1032-00004 · Client 1032 · NSA Negotiation

tcp-requirements-memo.docx DOCUMENT M&A / Corporate

66 / 79 ← → ✕

MEMORANDUM

PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT

To: Dr. Maximilian Ehrhardt, Chief Executive Officer, Halcyon Semiconductor AG Katarina Brückner, Chief Financial Officer, Halcyon Semiconductor AG Stefan Lohse, General Counsel, Halcyon Semiconductor AG

From: Margaret "Peggy" Ashworth, Of Counsel, National Security & CFIUS Practice Lt. Col. (Ret.) David Caruso, Senior Counsel, Government Contracts & Export Controls Practice Priya Venkataraman, Associate, International Trade & Sanctions Practice Calderwood & Harkness LLP

Date: November 17, 2023

Re: Analysis of Technology Control Plan Requirements Under the Proposed National Security Agreement — Acquisition of Marlowe Asset Management Photonics Inc. (CFIUS Case No. CFIUS-023-07-3841)

Right-click to update Table of Contents

I. Executive Summary

This memorandum analyzes the Technology Control Plan ("TCP") obligations that will be imposed on Halcyon Semiconductor AG ("HSAG") and Marlowe Asset Management Photonics Inc. ("VPI") under the proposed National Security Agreement ("NSA," docket reference NSA-2024-0019) currently being negotiated with the Committee on Foreign Investment in the United States ("CFIUS"). The TCP is one of the central pillars of the mitigation framework that CFIUS will require as a condition of clearing HSAG's proposed acquisition of VPI, and its provisions will materially affect how HSAG may access, use, and derive value from VPI's technology portfolio following consummation of the transaction.

HSAG has proposed to acquire one hundred percent (100%) of the outstanding equity of VPI, a Delaware C-corporation headquartered at 7400 Ridgeline Parkway, Colorado Springs, Colorado 80919, in an all-cash transaction valued at approximately $1.42 billion. The acquisition will be effectuated through Halcyon US Holdings Inc., a Delaware C-corporation formed as HSAG's acquisition vehicle. VPI is a designer and manufacturer of advanced gallium-nitride ("GaN") power amplifier chips with significant applications in defense radar systems, satellite communications, and commercial 5G infrastructure. VPI holds a Facility Security Clearance at the SECRET level, maintains active registrations with the Directorate of Defense Trade Controls ("DDTC"), and is a party to fourteen (14) active Department of Defense contracts with an aggregate backlog of approximately $193 million. The breadth and sensitivity of VPI's controlled technology portfolio are the primary drivers of CFIUS's insistence on a comprehensive TCP.

The TCP will be formalized as Annex B to the NSA and will govern all aspects of access to, use of, and transfer of VPI technical data and technology. The core obligation imposed by the TCP is a prohibition on the transfer of VPI technical data subject to the International Traffic in Arms Regulations ("ITAR") or the Export Administration Regulations ("EAR") to any non-U.S. person — including HSAG personnel who are not U.S. citizens or U.S. lawful permanent residents — without prior authorization from the applicable U.S. government agency (DDTC for ITAR-controlled items; the Bureau of Industry and Security ("BIS") for EAR-controlled items). This prohibition extends to so-called "deemed exports," meaning that the mere disclosure of controlled technical data to a non-U.S. person — whether orally, visually, or electronically, and whether occurring in the United States or abroad — constitutes a regulated transfer requiring government authorization.

The TCP must be integrated with VPI's existing export compliance program, which has been in place since VPI's initial DDTC registration in 2011 (Registration No. M-24817). However, VPI's current compliance infrastructure was designed for a privately held U.S. company with no foreign parent, and it must be substantially enhanced to address the unique compliance challenges presented by HSAG's foreign ownership and the specific requirements of the TCP as negotiated with CFIUS.

In terms of operational impact, the TCP will impose significant constraints on HSAG's ability to integrate VPI's technology with HSAG's global operations. VPI's defense-related R&D activities, which involve ITAR-controlled technical data and classified programs, must remain ring-fenced within VPI's U.S. operations, staffed and supervised exclusively by U.S. persons. Manufacturing activities at VPI's Albuquerque fabrication facility (9200 Innovation Boulevard, Albuquerque, New Mexico 87113) involve controlled technical data — including proprietary GaN epitaxial recipes among VPI's thirty-one (31) registered internal trade secrets — and HSAG manufacturing engineers who are not U.S. persons cannot participate in classified or controlled manufacturing processes at the facility. Cross-border R&D collaboration between VPI and HSAG's German-based engineering teams will be severely restricted for defense-related technology and will require case-by-case government authorization.

The most viable near-term pathway for HSAG to realize technology integration value from the acquisition lies in VPI's commercial 5G infrastructure product lines, which may qualify for EAR license exceptions permitting limited sharing with HSAG's German operations, subject to item-by-item classification review and TCP officer approval.

Our recommendation is that HSAG can comply with the TCP requirements while preserving the fundamental commercial value of the acquisition, but the company must be prepared to invest in robust compliance infrastructure and accept significant limitations on cross-border technology integration in the near term. The remainder of this memorandum sets forth in detail the legal framework governing TCPs, the specific obligations contained in the draft TCP, the operational and financial implications for HSAG and VPI, and our recommendations for the ongoing NSA negotiations.

II. Background

A. Transaction Overview

Halcyon Semiconductor AG ("HSAG") is a publicly traded Aktiengesellschaft organized under the laws of the Federal Republic of Germany, with its principal offices located at Industriestraße 44, 01099 Dresden, Saxony, Germany. HSAG is registered in the German commercial register under HRB 28416 at the Amtsgericht Dresden (Legal Entity Identifier: 5299007KXQ2M4GHILZ38). HSAG's ordinary shares are listed on the Frankfurt Stock Exchange under the XETRA ticker symbol "HLC." As of June 1, 2023, HSAG's market capitalization was approximately €14.8 billion. For its fiscal year ended December 31, 2022, HSAG reported consolidated revenues of €6.12 billion and EBITDA of €1.37 billion. HSAG is a global leader in compound semiconductor design and manufacturing, with operations in Germany, the United States, Japan, South Korea, and the People's Republic of China.

HSAG is acquiring VPI through Halcyon US Holdings Inc. ("Halcyon US Holdings"), a Delaware C-corporation formed on June 5, 2023, for the sole purpose of serving as the domestic acquisition vehicle for this transaction. Halcyon US Holdings' Employer Identification Number is 93-2841067, and its registered agent is National Registered Agents of Delaware, located at 160 Greentree Drive, Suite 101, Dover, Delaware 19904. Halcyon US Holdings is a wholly owned, indirect subsidiary of HSAG.

The Stock Purchase Agreement ("SPA") was executed on June 10, 2023, and provides for HSAG's acquisition of one hundred percent (100%) of the outstanding equity of VPI for a purchase price of $1.42 billion in cash, on a cash-free, debt-free basis, with a normalized net working capital target of $34.6 million. The SPA is subject to customary closing conditions, including receipt of all required regulatory approvals. CFIUS clearance is specified as a condition precedent to closing under Section 7.01(c) of the SPA.

Marlowe Asset Management Photonics Inc. ("VPI") was incorporated in the State of Delaware on February 14, 2009 (EIN 26-4371885). VPI designs and manufactures advanced gallium-nitride ("GaN") power amplifier chips that are used in a range of critical defense and commercial applications, including defense radar systems, satellite communications platforms, and next-generation 5G wireless infrastructure. VPI's products are fabricated on silicon carbide ("SiC") substrates using proprietary epitaxial growth and device fabrication processes.

VPI operates a 45,000-square-foot GaN-on-SiC fabrication facility ("Albuquerque Fab") located at 9200 Innovation Boulevard, Albuquerque, New Mexico 87113. The Albuquerque Fab holds a Facility Security Clearance ("FCL") at the SECRET level, issued under the National Industrial Security Program, and is assigned CAGE Code 7VK92 by the Defense Logistics Agency. The Albuquerque Fab is VPI's sole manufacturing facility and is the site of all classified and controlled manufacturing activities.

VPI's corporate headquarters and design center are located at 7400 Ridgeline Parkway, Colorado Springs, Colorado 80919. The Colorado Springs facility houses VPI's executive leadership, business development, and a portion of VPI's design engineering team. Certain design engineering functions are also performed at the Albuquerque Fab.

For its fiscal year ended December 31, 2022, VPI reported revenues of $287.4 million and EBITDA of $61.2 million. As of the date of this memorandum, VPI employs approximately 486 individuals. Of these, 212 employees — representing approximately 43.6% of VPI's total workforce — hold active U.S. government security clearances at the SECRET level or above. The high proportion of cleared employees reflects VPI's deep involvement in classified and controlled defense programs.

VPI is a party to fourteen (14) active Department of Defense contracts, acting as both a prime contractor and a subcontractor. The aggregate backlog across these contracts is approximately $193 million. The specific contracts and their associated programs are detailed in Section II.C below.

HSAG currently maintains U.S. operations through Halcyon US Inc. (EIN 81-3056429), a Delaware corporation located at 11501 Alterra Parkway, Suite 300, Austin, Texas 78758. Halcyon US Inc. operates as a fabless design center with approximately 320 employees focused on commercial semiconductor design for automotive, industrial, and telecommunications applications. Halcyon US Inc. does not perform any classified work and does not hold a Facility Security Clearance. Halcyon US Inc. is not currently subject to any CFIUS mitigation agreement or foreign ownership, control, or influence ("FOCI") mitigation instrument.

B. CFIUS Review Status

HSAG and VPI submitted a voluntary joint notice to CFIUS on July 14, 2023, pursuant to 31 C.F.R. Part 800, notifying the Committee of the proposed covered transaction. CFIUS accepted the filing on July 21, 2023, commencing the initial forty-five (45) day review period.

During the initial review period, CFIUS issued its first Request for Information ("RFI") on August 4, 2023, seeking supplemental information regarding VPI's controlled technology portfolio, VPI's government contract relationships, and HSAG's global corporate structure, including the operations of HSAG's China subsidiary, Halcyon Semiconductor (Shanghai) Co., Ltd. The parties submitted a supplemental response on August 18, 2023, addressing each item raised in the first RFI.

Upon the conclusion of the initial forty-five (45) day review period, CFIUS initiated an additional forty-five (45) day investigation on September 4, 2023, as permitted under Section 721(b)(2) of the Defense Production Act. The initiation of the investigation phase is not unusual for transactions of this nature and complexity, particularly where the target company holds a Facility Security Clearance and is engaged in classified defense programs.

CFIUS issued a second RFI on September 22, 2023, focusing on HSAG's planned technology integration strategy, VPI's employee access controls for classified and controlled information, and the structure of HSAG's board of directors and executive leadership with respect to any individuals who are nationals of countries of concern. The parties submitted a second supplemental response on October 6, 2023.

On October 20, 2023, CFIUS communicated to the parties four preliminary national security concerns identified during the investigation. These concerns included: (1) the potential transfer of ITAR-controlled and EAR-controlled technology from VPI to HSAG personnel who are non-U.S. persons, including through deemed exports; (2) the risk of foreign influence over VPI's classified programs and cleared workforce; (3) the potential for disruption or degradation of VPI's supply of critical defense components to the U.S. military; and (4) cybersecurity risks arising from integration of VPI's IT systems with HSAG's global network. The first of these concerns — the risk of unauthorized technology transfer — is the primary driver of the TCP requirement.

Following communication of the preliminary national security concerns, the parties and CFIUS entered into negotiations regarding a proposed National Security Agreement. CFIUS circulated an initial draft NSA on November 3, 2023. The first NSA negotiation session was held on November 9, 2023, at which the parties submitted HSAG's initial buyer's redline to the draft NSA. The TCP provisions are contained in the draft NSA as Annex B and represent one of the central pillars of the overall mitigation framework. Other NSA annexes address board governance (Annex A), classified program protections (Annex C), cybersecurity requirements (Annex D), government contract continuity (Annex E), and facility access procedures (Annex F).

C. VPI's Controlled Technology Profile

VPI's technology portfolio encompasses items controlled under both the ITAR and the EAR, as well as proprietary information subject to government data rights clauses and trade secret protections. The breadth and sensitivity of VPI's controlled technology profile are the fundamental reasons CFIUS has determined that a comprehensive TCP is necessary as a condition of transaction clearance.

