structures, and engagement terms.
Each candidate was evaluated against the following eight criteria, which reflect both the requirements set forth in the draft NSA and the preferences that CFIUS has expressed — both formally and informally — in prior transactions:
(1) Principal's Professional Background and National Security Experience. Depth and relevance of the principal monitor's career in counterintelligence, national security investigation, intelligence community operations, or related fields.
(2) Active Security Clearances at Appropriate Levels. Whether the principal and key staff hold active TS/SCI clearances, or whether they hold lower-level clearances and would need to apply for upgrades — a process that can introduce significant delays.
(3) Relevant Sector Expertise (Semiconductors, Defense, Export Controls). Familiarity with the semiconductor industry, defense contracting, ITAR/EAR export control compliance, facility security clearance requirements under the National Industrial Security Program Operating Manual (NISPOM), and related regulatory frameworks.
(4) Prior CFIUS Monitoring Experience. Track record of serving as a CFIUS-appointed or CFIUS-approved third-party monitor in prior NSA engagements, including the nature and complexity of those engagements.
(5) Organizational Infrastructure and Staffing. Size, composition, and capabilities of the candidate's organization, including the availability of multi-disciplinary teams with expertise across counterintelligence, export controls, cybersecurity, industrial security, and compliance auditing.
(6) Independence from Both Parties. Absence of conflicts of interest, prior business relationships, financial interests, or other affiliations that could compromise, or create the appearance of compromising, the monitor's objectivity.
(7) Cost Competitiveness. Reasonableness of the proposed annual fee relative to industry benchmarks for comparable monitoring engagements in the semiconductor and defense sectors.
(8) Likelihood of CFIUS Approval. Assessment of the probability that CFIUS will approve the candidate, based on the candidate's alignment with CFIUS's known preferences and prior approval patterns.
It is important to note that CFIUS has historically exercised significant influence over monitor selection and has, in our experience, rejected candidates lacking sufficient counterintelligence or national security investigation backgrounds. In particular, CFIUS has shown a strong preference for monitors whose principals have direct experience in the FBI Counterintelligence Division, the Defense intelligence Agency (DIA), the National Security Agency (NSA), or comparable intelligence community organizations, and who hold active TS/SCI clearances at the time of appointment. Candidates whose backgrounds are oriented primarily toward physical security, corporate investigations, or commercial compliance — without a strong national security foundation — have faced resistance in the approval process.
B. Candidate 1 — Whitmore Compliance Group LLC (Recommended)
i. Entity Information
• Full Legal Name: Whitmore Compliance Group LLC
• Entity Type: Delaware limited liability company
• Principal Office: 1300 Crystal Drive, Suite 710, Arlington, Virginia 22202
• Principal / Lead Monitor: Gerald Whitmore
• Year Established: 2015
• Registered Agent: Pemberton Industries, 251 Little Falls Drive, Wilmington, DE 19808
ii. Background and Qualifications of Gerald Whitmore
Gerald Whitmore is the founder and managing principal of Whitmore Compliance Group LLC. He brings approximately 25 years of experience in federal law enforcement and counterintelligence operations, the substantial majority of which was spent in the Federal Bureau of Investigation (FBI), Counterintelligence Division. During his FBI career, Mr. Whitmore held progressively senior positions within the Counterintelligence Division, including supervisory roles in investigations involving the unauthorized acquisition of U.S. defense and dual-use technologies by foreign state actors. His career included direct involvement in matters relating to foreign investment in U.S. defense and technology companies, giving him a deep understanding of the national security risks that CFIUS is designed to address.
Mr. Whitmore holds an active security clearance at the TS/SCI level, which is current and in good standing. This clearance enables him to access classified information and enter classified facilities as necessary to perform the full scope of monitoring duties contemplated under the draft NSA, including review of VPI's classified DoD programs and classified areas within the Albuquerque fabrication facility.
Following his retirement from the FBI, Mr. Whitmore established Whitmore Compliance Group LLC in 2015 with the specific mission of providing national security compliance monitoring and advisory services, with a particular focus on serving as a third-party monitor under CFIUS National Security Agreements. Since the firm's founding, Mr. Whitmore has served as the principal monitor in at least three prior CFIUS-mandated monitoring engagements in the semiconductor and defense sectors. While confidentiality obligations preclude us from identifying the specific transactions, we can confirm that these engagements involved comparably complex compliance monitoring requirements, including oversight of classified programs, export control compliance, cybersecurity segregation, and board governance provisions — all of which are directly analogous to the requirements of the VPI NSA.
