cfius-preliminary-concerns-assessment.docx

1032-00004 · Client 1032 · Review & Investigation Responses

cfius-preliminary-concerns-assessment.docx DOCUMENT M&A / Corporate

72 / 79 ← → ✕

CALDERWOOD & HARKNESS LLP 1501 K Street, N.W., Suite 1200 Washington, D.C. 20005

INTERNAL MEMORANDUM

FROM: Margaret "Peggy" Ashworth, Of Counsel, National Security & CFIUS Lt. Col. (Ret.) David Caruso, Senior Counsel, Government Contracts & Export Controls

TO: Beatrice Holloway, Responsible Partner, Mergers & Acquisitions James Prentice, Billing Partner, Mergers & Acquisitions

CC: Priya Venkataraman, Associate, International Trade & Sanctions Kenneth Morales, Associate, Corporate/M&A Omar Siddiqui, Lead Associate, intellectual Property Christy Bauer, Working Associate, intellectual Property

DATE: October 23, 2023

RE: Assessment of CFIUS Preliminary National Security Concerns — Acquisition of Marlowe Asset Management Photonics Inc. by Halcyon Semiconductor AG; CFIUS Case No. CFIUS-023-07-3841

MATTER NO.: 1032-00004

Right-click to update Table of Contents

I. Executive Summary

On October 20, 2023, the Committee on Foreign Investment in the United States ("CFIUS" or the "Committee") communicated four preliminary national security concerns regarding the proposed acquisition of one hundred percent (100%) of the outstanding equity interests of Marlowe Asset Management Photonics Inc. ("VPI") by Halcyon Semiconductor Aktiengesellschaft ("HSAG"), to be effected through its wholly owned subsidiary, Halcyon US Holdings Inc. ("Halcyon Holdings"), a Delaware corporation. This communication was received during the 45-day investigation phase, which commenced on September 4, 2023, following the conclusion of the initial 45-day review period.

The four preliminary national security concerns identified by CFIUS are as follows:

1. Foreign Access to Classified Defense Programs: The risk that HSAG, as a German parent company with no U.S. security clearances, would have the ability to access, influence, or compromise VPI's classified defense programs.

2. Potential Transfer of ITAR/EAR-Controlled Technology to Non-U.S. Persons: The risk that VPI's defense articles controlled under the International Traffic in Arms Regulations ("ITAR") and dual-use technologies controlled under the Export Administration Regulations ("EAR") could be transferred, whether deliberately or inadvertently, to HSAG's non-U.S. personnel, subsidiaries, or affiliates — including HSAG's China subsidiary, Halcyon Semiconductor (Shanghai) Co., Ltd.

3. Cybersecurity Risks from Integration with HSAG IT Infrastructure: The risk that post-closing integration of VPI's information technology systems with HSAG's global IT infrastructure could create cybersecurity vulnerabilities, potentially exposing classified and controlled unclassified information ("CUI") to foreign intelligence services or unauthorized access.

4. Continuity of Critical DoD Supply Chain: The risk that foreign ownership could disrupt VPI's ability to serve as a reliable supplier of critical defense components — GaN power amplifier chips for defense radar, satellite communications, and missile defense systems — or lead to decisions that deprioritize government work in favor of commercial opportunities.

It is important to note that CFIUS's communication of preliminary concerns is a standard procedural step in the investigation phase, and it signals that the Committee is considering mitigation of the identified national security risks through a National Security Agreement ("NSA") rather than recommending a presidential block of the transaction under Section 721 of the Defense Production Act. We view this as a positive development. The communication of concerns, rather than an adverse finding or a request for withdrawal and refiling, indicates that the Committee believes the transaction can proceed subject to appropriate conditions.

This memorandum analyzes each of the four preliminary concerns in detail, assesses the factual basis and legal framework underlying each concern, and recommends specific responses and proposed mitigation measures. These recommendations are intended for discussion with the client — Stefan Lohse, HSAG General Counsel — and for potential incorporation into a draft NSA proposal that we would submit to CFIUS in our formal response.

Our overarching recommendation is that HSAG should proactively propose a comprehensive mitigation framework addressing all four concerns, positioning the parties for efficient NSA negotiation. Based on our analysis of twelve (12) recent semiconductor-sector NSA precedents from 2019 through 2023 — set forth in our Comparative NSA Precedent Analysis memo dated July 3, 2023 and updated September 15, 2023 — the concerns raised by CFIUS in this matter are typical of foreign acquisitions of U.S. defense-focused semiconductor companies, and all four are addressable through well-established mitigation mechanisms. A cooperative, proactive posture will expedite the process and increase the likelihood of achieving clearance on terms acceptable to HSAG.