ITAR-Controlled Items. VPI designs and manufactures products that constitute defense articles listed on the United States Munitions List ("USML") in ITAR Category XI(a)(3) (Military Electronics), specifically including GaN power amplifier modules and related components designed for military radar and electronic warfare applications. VPI has been registered with the DDTC at the U.S. Department of State since 2011, under Registration No. M-24817. VPI's DDTC registration has been maintained continuously and is current. VPI currently holds three (3) active DSP-5 export licenses authorizing the transfer of certain defense articles to end-users in the United Kingdom and the Commonwealth of Australia, both NATO allies and members of the AUKUS security partnership. These licenses will require amendment to reflect the post-closing change in VPI's ownership structure.

EAR-Controlled Items. VPI also designs and manufactures dual-use components for commercial applications, including 5G wireless infrastructure and satellite communications systems, that are controlled under the EAR. VPI's primary Export Control Classification Numbers ("ECCNs") include: ECCN 3A001 (certain microwave or millimeter wave discrete devices, integrated circuits, and components designed for operation at frequencies exceeding 2.7 GHz); ECCN 3A991 (electronic items not controlled by 3A001 but meeting specified performance parameters); and ECCN 3E001 (technology according to the General Technology Note for the development or production of items controlled under 3A001). The dual-use character of certain VPI products — serving both defense and commercial markets — adds complexity to the TCP classification framework, as the export control requirements differ depending on whether an item is classified under the ITAR or the EAR.

intellectual Property Portfolio. VPI holds a substantial portfolio of forty-seven (47) granted U.S. patents and twelve (12) pending patent applications, organized across three principal patent families:

(a) GaN-on-SiC Epitaxial Growth Process — eight (8) patents (U.S. Patent Nos. 9,XXX,001 through 9,XXX,008), with the earliest priority date in 2012, covering VPI's proprietary processes for growing high-quality GaN epitaxial layers on SiC substrates;

(b) HEMT Gate Structure Optimization — nineteen (19) patents (U.S. Patent Nos. 10,XXX,101 through 10,XXX,119), with the earliest priority date in 2015, covering innovations in high-electron-mobility transistor ("HEMT") gate geometries, passivation processes, and reliability enhancement techniques; and

(c) mmWave Broadband Matching Network — twenty (20) patents (U.S. Patent Nos. 11,XXX,201 through 11,XXX,220), with the earliest priority date in 2018, covering novel circuit topologies and impedance matching techniques for broadband millimeter-wave power amplifiers.

Twenty-three (23) of the forty-seven (47) granted patents were developed, in whole or in part, under U.S. government-funded contracts. These government-funded patents are subject to the government's march-in rights under 35 U.S.C. § 203 (as implemented by the Bayh-Dole Act) and to the patent rights provisions of DFARS 252.227-7038 (Patent Rights — Ownership by the Contractor (Large Business)). The government also retains a nonexclusive, nontransferable, irrevocable, paid-up license to practice or have practiced each such invention throughout the world by or on behalf of the United States. These government rights impose additional constraints on how HSAG may exploit VPI's patent portfolio, beyond the export control restrictions addressed by the TCP.

Trade Secrets. VPI maintains thirty-one (31) registered internal trade secrets under its trade secret management program, which is administered by VPI's Vice President of Engineering, Marissa Sung-Avila. These trade secrets primarily relate to proprietary GaN epitaxial growth recipes (including specific material compositions, growth temperatures, gas flow parameters, and post-growth annealing protocols) and die-level reliability screening processes (including accelerated life testing methodologies and failure analysis procedures). These trade secrets represent some of VPI's most commercially and strategically valuable proprietary information, and their protection is a critical component of the TCP.

Government Contract Portfolio. VPI is a party to fourteen (14) active DoD contracts, with an aggregate backlog of approximately $193 million, as follows:

• U.S. Army PEO IEW&S: $52.3 million backlog — supply of GaN HEMT modules for the AN/TPS-80 Ground/Air Task-Oriented Radar (G/ATOR) program;

• Air Force Research Laboratory ("AFRL"): $41.7 million — development and qualification of next-generation millimeter-wave power amplifiers for advanced electronic warfare applications;

• Missile Defense Agency ("MDA"): $38.9 million — design and fabrication of GaN-based transmit/receive ("T/R") modules for missile defense radar systems;

• Subcontract to Ironclad Defense Systems Inc. (prime contract: U.S. Navy NAVSEA): $34.1 million — supply of GaN power amplifier components for naval shipboard radar systems; and

• Department of Homeland Security, Science and Technology Directorate ("DHS S&T"): $26.0 million — development and production of radio frequency components for border surveillance radar systems.

Technical data generated under these contracts is subject to the data rights provisions of the applicable DFARS clauses, and in many cases is subject to additional contract-specific restrictions on foreign access and dissemination. The TCP must account for these contract-specific requirements in addition to the general ITAR and EAR obligations.

III. Legal Framework Governing Technology Control Plans

A. CFIUS Authority

The Committee on Foreign Investment in the United States derives its authority from Section 721 of the Defense Production Act of 1950, as amended ("DPA"), codified at 50 U.S.C. § 4565. Section 721 was substantially amended by the Foreign Investment Risk Review Modernization Act of 2018 ("FIRRMA"), Pub. L. No. 115-232, which broadened CFIUS's jurisdiction and enhanced its authority to impose mitigation conditions on covered transactions. The implementing regulations are set forth at 31 C.F.R. Part 800 (governing covered transactions involving control of a U.S. business) and 31 C.F.R. Part 802 (governing certain real estate transactions), as well as the procedural rules in 31 C.F.R. Part 802.

Under Section 721(l)(1) of the DPA, CFIUS is authorized to impose mitigation agreements, conditions, or orders — including, but not limited to, National Security Agreements — as a condition of clearing a covered transaction where the Committee has identified national security risks that require remediation short of blocking the transaction entirely. The Technology Control Plan is a standard and widely used mitigation tool within NSAs, particularly in transactions where the target company possesses controlled technology — whether classified, ITAR-controlled, EAR-controlled, or subject to government data rights — and the acquirer is a foreign person. The TCP is designed to ensure that the target company's controlled technology remains protected from unauthorized access and transfer following the change in ownership, while still permitting the acquirer to realize the legitimate business value of the acquisition.

TCP obligations contained within an NSA are legally binding on the parties. The NSA constitutes a binding agreement between the transaction parties and the U.S. government, typically represented by the CFIUS member agencies (in this case, the Department of the Treasury, the Department of Defense, the Department of Energy, and such other agencies as may be designated as monitoring agencies). Violation of the TCP or any other provision of the NSA may trigger significant consequences, including: (a) civil monetary penalties of up to $250,000 per violation per day, as specified in Section 12.3 of the draft NSA; (b) injunctive relief sought by the U.S. government in federal court to compel compliance; and (c) in the most severe cases, mandated divestiture of the acquired business pursuant to CFIUS's authority under Section 721(l)(3) of the DPA. The gravity of these potential consequences underscores the importance of establishing a robust TCP compliance infrastructure from the outset.

B. ITAR Framework (22 C.F.R. Parts 120–130)

The International Traffic in Arms Regulations ("ITAR") are administered by the Directorate of Defense Trade Controls ("DDTC") within the Bureau of Political-Military Affairs at the U.S. Department of State, pursuant to the Arms Export Control Act ("AECA"), 22 U.S.C. §§ 2751–2799aa-2. The ITAR control the export, temporary import, and brokering of defense articles, defense services, and related technical data listed on the United States Munitions List ("USML"), which is set forth in 22 C.F.R. Part 121.

As noted above, VPI's products include defense articles listed in ITAR Category XI(a)(3) of the USML, encompassing military electronics and related components. The technical data associated with the design, development, engineering, manufacture, production, assembly, testing, repair, maintenance, modification, operation, demilitarization, destruction, or processing of these defense articles is also controlled under the ITAR as "technical data" within the meaning of 22 C.F.R. § 120.33 (as revised effective December 30, 2020).

A critical concept under the ITAR for purposes of the TCP is the definition of "transfer." Under ITAR § 120.17 (as revised), a "transfer" includes any disclosure of technical data to a foreign person, whether in the United States or abroad. This is commonly referred to as the "deemed export" concept — the disclosure of ITAR-controlled technical data to a foreign person within the United States is deemed to be an export to the country of the foreign person's nationality, even though the technical data has not physically left U.S. territory. For purposes of the ITAR, a "foreign person" is any natural person who is not a U.S. citizen, U.S. lawful permanent resident (i.e., green card holder), or a protected individual as defined under 8 U.S.C. § 1324b(a)(3). This definition has direct and significant implications for HSAG personnel who are German citizens or nationals of other countries: any disclosure of VPI's ITAR-controlled technical data to such persons requires either a valid export license (typically a DSP-5 license) or an applicable ITAR exemption.

VPI's DDTC Registration No. M-24817 must be maintained continuously post-closing. Pursuant to ITAR § 122.4(a), VPI is required to notify DDTC of any change in its ownership or control within sixty (60) days of the effective date of the change. Given that the CFIUS review and NSA process is running concurrently, we anticipate coordinating the DDTC change-of-ownership notification with the acquisition closing. VPI's three (3) active DSP-5 export licenses will also require amendment to reflect the change in ownership, which may necessitate additional processing time at DDTC.

The consequences of non-compliance with ITAR requirements are severe. An unauthorized transfer of ITAR-controlled technical data to HSAG's non-U.S. personnel — including, for example, Dr. Ehrhardt or Ms. Brückner — would constitute a violation of ITAR § 127.1 (Violations). Such violations may subject VPI and HSAG to criminal penalties under 22 U.S.C. § 2778 (including fines of up to $1 million per violation and imprisonment of up to twenty (20) years for willful violations) and civil penalties under 22 C.F.R. § 127.10 (currently up to $1,227,271 per violation, as adjusted for inflation). In addition, the U.S. government may impose debarment from participation in future defense trade activities. The TCP is designed, in substantial part, to prevent inadvertent ITAR violations that could arise from the integration of VPI into HSAG's global corporate structure.

C. EAR Framework (15 C.F.R. Parts 730–774)

The Export Administration Regulations ("EAR") are administered by the Bureau of Industry and Security ("BIS") within the U.S. Department of Commerce, pursuant to the Export Control Reform Act of 2018 ("ECRA"), 50 U.S.C. §§ 4801–4852, and Executive Order 13222. The EAR control the export, reexport, and transfer (in-country) of dual-use items — those with both commercial and military or proliferation applications — as well as certain items that are exclusively commercial but controlled for foreign policy or other reasons. Items subject to the EAR are classified according to the Commerce Control List ("CCL"), set forth in Supplement No. 1 to 15 C.F.R. Part 774.

VPI's dual-use products and associated technology are primarily controlled under the following ECCNs:

• ECCN 3A001: Certain microwave or millimeter wave discrete devices, integrated circuits, and components designed for operation at frequencies exceeding 2.7 GHz, meeting specified performance parameters for power output, noise figure, or bandwidth;

• ECCN 3A991: Electronic items not controlled by ECCN 3A001 but meeting separate performance specifications relevant to telecommunications and industrial applications; and

• ECCN 3E001: "Technology" according to the General Technology Note for the "development" or "production" of items controlled under ECCN 3A001, including design data, manufacturing know-how, and test methodologies.

The EAR's "deemed export" rule, set forth in 15 C.F.R. § 734.13, provides that any release of "technology" or "source code" subject to the EAR to a foreign national within the United States is deemed to be an export to the country of that person's most recent country of citizenship or permanent residency. This rule is conceptually similar to, but technically distinct from, the ITAR's deemed export provisions. For EAR purposes, a "foreign national" means any natural person who is not a U.S. citizen, a U.S. lawful permanent resident, or a protected individual under the Immigration and Nationality Act. As with the ITAR, this rule means that the disclosure of VPI's EAR-controlled technology to HSAG's non-U.S. employees would require either a BIS export license or an applicable license exception.

Germany is designated as a participant in Country Group A:1 (Wassenaar Arrangement participants) under the EAR, which is a favorable designation for purposes of determining the availability of certain license exceptions. In particular, License Exception Strategic Trade Authorization ("STA"), codified at 15 C.F.R. § 740.20, may be available for certain eligible items destined for eligible end-users in Country Group A:1 destinations, subject to specific conditions and limitations. However, the availability of License Exception STA must be assessed on an item-by-item basis, as not all ECCNs are eligible and additional requirements (such as the consignee statement required under § 740.20(d)(2)) must be satisfied. The TCP must incorporate protocols for evaluating the applicability of License Exception STA and other potential license exceptions on a case-by-case basis, as discussed in detail in Section IV.E below.