Mr. Whitmore possesses deep familiarity with the Defense Counterintelligence and Security Agency (DCSA) facility clearance processes, Foreign Ownership, Control, or Influence (FOCI) mitigation instruments (including Special Security Agreements, Proxy Agreements, and Voting Trust Agreements), the National Industrial Security Program Operating Manual (NISPOM, 32 C.F.R. Part 117), and the ITAR/EAR export control compliance frameworks. He has also testified as an expert witness before congressional committees on matters relating to foreign investment national security risks, further demonstrating his recognized expertise in this domain.
iii. Organizational Infrastructure
Whitmore Compliance Group LLC employs a full-time professional staff of approximately twelve (12) individuals, representing a multi-disciplinary team with collective expertise spanning the full range of competencies required for effective NSA compliance monitoring. Key staff include:
• Former Department of Justice (DOJ) national security attorneys with experience in FISA applications, espionage prosecutions, and national security regulatory matters;
• Former DCSA industrial security specialists with direct experience in administering facility security clearances, conducting FOCI assessments, and overseeing NISPOM compliance;
• Former military counterintelligence officers with backgrounds in the Army Counterintelligence Corps, Air Force Office of Special Investigations (AFOSI), and Naval Criminal Investigative Service (NCIS);
• Cybersecurity auditors with certifications including CISSP, CISM, and CEH, and experience in evaluating compliance with NIST SP 800-171, CMMC, and related cybersecurity frameworks.
This organizational depth gives Whitmore Compliance Group the demonstrated ability to deploy multi-disciplinary teams for complex monitoring engagements. In the context of VPI's operations — which involve 212 cleared employees, 14 active DoD contracts with an aggregate backlog of $193 million, ITAR-controlled defense articles, EAR-controlled dual-use components, a classified fabrication facility, and extensive cybersecurity and data segregation requirements — the breadth and depth of Whitmore Compliance Group's team is a significant advantage.
The firm's prior monitoring engagements have required the conduct of annual compliance audits, ad hoc reviews triggered by potential compliance concerns, incident investigations (including cybersecurity incidents and unauthorized access events), and preparation of detailed annual compliance reports for submission to CFIUS monitoring agencies. Whitmore Compliance Group has consistently demonstrated the capacity to manage these obligations within required timelines and to the satisfaction of the relevant government agencies.
iv. Independence Assessment
Calderwood & Harkness conducted a thorough independence assessment of Whitmore Compliance Group LLC and Gerald Whitmore, encompassing the following elements:
• HSAG and Affiliates: Whitmore Compliance Group has no prior engagements, business relationships, financial interests, or other affiliations with HSAG, Halcyon US Holdings Inc., Halcyon US Inc., or any HSAG subsidiary, affiliate, or portfolio company. No member of the Whitmore Compliance Group staff has previously been employed by, consulted for, or provided services to HSAG or any HSAG affiliate.
• VPI and Shareholders: Whitmore Compliance Group has no prior engagements, business relationships, financial interests, or other affiliations with VPI, Ridgecrest Ventures, Cascadian Capital Partners, or any VPI shareholder, director, officer, or employee. No member of the Whitmore Compliance Group staff has previously been employed by, consulted for, or provided services to VPI or any VPI-related entity.
• Transaction Advisors: No identified conflicts of interest with Calderwood & Harkness LLP, Wethersfield & Gale LLP (counsel to VPI), or any other legal, financial, or advisory entity involved in the transaction.
• Personal Interests: Gerald Whitmore holds no financial interests, equity positions, board memberships, or advisory relationships with any party to the transaction or any entity affiliated with any party.