II. Background and Procedural Context

A. Transaction Overview

HSAG is acquiring one hundred percent (100%) of the outstanding equity of VPI for a base purchase price of $1.42 billion, payable in cash, on a cash-free, debt-free basis with a normalized net working capital target of $34.6 million. The maximum aggregate consideration, including an earnout component, is $1.505 billion. The earnout comprises $85 million in two tranches: $50 million based on government-contract revenue milestones in calendar year 2024, and $35 million based on government-contract revenue milestones in calendar year 2025. The Stock Purchase Agreement ("SPA") was executed on June 10, 2023.

The acquisition is being effected through Halcyon US Holdings Inc. ("Halcyon Holdings"), a Delaware corporation formed on June 5, 2023, as a wholly owned direct subsidiary of HSAG. Halcyon Holdings was organized specifically as the acquisition vehicle for this transaction and has no independent operations, assets, or employees other than those incidental to serving as the acquiring entity.

The Buyer. HSAG is a German Aktiengesellschaft (stock corporation organized under German law), publicly traded on the Frankfurt Stock Exchange under the ticker symbol XETRA: HLC. As of the date of this memorandum, HSAG has an approximate market capitalization of €14.8 billion. For fiscal year 2022, HSAG reported consolidated revenue of €6.12 billion. HSAG is headquartered in Dresden, Saxony, Germany, and is a global leader in power semiconductor design and fabrication, with operations in twelve countries. HSAG's product portfolio includes power management integrated circuits, silicon carbide ("SiC") power modules, insulated-gate bipolar transistors ("IGBTs"), and analog semiconductor devices, serving the automotive, industrial, and consumer electronics markets. HSAG's existing U.S. operations consist of Halcyon US Inc., a fabless semiconductor design center located in Austin, Texas, with approximately 320 employees focused on analog and mixed-signal IC design for the commercial automotive market. Halcyon US Inc. does not perform any classified work, does not hold a Facility Security Clearance, and is not registered with the Directorate of Defense Trade Controls ("DDTC").

The Target. VPI is a Delaware C-corporation incorporated on February 14, 2009. VPI's principal executive offices are located at 7400 Ridgeline Parkway, Colorado Springs, Colorado 80919. VPI's primary manufacturing facility — a gallium-nitride on silicon-carbide ("GaN-on-SiC") fabrication facility — is located at 9200 Innovation Boulevard, Albuquerque, New Mexico 87113. The Albuquerque facility comprises approximately 45,000 square feet of fabrication, testing, and office space. The facility holds an active Facility Security Clearance ("FCL") at the SECRET level, issued by the Defense Counterintelligence and Security Agency ("DCSA"), under CAGE Code 7VK92.

VPI designs and manufactures advanced gallium-nitride power amplifier chips used in defense radar systems, satellite communications, electronic warfare applications, and 5G telecommunications infrastructure. VPI occupies a strategically significant position in the U.S. defense industrial base as one of a limited number of domestic manufacturers capable of producing high-performance GaN-on-SiC power amplifiers at the specifications required for advanced defense applications.

For fiscal year 2022, VPI reported revenue of $287.4 million and adjusted EBITDA of $61.2 million. VPI employs 486 individuals, of whom 212 (approximately 43.6%) hold active U.S. government security clearances at the SECRET, TOP SECRET, or TS/SCI levels. VPI holds 14 active contracts with the U.S. Department of Defense ("DoD"), both as a prime contractor and as a subcontractor, with aggregate contract backlog of approximately $193 million.

VPI's key government customers include: the U.S. Army Program Executive Office for intelligence, Electronic Warfare & Sensors ("PEO IEW&S"); the U.S. Air Force Research Laboratory ("AFRL"); the Missile Defense Agency ("MDA"); the U.S. Navy Naval Sea Systems Command ("NAVSEA"), via subcontract to Ironclad Defense Systems Inc.; and the Department of Homeland Security Science and Technology Directorate ("DHS S&T").

VPI's management team includes Dr. Nathan Trevorrow, Chief Executive Officer, who holds a TS/SCI clearance; Marissa Sung-Avila, President and Chief Operating Officer, who holds a SECRET clearance; and Col. (Ret.) Bryce Hendrickson, USAF, Vice President of Government Programs and Facility Security Officer, who holds a TS/SCI clearance.

B. CFIUS Filing History

Calderwood & Harkness LLP was engaged on June 12, 2023 to serve as counsel to HSAG for the CFIUS filing and mitigation aspects of the transaction. The following is a chronological summary of the CFIUS proceedings to date:

• June 19, 2023: Pre-filing consultation with the Treasury Department's Office of Investment Security ("OIS"). During this meeting, we presented the key elements of the proposed transaction, VPI's defense-sector activities, and HSAG's corporate profile. OIS indicated that the transaction would likely be subject to a full review given VPI's Facility Security Clearance and classified contract portfolio, and that DoD and DOE would likely serve as co-lead agencies.