D. NISPOM and Facility Security Requirements

The National Industrial Security Program Operating Manual ("NISPOM"), now codified as a federal regulation at 32 C.F.R. Part 117 (effective February 24, 2021), governs the protection of classified information entrusted to cleared defense contractors participating in the National Industrial Security Program ("NISP"). The NISPOM establishes baseline security requirements for personnel security, physical security, information security, and security education and training for all cleared contractor facilities.

VPI's Facility Security Clearance at the SECRET level at the Albuquerque Fab is administered under the NISPOM and overseen by the Defense Counterintelligence and Security Agency ("DCSA"), which serves as the cognizant security agency ("CSA") for VPI. VPI's Facility Security Officer ("FSO") is Col. (Ret.) Bryce Hendrickson, who holds a current TS/SCI security clearance and is responsible for the day-to-day administration of VPI's industrial security program.

When a cleared contractor facility is subject to foreign ownership, control, or influence ("FOCI"), the NISPOM requires that the FOCI be mitigated through one of several prescribed mechanisms, including a Special Security Agreement ("SSA"), Proxy Agreement, or Voting Trust Agreement. In the context of a CFIUS-reviewed transaction, the NSA typically functions as the equivalent of, or in conjunction with, an SSA for FOCI mitigation purposes under the NISPOM. The NSA establishes a Government Security Committee ("GSC") composed of independent Security Board Members who are U.S. citizens holding or eligible for TS/SCI clearances, charged with overseeing the cleared contractor's security and compliance obligations.

The TCP is a component of this broader FOCI mitigation framework but is distinct from the classified information protections contained in NSA Annex C (GSC Provisions). The TCP focuses on the protection of controlled unclassified information ("CUI"), ITAR-controlled technical data, EAR-controlled technology, and proprietary information such as trade secrets. Classified information — which includes all national security information classified at the CONFIDENTIAL, SECRET, or TOP SECRET levels — is separately governed by the GSC provisions and the NISPOM. The TCP addresses classified information only to state the absolute prohibition on any transfer of classified information to HSAG personnel. DCSA will serve as one of the monitoring agencies under the NSA, with responsibility for oversight of both the classified program protections and the TCP.

IV. Detailed Analysis of TCP Obligations

A. Scope of Controlled Information

The draft TCP, as set forth in Annex B to the draft NSA circulated by CFIUS on November 3, 2023, defines the scope of information subject to TCP protections through the term "Controlled Technical Data." This definition is deliberately broad and encompasses multiple categories of sensitive information, reflecting CFIUS's intent to establish a comprehensive protective framework.

Under Section 2.1 of the draft TCP, "Controlled Technical Data" is defined to include the following categories of information:

(a) All technical data subject to ITAR controls, as defined in 22 C.F.R. § 120.33, including but not limited to information required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance, or modification of defense articles classified under ITAR Category XI(a)(3);

(b) All "technology" and "source code" subject to EAR controls, as those terms are defined in 15 C.F.R. § 772.1, including but not limited to technology classified under ECCNs 3E001 and related entries on the Commerce Control List;

(c) All information designated as Controlled Unclassified Information ("CUI") under 32 C.F.R. Part 2002, including CUI categories established under the CUI Registry maintained by the National Archives and Records Administration, to the extent applicable to VPI's operations;

(d) VPI trade secrets, including the thirty-one (31) registered internal trade secrets maintained under VPI's trade secret management program, with particular emphasis on proprietary GaN epitaxial growth recipes and die-level reliability screening processes;

(e) Technical information developed under or delivered pursuant to U.S. government contracts and subject to the technical data rights provisions of DFARS 252.227-7013 (Rights in Technical Data — Noncommercial Items) and DFARS 252.227-7014 (Rights in Noncommercial Computer Software and Noncommercial Computer Software Documentation); and

(f) Any other technical information that VPI or the GSC determines, in its reasonable discretion, to be sensitive from a national security perspective and warranting protection under the TCP.

The TCP also covers VPI's forty-seven (47) granted U.S. patents, twelve (12) pending patent applications, and the underlying technical data associated with each patent family. Although issued patents are by definition publicly available, the underlying technical data — including unpublished specifications, experimental results, manufacturing process details, and know-how not disclosed in the patent specifications — may constitute Controlled Technical Data to the extent it is subject to ITAR, EAR, or CUI controls. This is particularly relevant for the twenty-three (23) government-funded patents, which are subject to the Bayh-Dole Act and DFARS 252.227-7038, and whose underlying technical data may be subject to government data rights restrictions.

The draft TCP excludes from the definition of "Controlled Technical Data" the following categories of information: (i) purely commercial product specifications that are already in the public domain, including published datasheets and application notes for commercially available VPI products; (ii) marketing materials, press releases, and public-facing communications that do not contain controlled technical content; and (iii) financial and business information — such as revenue data, operating metrics, and non-technical corporate records — that does not contain or incorporate any controlled technical content. These exclusions are important because they define the universe of information that HSAG may freely access as the parent company of VPI without triggering TCP compliance obligations.

B. Prohibition on Unauthorized Transfer

The core operative provision of the TCP is its prohibition on unauthorized transfers of Controlled Technical Data to non-U.S. persons. Section 3.1 of the draft TCP provides that no VPI employee, contractor, or agent may disclose, transfer, provide access to, or otherwise make available any Controlled Technical Data to any "non-U.S. person" (as that term is defined under ITAR § 120.16) without first obtaining one of the following authorizations:

(a) A valid ITAR export license (typically a DSP-5 license) or an applicable ITAR exemption, for items subject to ITAR controls;

(b) A valid EAR export license or an applicable EAR license exception, for items subject to EAR controls; or

(c) Prior written approval from the Government Security Committee established under the NSA, for items subject to NSA-specific restrictions that extend beyond the requirements of the ITAR and EAR (such as certain categories of CUI or VPI trade secrets that, while not independently export-controlled, are designated as Controlled Technical Data under the TCP due to their national security sensitivity).

The term "non-U.S. person" explicitly includes all HSAG employees who are not U.S. citizens or U.S. lawful permanent residents. Without limitation, this encompasses:

• Dr. Maximilian Ehrhardt, a German citizen serving as Chief Executive Officer of HSAG;

• Katarina Brückner, a German citizen serving as Chief Financial Officer of HSAG;

• All HSAG employees based at HSAG's headquarters in Dresden, Germany, as well as those in HSAG's Berlin office and any other non-U.S. HSAG office worldwide;

• All employees of HSAG's China subsidiary, Halcyon Semiconductor (Shanghai) Co., Ltd., including Chinese nationals employed at that subsidiary; and

• Any other HSAG employee, consultant, or contractor who is not a U.S. citizen or U.S. lawful permanent resident.

Analysis of Stefan Lohse's Status. A question has arisen regarding the TCP status of Stefan Lohse, HSAG's General Counsel. Mr. Lohse holds dual German and U.S. citizenship and is admitted to the bar of the State of New York. As a U.S. citizen, Mr. Lohse qualifies as a "U.S. person" for purposes of both the ITAR and the EAR, and the general prohibition on transfers to non-U.S. persons does not apply to him. However, the draft NSA contains an additional provision — Section 8.4 — specifying that the GSC retains oversight authority over access to Controlled Technical Data by any HSAG officer or director, even if such person is a U.S. person, where the information pertains to classified programs or relates to VPI's most sensitive government contracts. Accordingly, while Mr. Lohse's U.S. citizenship removes the automatic ITAR/EAR transfer prohibition, his role as HSAG's General Counsel — and the potential that his access to VPI information could facilitate indirect transfer to non-U.S. HSAG personnel — means that his access to certain categories of Controlled Technical Data will be subject to GSC review on a case-by-case basis.

The prohibition on unauthorized transfers extends to all forms of disclosure, including "deemed exports" — that is, oral briefings, visual demonstrations, electronic transmissions, and any other form of communication that results in a non-U.S. person gaining access to Controlled Technical Data, regardless of whether the disclosure occurs at VPI facilities, at HSAG facilities, or through any other means of communication, including telephone, videoconference, email, file sharing, or cloud-based collaboration tools.

The draft TCP further requires, consistent with the cybersecurity provisions of NSA Annex D, that VPI maintain complete physical and logical separation of its IT infrastructure from HSAG's global IT network. No shared cloud infrastructure, shared servers, shared email domains, shared file repositories, or shared collaboration platforms may be used to store, process, or transmit Controlled Technical Data. This requirement ensures that even inadvertent access by HSAG's global IT administrators or automated data synchronization processes does not result in an unauthorized transfer.

C. Information Segregation and Access Controls

1. Physical Access Controls

The TCP establishes a tiered framework for physical access controls at VPI's facilities, with the most restrictive controls applied to classified areas and progressively less restrictive controls applied to unclassified areas that nonetheless handle Controlled Technical Data.

Classified Areas at the Albuquerque Fab. VPI's classified areas at the Albuquerque Fab — specifically, clean room Sections C-7 through C-12 — are subject to an absolute prohibition on access by HSAG personnel, regardless of their citizenship status, without prior written approval from both DCSA and the Government Security Committee. This restriction is primarily governed by NSA Annex F (Facility Access Procedures) but is reinforced by the TCP to ensure comprehensive coverage. Clean room Sections C-7 through C-12 are the areas where VPI performs fabrication processes on classified defense programs, including the AN/TPS-80 radar modules for the U.S. Army and the T/R modules for the Missile Defense Agency. Access to these areas is limited to VPI employees who hold the requisite security clearances and have a need-to-know for the specific classified programs being executed in those areas.

Unclassified Areas at the Albuquerque Fab. HSAG personnel may access unclassified areas at the Albuquerque Fab under controlled conditions. Specifically, HSAG personnel seeking to visit the Albuquerque Fab must provide advance written notice to the TCP Officer no fewer than five (5) business days prior to the proposed visit. During any visit, HSAG personnel must be escorted at all times by a cleared VPI employee designated by the TCP Officer. HSAG personnel may enter only those areas where no Controlled Technical Data is displayed, accessible, or under active discussion. Prior to any visit by HSAG personnel, the TCP Officer must conduct an area sweep to confirm that no controlled materials — including technical drawings, test data, process specifications, or computer displays showing controlled information — are visible or accessible in the areas to be visited.

VPI Colorado Springs Headquarters. The access restrictions at VPI's Colorado Springs headquarters at 7400 Ridgeline Parkway are less stringent, reflecting the fact that the Colorado Springs facility does not house classified operations and that a significant portion of VPI's business development and financial operations are conducted there. HSAG personnel may visit the Colorado Springs facility for routine business meetings, including financial reviews, strategic planning sessions, and non-technical management discussions. However, the TCP requires that meeting rooms to be used by HSAG personnel be screened in advance by the TCP Officer or a designated delegate to confirm that no controlled materials are present in the room or accessible from it. No Controlled Technical Data may be presented, discussed, or referenced during any meeting attended by non-U.S. HSAG personnel unless the applicable authorization requirements of the TCP (including ITAR/EAR licensing and TCP Officer approval) have been satisfied in advance.

Visitor Logs. Comprehensive visitor logs must be maintained for all HSAG personnel visits to any VPI facility, including the Albuquerque Fab, the Colorado Springs headquarters, and any other VPI location. These logs must record the name, title, citizenship, and employer of each visitor; the date and time of arrival and departure; the areas accessed; the name of the VPI escort; and a brief description of the purpose of the visit. Visitor logs are subject to review by Whitmore Compliance Group LLC, the designated third-party compliance monitor, during annual compliance audits and ad hoc reviews.

2. Electronic Access Controls

The TCP imposes rigorous electronic access controls designed to prevent unauthorized access to Controlled Technical Data through VPI's information technology systems. These requirements complement the cybersecurity provisions of NSA Annex D but are independently enforceable under the TCP.