Independence has been confirmed through a formal conflict screening process conducted by Whitmore Compliance Group's internal compliance function and independently verified by Calderwood & Harkness through our own review of publicly available information, SEC filings, and proprietary conflict databases. We are confident that Whitmore Compliance Group satisfies the independence requirements set forth in Article VII of the draft NSA.
v. Cost Proposal
Whitmore Compliance Group has submitted the following fee proposal:
• Proposed Annual Fee: $1,200,000 per annum
• Payment Structure: Payable in quarterly installments of $300,000 each
• Fee Payor: HSAG (as required by the draft NSA)
• CPI Adjustment Mechanism: Annual adjustment based on the Consumer Price Index for All Urban Consumers (CPI-U), commencing on the first anniversary of the NSA execution date
• Scope of Included Services: Annual compliance audits covering all NSA obligation areas; preparation and submission of annual compliance reports to CFIUS monitoring agencies; up to two (2) ad hoc reviews per year; reasonable travel and related expenses
• Additional Services: Ad hoc reviews or incident investigations beyond two per year to be billed at agreed hourly rates, to be set forth in the monitor engagement agreement
The proposed annual fee of $1.2 million is within the range observed in comparable semiconductor-sector NSA monitoring engagements. Based on Calderwood & Harkness's review of fee structures in twelve (12) precedent NSAs from the 2019–2023 period involving semiconductor and defense-sector transactions, third-party monitor annual fees ranged from approximately $900,000 to $1.8 million, with a median of approximately $1.25 million. Whitmore Compliance Group's proposal falls in the lower-middle range of this benchmark, reflecting reasonable cost competitiveness given the complexity of VPI's operations and the scope of the monitoring obligations under the draft NSA.
vi. Likelihood of CFIUS Approval
We assess the likelihood of CFIUS approval for Whitmore Compliance Group LLC as high. This assessment is based on several factors:
• Gerald Whitmore's FBI Counterintelligence Division background and active TS/SCI clearance are closely aligned with CFIUS's consistently stated preference for monitors with deep counterintelligence experience and current access to classified information.
• Whitmore Compliance Group has been previously approved by CFIUS as a third-party monitor in comparable engagements. Gerald Whitmore is known to, and respected by, officials at the Treasury Department's Office of Investment Security (OIS), the Department of Defense, the Department of Energy, and DCSA.
• In informal pre-sounding conducted by Calderwood & Harkness with CFIUS monitoring agency contacts — conducted on a no-names basis with respect to the specific engagement, but referencing the general profile and qualifications of the candidate — agency contacts indicated receptivity to a candidate with this background and track record. While informal pre-sounding does not constitute a commitment or guarantee of approval, it provides a meaningful signal of the candidate's likely reception.
C. Candidate 2 — Sentinel National Security Advisors LLC
i. Entity Information
• Full Legal Name: Sentinel National Security Advisors LLC
• Entity Type: Virginia limited liability company
• Principal Office: 8000 Towers Crescent Drive, Suite 1350, Tysons Corner, Virginia 22182
• Principal / Lead Monitor: Raymond J. Alderman
• Background: Mr. Alderman is a former senior official of the Defense intelligence Agency (DIA), where he served for approximately 22 years in various intelligence and counterintelligence capacities, including assignments involving foreign intelligence threat assessments of critical technology sectors.
• Clearance Status: Mr. Alderman holds an active TS/SCI security clearance.
ii. Assessment. Sentinel National Security Advisors LLC presents a strong counterintelligence background through its principal, Raymond Alderman. Mr. Alderman's DIA career provided him with substantial exposure to foreign intelligence threats targeting U.S. defense and technology companies, and his TS/SCI clearance satisfies the draft NSA's security clearance requirements.
However, Sentinel has limited specific experience with CFIUS third-party monitoring roles. While Mr. Alderman has served as a national security compliance consultant in several contexts, he has not previously been appointed as a formal third-party monitor under a CFIUS National Security Agreement. This lack of a demonstrated CFIUS monitoring track record is a meaningful disadvantage, as CFIUS has historically shown a preference for candidates who have successfully navigated the monitoring role in prior engagements and who are familiar with the specific expectations, reporting formats, and agency dynamics involved.
Sentinel's organizational capacity is also a concern. The firm employs approximately six (6) full-time professional staff, which may present capacity constraints for a monitoring engagement of the complexity involved in the VPI transaction. With 212 cleared employees, 14 active DoD contracts spanning multiple military services and defense agencies, classified and ITAR-controlled programs, and extensive cybersecurity and data segregation requirements, the VPI monitoring engagement will require substantial resources, including the ability to deploy multi-disciplinary audit teams covering board governance, export controls, cybersecurity, facility security, and personnel matters simultaneously.
Sentinel's cost proposal is $1.4 million per annum, which is higher than Whitmore Compliance Group's proposal by $200,000 annually. While this fee is within the benchmark range, it is less competitive when evaluated in conjunction with the capacity concerns noted above.