• July 14, 2023: Joint voluntary notice filed by HSAG and VPI under 31 C.F.R. Part 800. The notice was prepared and submitted in accordance with 31 C.F.R. § 800.501 et seq. and included all required transaction documents, party information, and national security–related disclosures.

• July 21, 2023: CFIUS formally accepted the filing as complete, triggering the commencement of the initial 45-day review period under 50 U.S.C. § 4565(b)(1)(E).

• August 4, 2023: CFIUS issued its first Request for Information ("RFI"). The RFI comprised thirty-four (34) questions spanning multiple areas, including: HSAG's relationships with German and European Union government entities; HSAG's cybersecurity practices and certifications; VPI's and HSAG's technology transfer protocols; HSAG's exposure to the Chinese market, including a detailed description of HSAG's China subsidiary; HSAG's corporate governance structure and any foreign government influence or ownership; and VPI's classified programs and cleared personnel.

• August 18, 2023: We submitted HSAG's supplemental response to the first RFI, together with supporting exhibits including HSAG's ISO 27001 certification, enterprise cybersecurity framework documentation, a description of HSAG's China subsidiary operations, HSAG's corporate governance charter, and VPI's export compliance manual.

• September 4, 2023: The initial 45-day review period concluded. CFIUS determined that the review period was insufficient to complete its assessment and initiated the 45-day investigation phase under 50 U.S.C. § 4565(b)(2)(A). The notification confirming initiation of the investigation identified the Department of Defense and the Department of Energy as co-lead agencies, reflecting VPI's defense-sector activities and VPI's work with dual-use semiconductor technologies that implicate DOE equities related to advanced materials and energy applications.

• September 22, 2023: CFIUS issued its second RFI. This RFI comprised twenty-two (22) follow-up questions, principally drafted by representatives of DoD and DOE. The second RFI focused on: detailed VPI intellectual property transfer risks, including patent-by-patent analysis of government-funded inventions; VPI supply chain dependencies, with a request for a full bill-of-materials mapping and country-of-origin analysis for critical materials; HSAG's relationships with non-allied foreign governments, including detailed questions about HSAG's customer base in countries of concern; personnel continuity plans; and the proposed post-closing corporate governance structure.

• October 6, 2023: We submitted HSAG's supplemental response to the second RFI, together with extensive supporting exhibits including VPI's supply chain map (identifying all critical-path suppliers by country of origin), a detailed IP transfer risk analysis prepared by Omar Siddiqui and Christy Bauer, HSAG's customer lists segregated by country, and a preliminary post-closing governance proposal.

• October 20, 2023: CFIUS communicated its preliminary national security concerns to the parties. This is the communication that is the subject of the present memorandum.

C. Significance of Preliminary Concerns Communication

The communication of preliminary national security concerns is a discretionary step that CFIUS may take during the investigation phase. It is not required by statute or regulation, but it has become a routine practice in matters where the Committee identifies specific, articulable national security risks that it believes can be addressed through mitigation. The significance of this communication should be understood in context:

First, the communication of specific concerns — rather than an adverse recommendation to the President, a request for withdrawal and refiling, or silence — indicates that CFIUS has concluded that the transaction presents genuine national security issues but that those issues are amenable to resolution through a negotiated National Security Agreement. This is the procedural pathway that leads to transaction clearance in the substantial majority of cases involving foreign acquisitions of U.S. defense contractors.

Second, the four concerns identified by CFIUS align closely with the seven risk factors we identified in our CFIUS Risk Assessment & Mitigation Strategy Memo dated June 26, 2023, which was prepared at the outset of the engagement. Specifically, Concerns 1 through 4 correspond directly to Risk Factors 1, 2, 4, and 5 in that memo. The remaining three risk factors we identified — relating to supply chain dependencies on Chinese-origin materials (Risk Factor 3, now mitigated by VPI's allied-nation supply chain), VPI's role in national critical technology (Risk Factor 6), and HSAG's German government relationships (Risk Factor 7) — were not raised as separate concerns. This suggests that our proactive disclosures and mitigation proposals in the notice and RFI responses have effectively framed the discussion, and that CFIUS has narrowed its focus to the four issues that we anticipated would be most significant.

Third, based on our experience and precedent review, we expect CFIUS to circulate an initial draft NSA within approximately two weeks of the preliminary concerns communication, targeting early November 2023. The concerns communication effectively functions as CFIUS's opening position in the mitigation negotiation. By submitting a detailed, proactive response with specific proposed mitigation measures, we can influence the content of the initial draft NSA and accelerate the negotiation timeline.