VPI's IT systems must be maintained on a completely separate network from HSAG's global IT infrastructure. This requirement precludes the use of shared servers, shared cloud accounts (including shared instances on public cloud platforms such as Ridgeway Industries, Crestline Systems, or Aldermere Technologies), shared email domains, shared collaboration tools (such as Northgate Data Systems, Meridian Solutions, or Aldermere Systems), and any other shared IT resources that could enable HSAG personnel to access VPI systems or data. VPI's existing IT infrastructure operates independently from HSAG's systems, which mitigates the implementation burden. However, any post-closing IT integration planning — to the extent HSAG has contemplated integrating VPI's non-controlled IT systems (such as financial reporting systems) — must be carefully reviewed by the TCP Officer to ensure that integration does not create pathways for unauthorized access to Controlled Technical Data.

VPI must maintain compliance with NIST Special Publication 800-171, "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations" (Revision 2), for the protection of CUI. This requirement is independently mandated by several of VPI's government contracts under DFARS 252.204-7012, and the TCP incorporates this requirement by reference. NIST SP 800-171 establishes one hundred ten (110) security requirements across fourteen (14) families, including access control, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, and system and information integrity.

All Controlled Technical Data must be stored in access-controlled repositories with role-based access controls ("RBAC") that limit access to authorized U.S. persons who have a legitimate need-to-know. Access permissions must be reviewed and updated on a quarterly basis by the TCP Officer to ensure that access lists remain current and accurate.

Electronic transmission of Controlled Technical Data outside VPI's internal network — including transmission to VPI employees working remotely, to VPI's government customers, or to any other authorized recipient — requires encryption using cryptographic modules validated under Federal Information Processing Standard ("FIPS") 140-2 (or its successor, FIPS 140-3). In addition, any electronic transmission of Controlled Technical Data requires pre-approval by the TCP Officer, who must verify that the transmission is authorized under applicable ITAR, EAR, and TCP requirements before the transmission may occur.

There is a strict prohibition on the use of HSAG-provided devices — including laptops, tablets, smartphones, and portable storage media — or HSAG-managed IT infrastructure to access or store VPI Controlled Technical Data. VPI employees and contractors must use only VPI-issued and VPI-managed devices for activities involving Controlled Technical Data. This prohibition extends to HSAG's mobile device management ("MDM") platforms, HSAG-provided virtual private network ("VPN") connections, and any other HSAG IT service.

VPI must engage a qualified third-party cybersecurity firm to conduct annual penetration testing of VPI's IT systems, with the scope of testing to include both external network penetration testing and internal vulnerability assessments. The results of each penetration test must be shared with the TCP Officer, the GSC, and Whitmore Compliance Group LLC. Any cybersecurity incidents — including suspected or confirmed breaches, unauthorized access events, and malware infections — must be reported to DCSA within seventy-two (72) hours of detection, consistent with the requirements of DFARS 252.204-7012 and the NSA's cybersecurity provisions.

3. Personnel Controls

The TCP establishes comprehensive personnel controls designed to ensure that all VPI personnel who have access to Controlled Technical Data are properly trained, vetted, and subject to ongoing compliance obligations.

Training Requirements. All VPI employees with access to Controlled Technical Data must undergo TCP-specific training within thirty (30) days of the NSA effective date. Training must be refreshed annually thereafter. The training program must cover, at a minimum: (a) the scope and categories of Controlled Technical Data; (b) the prohibition on unauthorized transfers to non-U.S. persons; (c) the deemed export concept under both ITAR and EAR; (d) the procedures for requesting and obtaining authorization for authorized transfers; (e) the roles and responsibilities of the TCP Officer and the GSC; (f) the consequences of TCP violations, including NSA penalties and ITAR/EAR criminal and civil penalties; and (g) procedures for reporting suspected TCP violations. All new hires at VPI must complete TCP training before being granted access to any Controlled Technical Data, and no exceptions to this requirement are permitted.

TCP Access List. VPI must maintain a centralized "TCP access list" that identifies, by name, each VPI employee or contractor authorized to access specific categories of Controlled Technical Data. The TCP access list must be reviewed and updated at least quarterly by the TCP Officer and must reflect any changes in personnel, job responsibilities, or clearance status. The TCP access list must be made available to Whitmore Compliance Group LLC upon request and must be submitted to the GSC annually.

Exit Protocols. When a VPI employee with access to Controlled Technical Data departs VPI — whether through resignation, termination, retirement, or any other means — the departing employee must undergo a formal debriefing conducted by the TCP Officer or a designated delegate. The debriefing must cover the employee's continuing obligations with respect to Controlled Technical Data, including any non-disclosure agreements, trade secret obligations, and export control responsibilities that survive the employment relationship. All VPI-issued devices, media, and materials in the departing employee's possession must be collected and inspected to confirm that no Controlled Technical Data has been retained. The TCP Officer must certify in writing that the exit protocol has been completed.

Key Personnel Continuity Requirement. Section 9 of the draft NSA imposes a key personnel continuity requirement, mandating that certain designated VPI employees remain employed for a minimum of twenty-four (24) months following the closing of the acquisition, or, if they depart during that period, that their replacements be approved by the GSC and DCSA prior to assumption of their duties. The designated key personnel are:

• Dr. Nathan Trevorrow, President and Chief Technology Officer of VPI, who is responsible for VPI's technology strategy, R&D program management, and technical leadership of VPI's government contract programs;

• Marissa Sung-Avila, Vice President of Engineering, who manages VPI's trade secret program and oversees the engineering teams responsible for VPI's GaN process development and product design; and

• Col. (Ret.) Bryce Hendrickson, Vice President of Government Programs and Facility Security Officer, who holds a current TS/SCI clearance and is the primary interface with VPI's government customers, DCSA, and the CFIUS monitoring agencies.

These individuals are essential to the implementation and ongoing operation of the TCP, and their continued tenure at VPI is a critical condition of the NSA. Should any of these individuals depart VPI during the twenty-four (24) month continuity period, the GSC must approve their replacements, and DCSA must concur in the appointment, before the replacement may assume the departing individual's TCP-related responsibilities.

D. TCP Officer Role and Responsibilities

The TCP requires VPI to designate a "TCP Officer" who bears day-to-day responsibility for TCP implementation, compliance monitoring, and the approval or denial of requests for access to or transfer of Controlled Technical Data. The TCP Officer serves as the central point of accountability for TCP compliance within VPI and as the primary point of contact for the GSC, the third-party compliance monitor, and the CFIUS monitoring agencies.

We recommend that Col. (Ret.) Bryce Hendrickson be designated as the TCP Officer, serving concurrently in this role with his existing positions as Vice President of Government Programs and Facility Security Officer. Col. (Ret.) Hendrickson is uniquely qualified for this role by virtue of his TS/SCI security clearance, his extensive familiarity with VPI's export compliance program, his longstanding relationships with VPI's government customers, and his deep understanding of VPI's controlled technology portfolio. Combining the TCP Officer and FSO roles in a single individual is consistent with industry practice in similar CFIUS-mitigated transactions and avoids the creation of redundant compliance structures.

The TCP Officer reports to the Government Security Committee, which is composed of three (3) Security Board Members who must be U.S. citizens holding or eligible for TS/SCI clearances. The Security Board Members are to be appointed under the terms of the NSA and serve independently of HSAG's management. The TCP Officer does not report to HSAG management on TCP matters; rather, the TCP Officer's reporting relationship on TCP-related issues runs exclusively through the GSC. This structure is designed to ensure that the TCP Officer's decisions are insulated from potential foreign influence.

The TCP Officer's specific responsibilities include, but are not limited to, the following:

(a) Reviewing and approving or denying all requests for access to Controlled Technical Data by non-U.S. persons, including HSAG personnel;

(b) Maintaining comprehensive records of all access approvals, access denials, and information transfers, including the identity of the requesting party, the nature of the information requested, the basis for the approval or denial, and the applicable ITAR, EAR, or NSA authorization;

(c) Conducting quarterly internal TCP compliance reviews, the results of which must be documented in written reports submitted to the GSC;

(d) Coordinating with Whitmore Compliance Group LLC, the designated third-party compliance monitor, during annual audits and any ad hoc reviews or investigations;

(e) Promptly reporting any TCP violations — whether suspected or confirmed — to the GSC and, as required by the NSA, to the CFIUS monitoring agencies (DCSA, the Department of the Treasury, the Department of Defense, and the Department of Energy);

(f) Coordinating with DDTC for ITAR license applications, license amendments, and required notifications (including the post-closing change-of-ownership notification under ITAR § 122.4(a));

(g) Coordinating with BIS for EAR license applications and license exception determinations;

(h) Administering the visitor management protocols at VPI's facilities for HSAG personnel visits;

(i) Overseeing the TCP training program, including scheduling, content development, and recordkeeping;

(j) Managing the TCP access list and ensuring its accuracy and currency; and

(k) Serving as VPI's Empowered Official for ITAR purposes, to the extent consistent with DDTC requirements and VPI's existing designations.

E. Procedures for Authorized Information Sharing

It is recognized that HSAG, as the parent company and sole shareholder of VPI following the closing, will have legitimate business needs for access to certain categories of VPI information. These needs include financial reporting and consolidation, strategic planning and business development, non-controlled commercial technology collaboration, and general corporate oversight. The TCP must accommodate these legitimate needs while maintaining the prohibition on unauthorized access to Controlled Technical Data.

To this end, the TCP establishes a categorical framework for authorized information sharing, with five defined categories and corresponding approval requirements:

Category 1 — Unrestricted Business Information. This category encompasses financial data (including revenue, expense, and profitability reports), employee headcount data, non-technical marketing materials, regulatory filings (other than export control filings), and similar business information that does not contain any controlled technical content. Category 1 information may be freely shared with HSAG personnel, including non-U.S. persons, without TCP Officer approval. However, VPI personnel responsible for preparing Category 1 information must exercise diligence to ensure that no Controlled Technical Data is inadvertently included in materials shared under this category.

Category 2 — Commercial Technical Information (Non-Controlled). This category encompasses product specifications that are already in the public domain (such as published datasheets and application notes), uncontrolled commercial product data, and technical information relating to VPI's 5G infrastructure products that is not subject to ITAR or EAR controls (i.e., information classified as EAR99 or otherwise not controlled). Category 2 information may be shared with HSAG after the TCP Officer has reviewed the specific information and confirmed in writing that it does not contain any controlled content. This review requirement is intended to serve as a safeguard against the inadvertent commingling of controlled and non-controlled technical data — a risk that is particularly acute given the dual-use character of many VPI products.

Category 3 — Controlled Technical Data (ITAR). This category encompasses all technical data subject to ITAR controls, including design data, manufacturing process specifications, test results, and other technical information relating to VPI's defense articles listed in ITAR Category XI(a)(3). Any transfer of Category 3 information to a non-U.S. person requires: (i) a valid DDTC authorization, which may take the form of a DSP-5 export license, a Technical Assistance Agreement ("TAA"), or an applicable ITAR exemption; (ii) TCP Officer review and pre-approval; and (iii) notification to the GSC. Given the sensitivity of ITAR-controlled items and the potential criminal and civil penalties for unauthorized transfers, the TCP imposes the most rigorous procedural requirements on Category 3 information sharing.

Category 4 — Controlled Technology (EAR). This category encompasses all technology and source code subject to EAR controls, including technology classified under ECCNs 3E001 and related entries. Any transfer of Category 4 information to a non-U.S. person requires: (i) a valid BIS export license or an applicable license exception; (ii) TCP Officer review; and (iii) documentation of the basis for any license exception determination. For items where License Exception STA (15 C.F.R. § 740.20) may be available — given Germany's membership in Country Group A:1 — the TCP Officer must prepare a written license exception determination memorializing: the specific ECCN classification of the item; the eligibility of the item for STA; the identity and eligibility of the consignee; the completion of the required consignee statement; and any other conditions of the license exception. This documentation must be retained in the Transfer Request Log and made available to the compliance monitor.

Category 5 — Classified Information. This category encompasses all national security information classified at the CONFIDENTIAL, SECRET, or TOP SECRET levels. Classified information is governed exclusively by NSA Annex C (GSC Provisions) and the NISPOM, and is never transferable to HSAG personnel under any circumstances. The TCP addresses classified information solely to state this absolute prohibition and to clarify that the TCP's procedural mechanisms — including the Transfer Request Log and TCP Officer approval — do not apply to classified information, which is managed through separate channels.