With respect to independence, our conflict screening identified no conflicts of interest between Sentinel and any party to the transaction. The firm has no prior engagements with HSAG, VPI, or any affiliated entity.
We assess the likelihood of CFIUS approval for Sentinel as moderate. While Mr. Alderman's DIA background and TS/SCI clearance are strong qualifications, the absence of a prior CFIUS monitoring track record introduces uncertainty into the approval process.
D. Candidate 3 — Fortbridge Government Solutions LLC
i. Entity Information
• Full Legal Name: Fortbridge Government Solutions LLC
• Entity Type: Virginia limited liability company
• Principal Office: 13800 Coppermine Road, Suite 200, Herndon, Virginia 20171
• Principal / Lead Monitor: Dr. Patricia Keane
• Background: Dr. Keane is a former senior official of the National Security Agency (NSA), where she served for approximately 28 years, culminating in a senior leadership position within the signals intelligence Directorate. Her expertise is concentrated in signals intelligence, communications security, and cybersecurity.
• Clearance Status: Dr. Keane holds an active TS/SCI security clearance with additional special access program (SAP) eligibilities.
ii. Assessment. Fortbridge Government Solutions LLC brings significant strengths in signals intelligence and cybersecurity. Dr. Keane's nearly three-decade career at the National Security Agency provided her with deep expertise in the cybersecurity dimensions of national security compliance, which is highly relevant to the draft NSA's cybersecurity requirements, including NIST SP 800-171 compliance verification, penetration testing review, and IT system segregation.
The firm employs approximately fifteen (15) full-time professional staff, with particularly strong cybersecurity audit capabilities. The team includes certified information security professionals, former NSA technical officers, and IT auditors with experience in evaluating compliance with NIST cybersecurity frameworks and the Cybersecurity Maturity Model Certification (CMMC) program.
However, Fortbridge's experience with ITAR/EAR export control compliance — which is a critical component of the VPI NSA — is less developed. The draft NSA's Technology Control Plan (TCP) provisions and the verification of compliance with ITAR Category XI(a)(3) and EAR ECCN 3A001 controls represent a substantial portion of the monitor's annual audit obligations. Dr. Keane's background, while formidable in cybersecurity, does not include direct experience with DDTC licensing, DSP-5 administration, or ITAR technical data transfer controls. This gap could necessitate supplementation of Fortbridge's capabilities with external export control expertise, adding complexity and potentially cost to the engagement.
Fortbridge's cost proposal is $1.35 million per annum, which is competitive but higher than Whitmore Compliance Group's proposal.
With respect to independence, our conflict screening identified a potential concern. One of Fortbridge's senior staff members previously provided consulting services to a portfolio company of Ridgecrest Ventures — the majority equity holder of VPI. While the consulting engagement did not involve VPI itself and may ultimately be manageable from an independence perspective, the relationship could raise questions during CFIUS vetting and may require additional disclosure and explanation that introduces risk and delay into the approval process.
We assess the likelihood of CFIUS approval for Fortbridge as moderate. Dr. Keane's NSA background and active TS/SCI clearance are highly valued by the intelligence community components of CFIUS, particularly the Department of Energy and NSA-affiliated reviewers. However, the ITAR/EAR expertise gap and the potential independence concern may reduce the candidate's competitiveness relative to Whitmore Compliance Group.
E. Candidate 4 — Hargrove & Sterns Security Consulting LLC
i. Entity Information
• Full Legal Name: Hargrove & Sterns Security Consulting LLC
• Entity Type: Virginia limited liability company
• Principal Office: 1600 Tysons Boulevard, Suite 450, McLean, Virginia 22102
• Principals / Co-Lead Monitors: Thomas P. Hargrove and Jessica R. Sterns
• Background: Mr. Hargrove is a former senior official of the U.S. Secret Service, with approximately 20 years of service including supervisory roles in protective intelligence and criminal investigation. Ms. Sterns is a former FBI Supervisory Special Agent, with approximately 18 years of service in the Criminal Investigative Division, with a focus on white-collar crime, corporate fraud, and financial investigations.