All requests for information transfer, regardless of category, must be documented in a centralized Transfer Request Log maintained by the TCP Officer. T

MEMORANDUM
PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT
To: Dr. Maximilian Ehrhardt, Chief Executive Officer, Halcyon Semiconductor AG Katarina Brückner, Chief Financial Officer, Halcyon Semiconductor AG Stefan Lohse, General Counsel, Halcyon Semiconductor AG
From: Margaret "Peggy" Ashworth, Of Counsel, National Security & CFIUS Practice Lt. Col. (Ret.) David Caruso, Senior Counsel, Government Contracts & Export Controls Practice Priya Venkataraman, Associate, International Trade & Sanctions Practice Calderwood & Harkness LLP
Date: November 17, 2023
Re: Analysis of Technology Control Plan Requirements Under the Proposed National Security Agreement — Acquisition of Marlowe Asset Management Photonics Inc. (CFIUS Case No. CFIUS-023-07-3841)
Right-click to update Table of Contents
I. Executive Summary
This memorandum analyzes the Technology Control Plan ("TCP") obligations that will be imposed on Halcyon Semiconductor AG ("HSAG") and Marlowe Asset Management Photonics Inc. ("VPI") under the proposed National Security Agreement ("NSA," docket reference NSA-2024-0019) currently being negotiated with the Committee on Foreign Investment in the United States ("CFIUS"). The TCP is one of the central pillars of the mitigation framework that CFIUS will require as a condition of clearing HSAG's proposed acquisition of VPI, and its provisions will materially affect how HSAG may access, use, and derive value from VPI's technology portfolio following consummation of the transaction.
HSAG has proposed to acquire one hundred percent (100%) of the outstanding equity of VPI, a Delaware C-corporation headquartered at 7400 Ridgeline Parkway, Colorado Springs, Colorado 80919, in an all-cash transaction valued at approximately $1.42 billion. The acquisition will be effectuated through Halcyon US Holdings Inc., a Delaware C-corporation formed as HSAG's acquisition vehicle. VPI is a designer and manufacturer of advanced gallium-nitride ("GaN") power amplifier chips with significant applications in defense radar systems, satellite communications, and commercial 5G infrastructure. VPI holds a Facility Security Clearance at the SECRET level, maintains active registrations with the Directorate of Defense Trade Controls ("DDTC"), and is a party to fourteen (14) active Department of Defense contracts with an aggregate backlog of approximately $193 million. The breadth and sensitivity of VPI's controlled technology portfolio are the primary drivers of CFIUS's insistence on a comprehensive TCP.
The TCP will be formalized as Annex B to the NSA and will govern all aspects of access to, use of, and transfer of VPI technical data and technology. The core obligation imposed by the TCP is a prohibition on the transfer of VPI technical data subject to the International Traffic in Arms Regulations ("ITAR") or the Export Administration Regulations ("EAR") to any non-U.S. person — including HSAG personnel who are not U.S. citizens or U.S. lawful permanent residents — without prior authorization from the applicable U.S. government agency (DDTC for ITAR-controlled items; the Bureau of Industry and Security ("BIS") for EAR-controlled items). This prohibition extends to so-called "deemed exports," meaning that the mere disclosure of controlled technical data to a non-U.S. person — whether orally, visually, or electronically, and whether occurring in the United States or abroad — constitutes a regulated transfer requiring government authorization.
The TCP must be integrated with VPI's existing export compliance program, which has been in place since VPI's initial DDTC registration in 2011 (Registration No. M-24817). However, VPI's current compliance infrastructure was designed for a privately held U.S. company with no foreign parent, and it must be substantially enhanced to address the unique compliance challenges presented by HSAG's foreign ownership and the specific requirements of the TCP as negotiated with CFIUS.
In terms of operational impact, the TCP will impose significant constraints on HSAG's ability to integrate VPI's technology with HSAG's global operations. VPI's defense-related R&D activities, which involve ITAR-controlled technical data and classified programs, must remain ring-fenced within VPI's U.S. operations, staffed and supervised exclusively by U.S. persons. Manufacturing activities at VPI's Albuquerque fabrication facility (9200 Innovation Boulevard, Albuquerque, New Mexico 87113) involve controlled technical data — including proprietary GaN epitaxial recipes among VPI's thirty-one (31) registered internal trade secrets — and HSAG manufacturing engineers who are not U.S. persons cannot participate in classified or controlled manufacturing processes at the facility. Cross-border R&D collaboration between VPI and HSAG's German-based engineering teams will be severely restricted for defense-related technology and will require case-by-case government authorization.
The most viable near-term pathway for HSAG to realize technology integration value from the acquisition lies in VPI's commercial 5G infrastructure product lines, which may qualify for EAR license exceptions permitting limited sharing with HSAG's German operations, subject to item-by-item classification review and TCP officer approval.
Our recommendation is that HSAG can comply with the TCP requirements while preserving the fundamental commercial value of the acquisition, but the company must be prepared to invest in robust compliance infrastructure and accept significant limitations on cross-border technology integration in the near term. The remainder of this memorandum sets forth in detail the legal framework governing TCPs, the specific obligations contained in the draft TCP, the operational and financial implications for HSAG and VPI, and our recommendations for the ongoing NSA negotiations.
II. Background
A. Transaction Overview
Halcyon Semiconductor AG ("HSAG") is a publicly traded Aktiengesellschaft organized under the laws of the Federal Republic of Germany, with its principal offices located at Industriestraße 44, 01099 Dresden, Saxony, Germany. HSAG is registered in the German commercial register under HRB 28416 at the Amtsgericht Dresden (Legal Entity Identifier: 5299007KXQ2M4GHILZ38). HSAG's ordinary shares are listed on the Frankfurt Stock Exchange under the XETRA ticker symbol "HLC." As of June 1, 2023, HSAG's market capitalization was approximately €14.8 billion. For its fiscal year ended December 31, 2022, HSAG reported consolidated revenues of €6.12 billion and EBITDA of €1.37 billion. HSAG is a global leader in compound semiconductor design and manufacturing, with operations in Germany, the United States, Japan, South Korea, and the People's Republic of China.
HSAG is acquiring VPI through Halcyon US Holdings Inc. ("Halcyon US Holdings"), a Delaware C-corporation formed on June 5, 2023, for the sole purpose of serving as the domestic acquisition vehicle for this transaction. Halcyon US Holdings' Employer Identification Number is 93-2841067, and its registered agent is National Registered Agents of Delaware, located at 160 Greentree Drive, Suite 101, Dover, Delaware 19904. Halcyon US Holdings is a wholly owned, indirect subsidiary of HSAG.
The Stock Purchase Agreement ("SPA") was executed on June 10, 2023, and provides for HSAG's acquisition of one hundred percent (100%) of the outstanding equity of VPI for a purchase price of $1.42 billion in cash, on a cash-free, debt-free basis, with a normalized net working capital target of $34.6 million. The SPA is subject to customary closing conditions, including receipt of all required regulatory approvals. CFIUS clearance is specified as a condition precedent to closing under Section 7.01(c) of the SPA.
Marlowe Asset Management Photonics Inc. ("VPI") was incorporated in the State of Delaware on February 14, 2009 (EIN 26-4371885). VPI designs and manufactures advanced gallium-nitride ("GaN") power amplifier chips that are used in a range of critical defense and commercial applications, including defense radar systems, satellite communications platforms, and next-generation 5G wireless infrastructure. VPI's products are fabricated on silicon carbide ("SiC") substrates using proprietary epitaxial growth and device fabrication processes.
VPI operates a 45,000-square-foot GaN-on-SiC fabrication facility ("Albuquerque Fab") located at 9200 Innovation Boulevard, Albuquerque, New Mexico 87113. The Albuquerque Fab holds a Facility Security Clearance ("FCL") at the SECRET level, issued under the National Industrial Security Program, and is assigned CAGE Code 7VK92 by the Defense Logistics Agency. The Albuquerque Fab is VPI's sole manufacturing facility and is the site of all classified and controlled manufacturing activities.
VPI's corporate headquarters and design center are located at 7400 Ridgeline Parkway, Colorado Springs, Colorado 80919. The Colorado Springs facility houses VPI's executive leadership, business development, and a portion of VPI's design engineering team. Certain design engineering functions are also performed at the Albuquerque Fab.
For its fiscal year ended December 31, 2022, VPI reported revenues of $287.4 million and EBITDA of $61.2 million. As of the date of this memorandum, VPI employs approximately 486 individuals. Of these, 212 employees — representing approximately 43.6% of VPI's total workforce — hold active U.S. government security clearances at the SECRET level or above. The high proportion of cleared employees reflects VPI's deep involvement in classified and controlled defense programs.
VPI is a party to fourteen (14) active Department of Defense contracts, acting as both a prime contractor and a subcontractor. The aggregate backlog across these contracts is approximately $193 million. The specific contracts and their associated programs are detailed in Section II.C below.
HSAG currently maintains U.S. operations through Halcyon US Inc. (EIN 81-3056429), a Delaware corporation located at 11501 Alterra Parkway, Suite 300, Austin, Texas 78758. Halcyon US Inc. operates as a fabless design center with approximately 320 employees focused on commercial semiconductor design for automotive, industrial, and telecommunications applications. Halcyon US Inc. does not perform any classified work and does not hold a Facility Security Clearance. Halcyon US Inc. is not currently subject to any CFIUS mitigation agreement or foreign ownership, control, or influence ("FOCI") mitigation instrument.
B. CFIUS Review Status
HSAG and VPI submitted a voluntary joint notice to CFIUS on July 14, 2023, pursuant to 31 C.F.R. Part 800, notifying the Committee of the proposed covered transaction. CFIUS accepted the filing on July 21, 2023, commencing the initial forty-five (45) day review period.
During the initial review period, CFIUS issued its first Request for Information ("RFI") on August 4, 2023, seeking supplemental information regarding VPI's controlled technology portfolio, VPI's government contract relationships, and HSAG's global corporate structure, including the operations of HSAG's China subsidiary, Halcyon Semiconductor (Shanghai) Co., Ltd. The parties submitted a supplemental response on August 18, 2023, addressing each item raised in the first RFI.
Upon the conclusion of the initial forty-five (45) day review period, CFIUS initiated an additional forty-five (45) day investigation on September 4, 2023, as permitted under Section 721(b)(2) of the Defense Production Act. The initiation of the investigation phase is not unusual for transactions of this nature and complexity, particularly where the target company holds a Facility Security Clearance and is engaged in classified defense programs.
CFIUS issued a second RFI on September 22, 2023, focusing on HSAG's planned technology integration strategy, VPI's employee access controls for classified and controlled information, and the structure of HSAG's board of directors and executive leadership with respect to any individuals who are nationals of countries of concern. The parties submitted a second supplemental response on October 6, 2023.
On October 20, 2023, CFIUS communicated to the parties four preliminary national security concerns identified during the investigation. These concerns included: (1) the potential transfer of ITAR-controlled and EAR-controlled technology from VPI to HSAG personnel who are non-U.S. persons, including through deemed exports; (2) the risk of foreign influence over VPI's classified programs and cleared workforce; (3) the potential for disruption or degradation of VPI's supply of critical defense components to the U.S. military; and (4) cybersecurity risks arising from integration of VPI's IT systems with HSAG's global network. The first of these concerns — the risk of unauthorized technology transfer — is the primary driver of the TCP requirement.
Following communication of the preliminary national security concerns, the parties and CFIUS entered into negotiations regarding a proposed National Security Agreement. CFIUS circulated an initial draft NSA on November 3, 2023. The first NSA negotiation session was held on November 9, 2023, at which the parties submitted HSAG's initial buyer's redline to the draft NSA. The TCP provisions are contained in the draft NSA as Annex B and represent one of the central pillars of the overall mitigation framework. Other NSA annexes address board governance (Annex A), classified program protections (Annex C), cybersecurity requirements (Annex D), government contract continuity (Annex E), and facility access procedures (Annex F).
C. VPI's Controlled Technology Profile
VPI's technology portfolio encompasses items controlled under both the ITAR and the EAR, as well as proprietary information subject to government data rights clauses and trade secret protections. The breadth and sensitivity of VPI's controlled technology profile are the fundamental reasons CFIUS has determined that a comprehensive TCP is necessary as a condition of transaction clearance.
ITAR-Controlled Items. VPI designs and manufactures products that constitute defense articles listed on the United States Munitions List ("USML") in ITAR Category XI(a)(3) (Military Electronics), specifically including GaN power amplifier modules and related components designed for military radar and electronic warfare applications. VPI has been registered with the DDTC at the U.S. Department of State since 2011, under Registration No. M-24817. VPI's DDTC registration has been maintained continuously and is current. VPI currently holds three (3) active DSP-5 export licenses authorizing the transfer of certain defense articles to end-users in the United Kingdom and the Commonwealth of Australia, both NATO allies and members of the AUKUS security partnership. These licenses will require amendment to reflect the post-closing change in VPI's ownership structure.
EAR-Controlled Items. VPI also designs and manufactures dual-use components for commercial applications, including 5G wireless infrastructure and satellite communications systems, that are controlled under the EAR. VPI's primary Export Control Classification Numbers ("ECCNs") include: ECCN 3A001 (certain microwave or millimeter wave discrete devices, integrated circuits, and components designed for operation at frequencies exceeding 2.7 GHz); ECCN 3A991 (electronic items not controlled by 3A001 but meeting specified performance parameters); and ECCN 3E001 (technology according to the General Technology Note for the development or production of items controlled under 3A001). The dual-use character of certain VPI products — serving both defense and commercial markets — adds complexity to the TCP classification framework, as the export control requirements differ depending on whether an item is classified under the ITAR or the EAR.
intellectual Property Portfolio. VPI holds a substantial portfolio of forty-seven (47) granted U.S. patents and twelve (12) pending patent applications, organized across three principal patent families:
(a) GaN-on-SiC Epitaxial Growth Process — eight (8) patents (U.S. Patent Nos. 9,XXX,001 through 9,XXX,008), with the earliest priority date in 2012, covering VPI's proprietary processes for growing high-quality GaN epitaxial layers on SiC substrates;
(b) HEMT Gate Structure Optimization — nineteen (19) patents (U.S. Patent Nos. 10,XXX,101 through 10,XXX,119), with the earliest priority date in 2015, covering innovations in high-electron-mobility transistor ("HEMT") gate geometries, passivation processes, and reliability enhancement techniques; and
(c) mmWave Broadband Matching Network — twenty (20) patents (U.S. Patent Nos. 11,XXX,201 through 11,XXX,220), with the earliest priority date in 2018, covering novel circuit topologies and impedance matching techniques for broadband millimeter-wave power amplifiers.
Twenty-three (23) of the forty-seven (47) granted patents were developed, in whole or in part, under U.S. government-funded contracts. These government-funded patents are subject to the government's march-in rights under 35 U.S.C. § 203 (as implemented by the Bayh-Dole Act) and to the patent rights provisions of DFARS 252.227-7038 (Patent Rights — Ownership by the Contractor (Large Business)). The government also retains a nonexclusive, nontransferable, irrevocable, paid-up license to practice or have practiced each such invention throughout the world by or on behalf of the United States. These government rights impose additional constraints on how HSAG may exploit VPI's patent portfolio, beyond the export control restrictions addressed by the TCP.
Trade Secrets. VPI maintains thirty-one (31) registered internal trade secrets under its trade secret management program, which is administered by VPI's Vice President of Engineering, Marissa Sung-Avila. These trade secrets primarily relate to proprietary GaN epitaxial growth recipes (including specific material compositions, growth temperatures, gas flow parameters, and post-growth annealing protocols) and die-level reliability screening processes (including accelerated life testing methodologies and failure analysis procedures). These trade secrets represent some of VPI's most commercially and strategically valuable proprietary information, and their protection is a critical component of the TCP.
Government Contract Portfolio. VPI is a party to fourteen (14) active DoD contracts, with an aggregate backlog of approximately $193 million, as follows:
•  U.S. Army PEO IEW&S: $52.3 million backlog — supply of GaN HEMT modules for the AN/TPS-80 Ground/Air Task-Oriented Radar (G/ATOR) program;
•  Air Force Research Laboratory ("AFRL"): $41.7 million — development and qualification of next-generation millimeter-wave power amplifiers for advanced electronic warfare applications;
•  Missile Defense Agency ("MDA"): $38.9 million — design and fabrication of GaN-based transmit/receive ("T/R") modules for missile defense radar systems;
•  Subcontract to Ironclad Defense Systems Inc. (prime contract: U.S. Navy NAVSEA): $34.1 million — supply of GaN power amplifier components for naval shipboard radar systems; and
•  Department of Homeland Security, Science and Technology Directorate ("DHS S&T"): $26.0 million — development and production of radio frequency components for border surveillance radar systems.
Technical data generated under these contracts is subject to the data rights provisions of the applicable DFARS clauses, and in many cases is subject to additional contract-specific restrictions on foreign access and dissemination. The TCP must account for these contract-specific requirements in addition to the general ITAR and EAR obligations.
III. Legal Framework Governing Technology Control Plans
A. CFIUS Authority
The Committee on Foreign Investment in the United States derives its authority from Section 721 of the Defense Production Act of 1950, as amended ("DPA"), codified at 50 U.S.C. § 4565. Section 721 was substantially amended by the Foreign Investment Risk Review Modernization Act of 2018 ("FIRRMA"), Pub. L. No. 115-232, which broadened CFIUS's jurisdiction and enhanced its authority to impose mitigation conditions on covered transactions. The implementing regulations are set forth at 31 C.F.R. Part 800 (governing covered transactions involving control of a U.S. business) and 31 C.F.R. Part 802 (governing certain real estate transactions), as well as the procedural rules in 31 C.F.R. Part 802.
Under Section 721(l)(1) of the DPA, CFIUS is authorized to impose mitigation agreements, conditions, or orders — including, but not limited to, National Security Agreements — as a condition of clearing a covered transaction where the Committee has identified national security risks that require remediation short of blocking the transaction entirely. The Technology Control Plan is a standard and widely used mitigation tool within NSAs, particularly in transactions where the target company possesses controlled technology — whether classified, ITAR-controlled, EAR-controlled, or subject to government data rights — and the acquirer is a foreign person. The TCP is designed to ensure that the target company's controlled technology remains protected from unauthorized access and transfer following the change in ownership, while still permitting the acquirer to realize the legitimate business value of the acquisition.
TCP obligations contained within an NSA are legally binding on the parties. The NSA constitutes a binding agreement between the transaction parties and the U.S. government, typically represented by the CFIUS member agencies (in this case, the Department of the Treasury, the Department of Defense, the Department of Energy, and such other agencies as may be designated as monitoring agencies). Violation of the TCP or any other provision of the NSA may trigger significant consequences, including: (a) civil monetary penalties of up to $250,000 per violation per day, as specified in Section 12.3 of the draft NSA; (b) injunctive relief sought by the U.S. government in federal court to compel compliance; and (c) in the most severe cases, mandated divestiture of the acquired business pursuant to CFIUS's authority under Section 721(l)(3) of the DPA. The gravity of these potential consequences underscores the importance of establishing a robust TCP compliance infrastructure from the outset.
B. ITAR Framework (22 C.F.R. Parts 120–130)
The International Traffic in Arms Regulations ("ITAR") are administered by the Directorate of Defense Trade Controls ("DDTC") within the Bureau of Political-Military Affairs at the U.S. Department of State, pursuant to the Arms Export Control Act ("AECA"), 22 U.S.C. §§ 2751–2799aa-2. The ITAR control the export, temporary import, and brokering of defense articles, defense services, and related technical data listed on the United States Munitions List ("USML"), which is set forth in 22 C.F.R. Part 121.
As noted above, VPI's products include defense articles listed in ITAR Category XI(a)(3) of the USML, encompassing military electronics and related components. The technical data associated with the design, development, engineering, manufacture, production, assembly, testing, repair, maintenance, modification, operation, demilitarization, destruction, or processing of these defense articles is also controlled under the ITAR as "technical data" within the meaning of 22 C.F.R. § 120.33 (as revised effective December 30, 2020).
A critical concept under the ITAR for purposes of the TCP is the definition of "transfer." Under ITAR § 120.17 (as revised), a "transfer" includes any disclosure of technical data to a foreign person, whether in the United States or abroad. This is commonly referred to as the "deemed export" concept — the disclosure of ITAR-controlled technical data to a foreign person within the United States is deemed to be an export to the country of the foreign person's nationality, even though the technical data has not physically left U.S. territory. For purposes of the ITAR, a "foreign person" is any natural person who is not a U.S. citizen, U.S. lawful permanent resident (i.e., green card holder), or a protected individual as defined under 8 U.S.C. § 1324b(a)(3). This definition has direct and significant implications for HSAG personnel who are German citizens or nationals of other countries: any disclosure of VPI's ITAR-controlled technical data to such persons requires either a valid export license (typically a DSP-5 license) or an applicable ITAR exemption.
VPI's DDTC Registration No. M-24817 must be maintained continuously post-closing. Pursuant to ITAR § 122.4(a), VPI is required to notify DDTC of any change in its ownership or control within sixty (60) days of the effective date of the change. Given that the CFIUS review and NSA process is running concurrently, we anticipate coordinating the DDTC change-of-ownership notification with the acquisition closing. VPI's three (3) active DSP-5 export licenses will also require amendment to reflect the change in ownership, which may necessitate additional processing time at DDTC.
The consequences of non-compliance with ITAR requirements are severe. An unauthorized transfer of ITAR-controlled technical data to HSAG's non-U.S. personnel — including, for example, Dr. Ehrhardt or Ms. Brückner — would constitute a violation of ITAR § 127.1 (Violations). Such violations may subject VPI and HSAG to criminal penalties under 22 U.S.C. § 2778 (including fines of up to $1 million per violation and imprisonment of up to twenty (20) years for willful violations) and civil penalties under 22 C.F.R. § 127.10 (currently up to $1,227,271 per violation, as adjusted for inflation). In addition, the U.S. government may impose debarment from participation in future defense trade activities. The TCP is designed, in substantial part, to prevent inadvertent ITAR violations that could arise from the integration of VPI into HSAG's global corporate structure.
C. EAR Framework (15 C.F.R. Parts 730–774)
The Export Administration Regulations ("EAR") are administered by the Bureau of Industry and Security ("BIS") within the U.S. Department of Commerce, pursuant to the Export Control Reform Act of 2018 ("ECRA"), 50 U.S.C. §§ 4801–4852, and Executive Order 13222. The EAR control the export, reexport, and transfer (in-country) of dual-use items — those with both commercial and military or proliferation applications — as well as certain items that are exclusively commercial but controlled for foreign policy or other reasons. Items subject to the EAR are classified according to the Commerce Control List ("CCL"), set forth in Supplement No. 1 to 15 C.F.R. Part 774.
VPI's dual-use products and associated technology are primarily controlled under the following ECCNs:
•  ECCN 3A001: Certain microwave or millimeter wave discrete devices, integrated circuits, and components designed for operation at frequencies exceeding 2.7 GHz, meeting specified performance parameters for power output, noise figure, or bandwidth;
•  ECCN 3A991: Electronic items not controlled by ECCN 3A001 but meeting separate performance specifications relevant to telecommunications and industrial applications; and
•  ECCN 3E001: "Technology" according to the General Technology Note for the "development" or "production" of items controlled under ECCN 3A001, including design data, manufacturing know-how, and test methodologies.
The EAR's "deemed export" rule, set forth in 15 C.F.R. § 734.13, provides that any release of "technology" or "source code" subject to the EAR to a foreign national within the United States is deemed to be an export to the country of that person's most recent country of citizenship or permanent residency. This rule is conceptually similar to, but technically distinct from, the ITAR's deemed export provisions. For EAR purposes, a "foreign national" means any natural person who is not a U.S. citizen, a U.S. lawful permanent resident, or a protected individual under the Immigration and Nationality Act. As with the ITAR, this rule means that the disclosure of VPI's EAR-controlled technology to HSAG's non-U.S. employees would require either a BIS export license or an applicable license exception.
Germany is designated as a participant in Country Group A:1 (Wassenaar Arrangement participants) under the EAR, which is a favorable designation for purposes of determining the availability of certain license exceptions. In particular, License Exception Strategic Trade Authorization ("STA"), codified at 15 C.F.R. § 740.20, may be available for certain eligible items destined for eligible end-users in Country Group A:1 destinations, subject to specific conditions and limitations. However, the availability of License Exception STA must be assessed on an item-by-item basis, as not all ECCNs are eligible and additional requirements (such as the consignee statement required under § 740.20(d)(2)) must be satisfied. The TCP must incorporate protocols for evaluating the applicability of License Exception STA and other potential license exceptions on a case-by-case basis, as discussed in detail in Section IV.E below.
D. NISPOM and Facility Security Requirements
The National Industrial Security Program Operating Manual ("NISPOM"), now codified as a federal regulation at 32 C.F.R. Part 117 (effective February 24, 2021), governs the protection of classified information entrusted to cleared defense contractors participating in the National Industrial Security Program ("NISP"). The NISPOM establishes baseline security requirements for personnel security, physical security, information security, and security education and training for all cleared contractor facilities.