• Clearance Status: Both principals hold active security clearances at the SECRET level. Both are eligible for TS/SCI clearance but do not currently hold it. Upgrade applications would need to be filed and processed.
ii. Assessment. Hargrove & Sterns Security Consulting LLC presents a solid law enforcement background, drawing on the combined experience of two principals with substantial careers in the Secret Service and FBI. However, the principals' professional experience is oriented primarily toward physical security, protective intelligence, and fraud investigation rather than counterintelligence, foreign intelligence threat assessment, or foreign investment review. Neither principal has significant experience with the specific national security concerns that arise in CFIUS transactions — namely, foreign access to classified programs, unauthorized technology transfer, and cybersecurity risks associated with foreign ownership.
The firm has no prior experience as a CFIUS third-party monitor. While the principals have performed corporate compliance assessments and internal investigations in other contexts, they have not navigated the specific requirements of a CFIUS monitoring engagement, including the preparation of annual compliance reports in the format prescribed by CFIUS, coordination with DCSA and other monitoring agencies, and the management of the complex reporting obligations that arise when monitoring classified programs and ITAR/EAR-controlled activities.
Of particular concern, the principals hold security clearances only at the SECRET level and do not currently hold TS/SCI clearances. While both are described as "eligible" for TS/SCI, the process of upgrading clearances can take six months or longer, depending on investigation backlogs and the specific access requirements involved. Given that the draft NSA requires the monitor to access classified information at the TS/SCI level — and given the targeted timeline for NSA execution in January 2024 — the absence of active TS/SCI clearances creates a significant timing risk and a substantive gap in the near term.
The firm employs approximately eight (8) full-time professional staff, which provides adequate but not robust capacity for the VPI engagement. The staff's collective expertise, while competent in corporate investigation and physical security, is less specialized in the national security compliance areas most relevant to the NSA monitoring mandate.
Hargrove & Sterns' cost proposal is $950,000 per annum — the lowest of the four candidates. However, this lower cost reflects the less specialized scope of the firm's capabilities and is not a sufficient basis for selection given the substantive qualification gaps identified above.
With respect to independence, our conflict screening identified no conflicts of interest between Hargrove & Sterns and any party to the transaction.
We assess the likelihood of CFIUS approval for Hargrove & Sterns as low. The combination of (i) the absence of active TS/SCI clearances, (ii) the lack of any prior CFIUS monitoring experience, and (iii) the principals' limited counterintelligence background represents a profile that CFIUS has historically disfavored. In our experience, CFIUS has rejected candidates with similar profiles in prior semiconductor and defense-sector transactions, and we do not believe that this candidate would survive the approval process.
F. Comparative Summary Table
The following table summarizes the evaluation of all four candidates across the eight criteria identified in Section III.A above:
Whitmore Compliance Group LLC is rated highest across the weighted evaluation criteria. Its combination of a deeply qualified principal, active TS/SCI clearance, proven CFIUS monitoring track record, relevant sector expertise, robust organizational capacity, verified independence, competitive cost, and high likelihood of CFIUS approval distinguishes it from the other candidates.
IV. RECOMMENDED CANDIDATE: WHITMORE COMPLIANCE GROUP LLC
Based on the comprehensive evaluation set forth in Section III above, Calderwood & Harkness formally recommends that HSAG propose Whitmore Compliance Group LLC, with Gerald Whitmore serving as the principal monitor, as the third-party compliance monitor for submission to CFIUS for approval under the draft NSA.
The rationale for this recommendation may be summarized as follows:
Professional Qualifications. Gerald Whitmore's approximately 25-year career in the FBI Counterintelligence Division provides the deep counterintelligence expertise that CFIUS has consistently required of monitors in semiconductor and defense-sector NSAs. His background directly addresses CFIUS's preliminary national security concerns regarding foreign access to classified programs and unauthorized technology transfer.
Active TS/SCI Clearance. Mr. Whitmore's active TS/SCI clearance enables him to immediately access classified information and facilities, including VPI's classified programs and the restricted areas of the Albuquerque fabrication facility. No clearance upgrade or processing delay is required.
Prior CFIUS Monitoring Experience. Whitmore Compliance Group has served as the CFIUS-appointed monitor in at least three prior semiconductor and defense-sector NSAs. This track record demonstrates the firm's ability to navigate the specific expectations and requirements of the CFIUS monitoring role and provides CFIUS with a known and proven entity.