VPI's Facility Security Clearance at the SECRET level at the Albuquerque Fab is administered under the NISPOM and overseen by the Defense Counterintelligence and Security Agency ("DCSA"), which serves as the cognizant security agency ("CSA") for VPI. VPI's Facility Security Officer ("FSO") is Col. (Ret.) Bryce Hendrickson, who holds a current TS/SCI security clearance and is responsible for the day-to-day administration of VPI's industrial security program.
When a cleared contractor facility is subject to foreign ownership, control, or influence ("FOCI"), the NISPOM requires that the FOCI be mitigated through one of several prescribed mechanisms, including a Special Security Agreement ("SSA"), Proxy Agreement, or Voting Trust Agreement. In the context of a CFIUS-reviewed transaction, the NSA typically functions as the equivalent of, or in conjunction with, an SSA for FOCI mitigation purposes under the NISPOM. The NSA establishes a Government Security Committee ("GSC") composed of independent Security Board Members who are U.S. citizens holding or eligible for TS/SCI clearances, charged with overseeing the cleared contractor's security and compliance obligations.
The TCP is a component of this broader FOCI mitigation framework but is distinct from the classified information protections contained in NSA Annex C (GSC Provisions). The TCP focuses on the protection of controlled unclassified information ("CUI"), ITAR-controlled technical data, EAR-controlled technology, and proprietary information such as trade secrets. Classified information — which includes all national security information classified at the CONFIDENTIAL, SECRET, or TOP SECRET levels — is separately governed by the GSC provisions and the NISPOM. The TCP addresses classified information only to state the absolute prohibition on any transfer of classified information to HSAG personnel. DCSA will serve as one of the monitoring agencies under the NSA, with responsibility for oversight of both the classified program protections and the TCP.
IV. Detailed Analysis of TCP Obligations
A. Scope of Controlled Information
The draft TCP, as set forth in Annex B to the draft NSA circulated by CFIUS on November 3, 2023, defines the scope of information subject to TCP protections through the term "Controlled Technical Data." This definition is deliberately broad and encompasses multiple categories of sensitive information, reflecting CFIUS's intent to establish a comprehensive protective framework.
Under Section 2.1 of the draft TCP, "Controlled Technical Data" is defined to include the following categories of information:
(a) All technical data subject to ITAR controls, as defined in 22 C.F.R. § 120.33, including but not limited to information required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance, or modification of defense articles classified under ITAR Category XI(a)(3);
(b) All "technology" and "source code" subject to EAR controls, as those terms are defined in 15 C.F.R. § 772.1, including but not limited to technology classified under ECCNs 3E001 and related entries on the Commerce Control List;
(c) All information designated as Controlled Unclassified Information ("CUI") under 32 C.F.R. Part 2002, including CUI categories established under the CUI Registry maintained by the National Archives and Records Administration, to the extent applicable to VPI's operations;
(d) VPI trade secrets, including the thirty-one (31) registered internal trade secrets maintained under VPI's trade secret management program, with particular emphasis on proprietary GaN epitaxial growth recipes and die-level reliability screening processes;
(e) Technical information developed under or delivered pursuant to U.S. government contracts and subject to the technical data rights provisions of DFARS 252.227-7013 (Rights in Technical Data — Noncommercial Items) and DFARS 252.227-7014 (Rights in Noncommercial Computer Software and Noncommercial Computer Software Documentation); and
(f) Any other technical information that VPI or the GSC determines, in its reasonable discretion, to be sensitive from a national security perspective and warranting protection under the TCP.
The TCP also covers VPI's forty-seven (47) granted U.S. patents, twelve (12) pending patent applications, and the underlying technical data associated with each patent family. Although issued patents are by definition publicly available, the underlying technical data — including unpublished specifications, experimental results, manufacturing process details, and know-how not disclosed in the patent specifications — may constitute Controlled Technical Data to the extent it is subject to ITAR, EAR, or CUI controls. This is particularly relevant for the twenty-three (23) government-funded patents, which are subject to the Bayh-Dole Act and DFARS 252.227-7038, and whose underlying technical data may be subject to government data rights restrictions.
The draft TCP excludes from the definition of "Controlled Technical Data" the following categories of information: (i) purely commercial product specifications that are already in the public domain, including published datasheets and application notes for commercially available VPI products; (ii) marketing materials, press releases, and public-facing communications that do not contain controlled technical content; and (iii) financial and business information — such as revenue data, operating metrics, and non-technical corporate records — that does not contain or incorporate any controlled technical content. These exclusions are important because they define the universe of information that HSAG may freely access as the parent company of VPI without triggering TCP compliance obligations.
B. Prohibition on Unauthorized Transfer
The core operative provision of the TCP is its prohibition on unauthorized transfers of Controlled Technical Data to non-U.S. persons. Section 3.1 of the draft TCP provides that no VPI employee, contractor, or agent may disclose, transfer, provide access to, or otherwise make available any Controlled Technical Data to any "non-U.S. person" (as that term is defined under ITAR § 120.16) without first obtaining one of the following authorizations:
(a) A valid ITAR export license (typically a DSP-5 license) or an applicable ITAR exemption, for items subject to ITAR controls;
(b) A valid EAR export license or an applicable EAR license exception, for items subject to EAR controls; or
(c) Prior written approval from the Government Security Committee established under the NSA, for items subject to NSA-specific restrictions that extend beyond the requirements of the ITAR and EAR (such as certain categories of CUI or VPI trade secrets that, while not independently export-controlled, are designated as Controlled Technical Data under the TCP due to their national security sensitivity).
The term "non-U.S. person" explicitly includes all HSAG employees who are not U.S. citizens or U.S. lawful permanent residents. Without limitation, this encompasses:
•  Dr. Maximilian Ehrhardt, a German citizen serving as Chief Executive Officer of HSAG;
•  Katarina Brückner, a German citizen serving as Chief Financial Officer of HSAG;
•  All HSAG employees based at HSAG's headquarters in Dresden, Germany, as well as those in HSAG's Berlin office and any other non-U.S. HSAG office worldwide;
•  All employees of HSAG's China subsidiary, Halcyon Semiconductor (Shanghai) Co., Ltd., including Chinese nationals employed at that subsidiary; and
•  Any other HSAG employee, consultant, or contractor who is not a U.S. citizen or U.S. lawful permanent resident.
Analysis of Stefan Lohse's Status. A question has arisen regarding the TCP status of Stefan Lohse, HSAG's General Counsel. Mr. Lohse holds dual German and U.S. citizenship and is admitted to the bar of the State of New York. As a U.S. citizen, Mr. Lohse qualifies as a "U.S. person" for purposes of both the ITAR and the EAR, and the general prohibition on transfers to non-U.S. persons does not apply to him. However, the draft NSA contains an additional provision — Section 8.4 — specifying that the GSC retains oversight authority over access to Controlled Technical Data by any HSAG officer or director, even if such person is a U.S. person, where the information pertains to classified programs or relates to VPI's most sensitive government contracts. Accordingly, while Mr. Lohse's U.S. citizenship removes the automatic ITAR/EAR transfer prohibition, his role as HSAG's General Counsel — and the potential that his access to VPI information could facilitate indirect transfer to non-U.S. HSAG personnel — means that his access to certain categories of Controlled Technical Data will be subject to GSC review on a case-by-case basis.
The prohibition on unauthorized transfers extends to all forms of disclosure, including "deemed exports" — that is, oral briefings, visual demonstrations, electronic transmissions, and any other form of communication that results in a non-U.S. person gaining access to Controlled Technical Data, regardless of whether the disclosure occurs at VPI facilities, at HSAG facilities, or through any other means of communication, including telephone, videoconference, email, file sharing, or cloud-based collaboration tools.
The draft TCP further requires, consistent with the cybersecurity provisions of NSA Annex D, that VPI maintain complete physical and logical separation of its IT infrastructure from HSAG's global IT network. No shared cloud infrastructure, shared servers, shared email domains, shared file repositories, or shared collaboration platforms may be used to store, process, or transmit Controlled Technical Data. This requirement ensures that even inadvertent access by HSAG's global IT administrators or automated data synchronization processes does not result in an unauthorized transfer.
C. Information Segregation and Access Controls
1. Physical Access Controls
The TCP establishes a tiered framework for physical access controls at VPI's facilities, with the most restrictive controls applied to classified areas and progressively less restrictive controls applied to unclassified areas that nonetheless handle Controlled Technical Data.
Classified Areas at the Albuquerque Fab. VPI's classified areas at the Albuquerque Fab — specifically, clean room Sections C-7 through C-12 — are subject to an absolute prohibition on access by HSAG personnel, regardless of their citizenship status, without prior written approval from both DCSA and the Government Security Committee. This restriction is primarily governed by NSA Annex F (Facility Access Procedures) but is reinforced by the TCP to ensure comprehensive coverage. Clean room Sections C-7 through C-12 are the areas where VPI performs fabrication processes on classified defense programs, including the AN/TPS-80 radar modules for the U.S. Army and the T/R modules for the Missile Defense Agency. Access to these areas is limited to VPI employees who hold the requisite security clearances and have a need-to-know for the specific classified programs being executed in those areas.
Unclassified Areas at the Albuquerque Fab. HSAG personnel may access unclassified areas at the Albuquerque Fab under controlled conditions. Specifically, HSAG personnel seeking to visit the Albuquerque Fab must provide advance written notice to the TCP Officer no fewer than five (5) business days prior to the proposed visit. During any visit, HSAG personnel must be escorted at all times by a cleared VPI employee designated by the TCP Officer. HSAG personnel may enter only those areas where no Controlled Technical Data is displayed, accessible, or under active discussion. Prior to any visit by HSAG personnel, the TCP Officer must conduct an area sweep to confirm that no controlled materials — including technical drawings, test data, process specifications, or computer displays showing controlled information — are visible or accessible in the areas to be visited.
VPI Colorado Springs Headquarters. The access restrictions at VPI's Colorado Springs headquarters at 7400 Ridgeline Parkway are less stringent, reflecting the fact that the Colorado Springs facility does not house classified operations and that a significant portion of VPI's business development and financial operations are conducted there. HSAG personnel may visit the Colorado Springs facility for routine business meetings, including financial reviews, strategic planning sessions, and non-technical management discussions. However, the TCP requires that meeting rooms to be used by HSAG personnel be screened in advance by the TCP Officer or a designated delegate to confirm that no controlled materials are present in the room or accessible from it. No Controlled Technical Data may be presented, discussed, or referenced during any meeting attended by non-U.S. HSAG personnel unless the applicable authorization requirements of the TCP (including ITAR/EAR licensing and TCP Officer approval) have been satisfied in advance.
Visitor Logs. Comprehensive visitor logs must be maintained for all HSAG personnel visits to any VPI facility, including the Albuquerque Fab, the Colorado Springs headquarters, and any other VPI location. These logs must record the name, title, citizenship, and employer of each visitor; the date and time of arrival and departure; the areas accessed; the name of the VPI escort; and a brief description of the purpose of the visit. Visitor logs are subject to review by Whitmore Compliance Group LLC, the designated third-party compliance monitor, during annual compliance audits and ad hoc reviews.
2. Electronic Access Controls
The TCP imposes rigorous electronic access controls designed to prevent unauthorized access to Controlled Technical Data through VPI's information technology systems. These requirements complement the cybersecurity provisions of NSA Annex D but are independently enforceable under the TCP.
VPI's IT systems must be maintained on a completely separate network from HSAG's global IT infrastructure. This requirement precludes the use of shared servers, shared cloud accounts (including shared instances on public cloud platforms such as Ridgeway Industries, Crestline Systems, or Aldermere Technologies), shared email domains, shared collaboration tools (such as Northgate Data Systems, Meridian Solutions, or Aldermere Systems), and any other shared IT resources that could enable HSAG personnel to access VPI systems or data. VPI's existing IT infrastructure operates independently from HSAG's systems, which mitigates the implementation burden. However, any post-closing IT integration planning — to the extent HSAG has contemplated integrating VPI's non-controlled IT systems (such as financial reporting systems) — must be carefully reviewed by the TCP Officer to ensure that integration does not create pathways for unauthorized access to Controlled Technical Data.