Organizational Depth. The firm's team of approximately 12 multi-disciplinary professionals — including former DOJ national security attorneys, former DCSA industrial security specialists, former military counterintelligence officers, and certified cybersecurity auditors — provides the breadth and depth of expertise necessary to conduct comprehensive monitoring across all NSA compliance areas.
Verified Independence. Whitmore Compliance Group and Gerald Whitmore have no prior or current relationships, financial interests, or affiliations with any party to the transaction. Independence has been confirmed through both internal conflict screening and independent verification by Calderwood & Harkness.
Cost Competitiveness. The proposed annual fee of $1.2 million falls in the lower-middle range of the benchmark observed in comparable semiconductor-sector NSA monitoring engagements ($900,000–$1.8 million), representing a reasonable and competitive cost for the scope of services required.
High Likelihood of CFIUS Approval. Based on Mr. Whitmore's profile, track record, and the informal pre-sounding conducted with CFIUS monitoring agency contacts, we assess a high likelihood of CFIUS approval for this candidate.
We recommend that the name of Whitmore Compliance Group LLC be submitted to CFIUS at the December 8, 2023 negotiation session for formal approval, and that HSAG management confirm authorization to proceed with this submission by no later than December 6, 2023.
V. SCOPE OF MONITORING UNDER THE DRAFT NSA
This section provides a detailed analysis of the scope of monitoring obligations set forth in the draft NSA and the corresponding responsibilities that the third-party monitor will be required to fulfill. An understanding of these obligations is essential for evaluating the adequacy of the recommended candidate's qualifications and the reasonableness of the proposed fee structure.
A. Annual Compliance Audits
Under Article VII, Section 7.2 of the draft NSA, the monitor is required to conduct comprehensive annual compliance audits covering all NSA obligations. These audits are intended to provide CFIUS monitoring agencies with an independent, systematic verification that the parties are fulfilling their mitigation commitments and that the national security concerns identified during the CFIUS review process are being effectively addressed.
The audit areas specified in the draft NSA encompass the following:
Board Governance. The monitor must verify that the VPI board of directors maintains its mandated five-member composition, consisting of: (i) three (3) Security Board Members — all of whom must be U.S. citizens holding or eligible for TS/SCI security clearances, including one independent Security Director who serves as chair of the Government Security Committee — and (ii) two (2) HSAG designees who are not granted access to classified information, ITAR-controlled technical data, or other U.S. government-controlled information. The monitor must verify the operational effectiveness of the Government Security Committee (GSC), including its exclusive authority over classified and ITAR-controlled programs, personnel security decisions, facility security matters, and any other matters designated by DCSA. The monitor must review GSC meeting minutes, resolutions, and decision records to confirm that the GSC is exercising its authorities in accordance with the NSA.
Technology Control Plan (TCP) Compliance. The monitor must review all technology transfers between VPI and HSAG (and any HSAG affiliate) to verify that no ITAR-controlled or EAR-controlled VPI technical data, manufacturing know-how, or defense articles have been transferred to non-U.S. persons without prior written authorization from the appropriate U.S. government authority (DDTC for ITAR-controlled items; BIS for EAR-controlled items). The TCP review encompasses examination of technology access requests, authorization records, employee certifications, training records, and incident logs.
Cybersecurity Compliance. The monitor must verify VPI's compliance with NIST Special Publication 800-171 (Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations), including review of VPI's System Security Plan (SSP) and Plan of Action and Milestones (POA&M). The monitor must review the results of annual third-party penetration testing of VPI's IT systems, which the NSA requires to be conducted by a qualified independent cybersecurity firm. The monitor must verify that VPI's information technology systems remain physically and logically separated from HSAG's global network, with no shared cloud infrastructure, interconnected networks, or common authentication systems. The monitor must also review VPI's cybersecurity incident reporting records to confirm that all reportable incidents have been reported to DCSA within 72 hours, as required by NSA Annex D.
Facility Access Controls. The monitor must verify that HSAG personnel — including HSAG employees, officers, directors, contractors, and agents — have not accessed VPI's classified facilities, including Sections C-7 through C-12 of the Albuquerque fabrication facility clean room, without prior written approval from both DCSA and the Government Security Committee. The monitor must review visitor logs, badge access records, entry/exit records, and any requests for HSAG personnel access to VPI classified areas. Any unauthorized access, or any access that occurred without proper advance approval, must be identified and reported as a compliance deficiency.
Data Segregation. The monitor must verify that VPI's information technology systems maintain complete physical and logical separation from HSAG's global network. This includes verification that no data is shared between VPI and HSAG systems through shared servers, cloud storage, email systems, collaboration platforms, or any other electronic medium without appropriate authorization and compliance with applicable export control requirements. The monitor must review network architecture diagrams, firewall configurations, access control lists, and data flow analyses to confirm ongoing segregation.
Personnel Continuity. The monitor must verify that designated key VPI personnel remain employed by VPI for the minimum 24-month post-closing period specified in the NSA, or that any departures have been managed in accordance with the NSA's requirements. The key personnel identified in the draft NSA include:
• Dr. Nathan Trevorrow — Chief Executive Officer
• Marissa Sung-Avila — President and Chief Operating Officer
• Col. (Ret.) Bryce Hendrickson — Vice President, Government Programs / Facility Security Officer (FSO)
If any key personnel depart during the 24-month retention period, the monitor must verify that replacement candidates have been approved by the Government Security Committee and DCSA prior to assumption of duties, and that no gap in critical security functions (particularly the FSO role) has occurred.
Pre-Notification Compliance. The monitor must verify that HSAG has provided timely notification to CFIUS — at least 30 days in advance — before implementing any material change to VPI's business. Material changes subject to pre-notification include, but are not limited to: divestitures or transfers of VPI assets or business lines; entry into new contracts with foreign subcontractors or foreign government entities; changes to VPI's cleared personnel roster; modifications to VPI's facility security clearance; and any other changes that could affect VPI's compliance posture under the NSA.
The first annual compliance audit is due within 12 months of the NSA execution date. Based on the targeted NSA execution date of January 19, 2024, the first annual audit would be due by approximately January 19, 2025.
B. Annual Compliance Reports to CFIUS Monitoring Agencies
Under Article VII, Section 7.4 of the draft NSA, the monitor is required to prepare and submit written annual compliance reports to the CFIUS monitoring agencies following the completion of each annual audit. The designated recipients of the annual compliance reports include:
• The Defense Counterintelligence and Security Agency (DCSA), as the primary monitoring agency designated under the NSA;
• The Department of the Treasury, Office of Investment Security (OIS), as CFIUS Chair;
• The Department of Defense; and
• The Department of Energy.
The annual compliance reports must follow the template provided in NSA Annex E (Annual Compliance Report Template), which prescribes a standardized format for presenting audit findings, compliance assessments, and recommendations. The reports must address all audit areas specified in Section V.A above and must specifically identify:
• Any instances of non-compliance with NSA obligations, including the nature, scope, and duration of each instance;
• Any potential violations of applicable law (ITAR, EAR, NISPOM, or other regulatory requirements) identified during the audit;
• Remediation actions taken or in progress to address identified compliance deficiencies;
• Recommendations for enhanced compliance measures or modifications to existing procedures; and
• An overall compliance assessment and opinion.
Annual compliance reports must be submitted to the designated monitoring agencies within sixty (60) days following the completion of each annual audit.
C. Ad Hoc Reviews and Incident Investigations
In addition to the scheduled annual compliance audits, the monitor has the authority under Article VII, Section 7.5 of the draft NSA to conduct unscheduled, ad hoc reviews at any time if the monitor identifies potential compliance concerns or receives reports of potential violations from any source — including VPI employees, HSAG personnel, DCSA, or other government agencies.
The monitor is specifically required to investigate:
• Any cybersecurity incident reported by VPI, including breaches, intrusions, malware infections, unauthorized access to VPI IT systems, or exfiltration of data. The monitor must include findings from any cybersecurity incident investigation in its regular annual compliance report or, if warranted by the severity or urgency of the incident, in a supplemental report submitted to CFIUS monitoring agencies on an expedited basis.
• Any reported breach of the Technology Control Plan (TCP), including any unauthorized transfer of ITAR-controlled or EAR-controlled technical data to non-U.S. persons, unauthorized disclosure of controlled information, or failure to follow TCP procedures.
• Any unauthorized access to VPI's classified facilities, including access by HSAG personnel or any other unauthorized individual to Sections C-7 through C-12 of the Albuquerque fabrication facility or any other classified area.
• Any unauthorized transfer of controlled technical data, manufacturing know-how, or proprietary information to HSAG, HSAG affiliates, or any non-U.S. person without appropriate U.S. government authorization.