VPI must maintain compliance with NIST Special Publication 800-171, "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations" (Revision 2), for the protection of CUI. This requirement is independently mandated by several of VPI's government contracts under DFARS 252.204-7012, and the TCP incorporates this requirement by reference. NIST SP 800-171 establishes one hundred ten (110) security requirements across fourteen (14) families, including access control, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, and system and information integrity.
All Controlled Technical Data must be stored in access-controlled repositories with role-based access controls ("RBAC") that limit access to authorized U.S. persons who have a legitimate need-to-know. Access permissions must be reviewed and updated on a quarterly basis by the TCP Officer to ensure that access lists remain current and accurate.
Electronic transmission of Controlled Technical Data outside VPI's internal network — including transmission to VPI employees working remotely, to VPI's government customers, or to any other authorized recipient — requires encryption using cryptographic modules validated under Federal Information Processing Standard ("FIPS") 140-2 (or its successor, FIPS 140-3). In addition, any electronic transmission of Controlled Technical Data requires pre-approval by the TCP Officer, who must verify that the transmission is authorized under applicable ITAR, EAR, and TCP requirements before the transmission may occur.
There is a strict prohibition on the use of HSAG-provided devices — including laptops, tablets, smartphones, and portable storage media — or HSAG-managed IT infrastructure to access or store VPI Controlled Technical Data. VPI employees and contractors must use only VPI-issued and VPI-managed devices for activities involving Controlled Technical Data. This prohibition extends to HSAG's mobile device management ("MDM") platforms, HSAG-provided virtual private network ("VPN") connections, and any other HSAG IT service.
VPI must engage a qualified third-party cybersecurity firm to conduct annual penetration testing of VPI's IT systems, with the scope of testing to include both external network penetration testing and internal vulnerability assessments. The results of each penetration test must be shared with the TCP Officer, the GSC, and Whitmore Compliance Group LLC. Any cybersecurity incidents — including suspected or confirmed breaches, unauthorized access events, and malware infections — must be reported to DCSA within seventy-two (72) hours of detection, consistent with the requirements of DFARS 252.204-7012 and the NSA's cybersecurity provisions.
3. Personnel Controls
The TCP establishes comprehensive personnel controls designed to ensure that all VPI personnel who have access to Controlled Technical Data are properly trained, vetted, and subject to ongoing compliance obligations.
Training Requirements. All VPI employees with access to Controlled Technical Data must undergo TCP-specific training within thirty (30) days of the NSA effective date. Training must be refreshed annually thereafter. The training program must cover, at a minimum: (a) the scope and categories of Controlled Technical Data; (b) the prohibition on unauthorized transfers to non-U.S. persons; (c) the deemed export concept under both ITAR and EAR; (d) the procedures for requesting and obtaining authorization for authorized transfers; (e) the roles and responsibilities of the TCP Officer and the GSC; (f) the consequences of TCP violations, including NSA penalties and ITAR/EAR criminal and civil penalties; and (g) procedures for reporting suspected TCP violations. All new hires at VPI must complete TCP training before being granted access to any Controlled Technical Data, and no exceptions to this requirement are permitted.
TCP Access List. VPI must maintain a centralized "TCP access list" that identifies, by name, each VPI employee or contractor authorized to access specific categories of Controlled Technical Data. The TCP access list must be reviewed and updated at least quarterly by the TCP Officer and must reflect any changes in personnel, job responsibilities, or clearance status. The TCP access list must be made available to Whitmore Compliance Group LLC upon request and must be submitted to the GSC annually.
Exit Protocols. When a VPI employee with access to Controlled Technical Data departs VPI — whether through resignation, termination, retirement, or any other means — the departing employee must undergo a formal debriefing conducted by the TCP Officer or a designated delegate. The debriefing must cover the employee's continuing obligations with respect to Controlled Technical Data, including any non-disclosure agreements, trade secret obligations, and export control responsibilities that survive the employment relationship. All VPI-issued devices, media, and materials in the departing employee's possession must be collected and inspected to confirm that no Controlled Technical Data has been retained. The TCP Officer must certify in writing that the exit protocol has been completed.
Key Personnel Continuity Requirement. Section 9 of the draft NSA imposes a key personnel continuity requirement, mandating that certain designated VPI employees remain employed for a minimum of twenty-four (24) months following the closing of the acquisition, or, if they depart during that period, that their replacements be approved by the GSC and DCSA prior to assumption of their duties. The designated key personnel are:
•  Dr. Nathan Trevorrow, President and Chief Technology Officer of VPI, who is responsible for VPI's technology strategy, R&D program management, and technical leadership of VPI's government contract programs;
•  Marissa Sung-Avila, Vice President of Engineering, who manages VPI's trade secret program and oversees the engineering teams responsible for VPI's GaN process development and product design; and
•  Col. (Ret.) Bryce Hendrickson, Vice President of Government Programs and Facility Security Officer, who holds a current TS/SCI clearance and is the primary interface with VPI's government customers, DCSA, and the CFIUS monitoring agencies.
These individuals are essential to the implementation and ongoing operation of the TCP, and their continued tenure at VPI is a critical condition of the NSA. Should any of these individuals depart VPI during the twenty-four (24) month continuity period, the GSC must approve their replacements, and DCSA must concur in the appointment, before the replacement may assume the departing individual's TCP-related responsibilities.
D. TCP Officer Role and Responsibilities
The TCP requires VPI to designate a "TCP Officer" who bears day-to-day responsibility for TCP implementation, compliance monitoring, and the approval or denial of requests for access to or transfer of Controlled Technical Data. The TCP Officer serves as the central point of accountability for TCP compliance within VPI and as the primary point of contact for the GSC, the third-party compliance monitor, and the CFIUS monitoring agencies.
We recommend that Col. (Ret.) Bryce Hendrickson be designated as the TCP Officer, serving concurrently in this role with his existing positions as Vice President of Government Programs and Facility Security Officer. Col. (Ret.) Hendrickson is uniquely qualified for this role by virtue of his TS/SCI security clearance, his extensive familiarity with VPI's export compliance program, his longstanding relationships with VPI's government customers, and his deep understanding of VPI's controlled technology portfolio. Combining the TCP Officer and FSO roles in a single individual is consistent with industry practice in similar CFIUS-mitigated transactions and avoids the creation of redundant compliance structures.
The TCP Officer reports to the Government Security Committee, which is composed of three (3) Security Board Members who must be U.S. citizens holding or eligible for TS/SCI clearances. The Security Board Members are to be appointed under the terms of the NSA and serve independently of HSAG's management. The TCP Officer does not report to HSAG management on TCP matters; rather, the TCP Officer's reporting relationship on TCP-related issues runs exclusively through the GSC. This structure is designed to ensure that the TCP Officer's decisions are insulated from potential foreign influence.
The TCP Officer's specific responsibilities include, but are not limited to, the following:
(a) Reviewing and approving or denying all requests for access to Controlled Technical Data by non-U.S. persons, including HSAG personnel;
(b) Maintaining comprehensive records of all access approvals, access denials, and information transfers, including the identity of the requesting party, the nature of the information requested, the basis for the approval or denial, and the applicable ITAR, EAR, or NSA authorization;
(c) Conducting quarterly internal TCP compliance reviews, the results of which must be documented in written reports submitted to the GSC;
(d) Coordinating with Whitmore Compliance Group LLC, the designated third-party compliance monitor, during annual audits and any ad hoc reviews or investigations;
(e) Promptly reporting any TCP violations — whether suspected or confirmed — to the GSC and, as required by the NSA, to the CFIUS monitoring agencies (DCSA, the Department of the Treasury, the Department of Defense, and the Department of Energy);
(f) Coordinating with DDTC for ITAR license applications, license amendments, and required notifications (including the post-closing change-of-ownership notification under ITAR § 122.4(a));
(g) Coordinating with BIS for EAR license applications and license exception determinations;
(h) Administering the visitor management protocols at VPI's facilities for HSAG personnel visits;
(i) Overseeing the TCP training program, including scheduling, content development, and recordkeeping;
(j) Managing the TCP access list and ensuring its accuracy and currency; and
(k) Serving as VPI's Empowered Official for ITAR purposes, to the extent consistent with DDTC requirements and VPI's existing designations.
E. Procedures for Authorized Information Sharing
It is recognized that HSAG, as the parent company and sole shareholder of VPI following the closing, will have legitimate business needs for access to certain categories of VPI information. These needs include financial reporting and consolidation, strategic planning and business development, non-controlled commercial technology collaboration, and general corporate oversight. The TCP must accommodate these legitimate needs while maintaining the prohibition on unauthorized access to Controlled Technical Data.
To this end, the TCP establishes a categorical framework for authorized information sharing, with five defined categories and corresponding approval requirements:
Category 1 — Unrestricted Business Information. This category encompasses financial data (including revenue, expense, and profitability reports), employee headcount data, non-technical marketing materials, regulatory filings (other than export control filings), and similar business information that does not contain any controlled technical content. Category 1 information may be freely shared with HSAG personnel, including non-U.S. persons, without TCP Officer approval. However, VPI personnel responsible for preparing Category 1 information must exercise diligence to ensure that no Controlled Technical Data is inadvertently included in materials shared under this category.
Category 2 — Commercial Technical Information (Non-Controlled). This category encompasses product specifications that are already in the public domain (such as published datasheets and application notes), uncontrolled commercial product data, and technical information relating to VPI's 5G infrastructure products that is not subject to ITAR or EAR controls (i.e., information classified as EAR99 or otherwise not controlled). Category 2 information may be shared with HSAG after the TCP Officer has reviewed the specific information and confirmed in writing that it does not contain any controlled content. This review requirement is intended to serve as a safeguard against the inadvertent commingling of controlled and non-controlled technical data — a risk that is particularly acute given the dual-use character of many VPI products.
Category 3 — Controlled Technical Data (ITAR). This category encompasses all technical data subject to ITAR controls, including design data, manufacturing process specifications, test results, and other technical information relating to VPI's defense articles listed in ITAR Category XI(a)(3). Any transfer of Category 3 information to a non-U.S. person requires: (i) a valid DDTC authorization, which may take the form of a DSP-5 export license, a Technical Assistance Agreement ("TAA"), or an applicable ITAR exemption; (ii) TCP Officer review and pre-approval; and (iii) notification to the GSC. Given the sensitivity of ITAR-controlled items and the potential criminal and civil penalties for unauthorized transfers, the TCP imposes the most rigorous procedural requirements on Category 3 information sharing.
Category 4 — Controlled Technology (EAR). This category encompasses all technology and source code subject to EAR controls, including technology classified under ECCNs 3E001 and related entries. Any transfer of Category 4 information to a non-U.S. person requires: (i) a valid BIS export license or an applicable license exception; (ii) TCP Officer review; and (iii) documentation of the basis for any license exception determination. For items where License Exception STA (15 C.F.R. § 740.20) may be available — given Germany's membership in Country Group A:1 — the TCP Officer must prepare a written license exception determination memorializing: the specific ECCN classification of the item; the eligibility of the item for STA; the identity and eligibility of the consignee; the completion of the required consignee statement; and any other conditions of the license exception. This documentation must be retained in the Transfer Request Log and made available to the compliance monitor.
Category 5 — Classified Information. This category encompasses all national security information classified at the CONFIDENTIAL, SECRET, or TOP SECRET levels. Classified information is governed exclusively by NSA Annex C (GSC Provisions) and the NISPOM, and is never transferable to HSAG personnel under any circumstances. The TCP addresses classified information solely to state this absolute prohibition and to clarify that the TCP's procedural mechanisms — including the Transfer Request Log and TCP Officer approval — do not apply to classified information, which is managed through separate channels.
All requests for information transfer, regardless of category, must be documented in a centralized Transfer Request Log maintained by the TCP Officer. T

MEMORANDUM

PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT

Record

Parties

Dates

Amounts