III. Analysis of Concern No. 1: Foreign Access to Classified Defense Programs

A. Statement of the Concern

In its October 20, 2023 communication, CFIUS expressed concern that, following the closing of the transaction, HSAG — as a German parent company with no U.S. security clearances — would have the ability to access, influence, or compromise VPI's participation in classified defense programs. The Committee's concern encompasses several related dimensions: direct access by HSAG personnel to classified information or classified facilities; indirect influence over classified program decisions through HSAG's exercise of ownership and governance rights over VPI; and the potential for compromise of classified programs through the introduction of foreign ownership, control, or influence ("FOCI") into VPI's corporate structure.

This concern is grounded in the following key facts:

VPI holds an active Facility Security Clearance at the SECRET level, issued by DCSA, for its fabrication facility at 9200 Innovation Boulevard, Albuquerque, New Mexico 87113 (CAGE Code 7VK92). The FCL is a condition of VPI's ability to perform classified work under its government contracts and to receive, store, and process classified information at the facility.

Of VPI's 486 employees, 212 — representing 43.6% of the total workforce — hold active U.S. government security clearances. The clearance levels range from SECRET to TOP SECRET/SCI. Notably, VPI's CEO, Dr. Nathan Trevorrow, and its Vice President of Government Programs / Facility Security Officer, Col. (Ret.) Bryce Hendrickson, USAF, both hold TS/SCI clearances, which are required for their roles in overseeing VPI's most sensitive classified programs.

VPI holds 14 active contracts with the DoD, several of which involve classified work at the SECRET level or above. The key classified programs include:

• U.S. Army CERDEC (AN/TPS-80 Radar Program): VPI supplies GaN high-electron-mobility transistor ("HEMT") modules for the AN/TPS-80 multi-mission radar system. Remaining contract backlog: $52.3 million. This program involves classified technical specifications, performance parameters, and integration data.

• U.S. Air Force Research Laboratory (Next-Generation mmWave Power Amplifiers): VPI is developing next-generation millimeter-wave power amplifiers under an AFRL research contract. Remaining contract backlog: $41.7 million. This program involves classified performance objectives and potential applications in advanced radar and electronic warfare systems.

• Missile Defense Agency (GaN-Based T/R Modules): VPI fabricates GaN-based transmit/receive modules for missile defense radar applications. Remaining contract backlog: $38.9 million. This program involves classified system-level requirements and integration specifications.

In aggregate, VPI's classified program backlog exceeds $130 million, representing a substantial portion of VPI's overall $193 million government contract backlog. The classified nature of these programs means that any disruption to VPI's Facility Security Clearance — or any unauthorized access to classified information by uncleared foreign persons — could have serious national security consequences.

B. Assessment

This is the most significant of the four preliminary concerns and will serve as the primary driver of the governance and structural provisions in any National Security Agreement. The concern strikes at the core of the FOCI issue that arises in every foreign acquisition of a U.S. company holding a Facility Security Clearance and performing classified work.

Several factors contribute to the significance of this concern:

HSAG's Lack of U.S. Security Clearances. HSAG currently holds no U.S. security clearances at any level — neither entity-level Facility Security Clearances nor individual personnel security clearances for any HSAG officer, director, or employee. HSAG's existing U.S. operations through Halcyon US Inc. in Austin, Texas — a fabless design center with approximately 320 employees — are entirely focused on commercial semiconductor design and do not involve any classified work. Accordingly, HSAG has no existing FOCI mitigation framework and no existing relationship with DCSA's FOCI Branch.

HSAG Senior Management. Dr. Maximilian Ehrhardt, HSAG's Chief Executive Officer, is a German citizen residing in Dresden, Germany, who does not hold and is not eligible for a U.S. security clearance. Katarina Brückner, HSAG's Chief Financial Officer, is likewise a German citizen without U.S. clearance eligibility. Stefan Lohse, HSAG's General Counsel, is a German/U.S. dual citizen admitted to the bar of the State of New York, but he does not currently hold a U.S. security clearance. While Mr. Lohse's dual citizenship and U.S. bar admission may facilitate certain aspects of the mitigation process, he would need to obtain a clearance if he were to have any role in overseeing classified programs, which we do not recommend.

FOCI Implications. The proposed acquisition presents a paradigmatic FOCI scenario under the National Industrial Security Program Operating Manual ("NISPOM"), 32 C.F.R. Part 117. One hundred percent foreign ownership of a cleared contractor is the most intensive FOCI configuration and requires the most robust structural mitigation measures. Per our FOCI Analysis memo dated July 1, 2023, we assessed the full spectrum of FOCI mitigation instruments and concluded that a Special Security Agreement ("SSA") is the appropriate instrument for this transaction, given that VPI's classified work is at the SECRET level and that HSAG is a company from a closely allied nation (Germany is a NATO ally and a member of the "Five Eyes Plus" Intelligence-sharing framework for certain purposes).

One favorable factor in the FOCI analysis is that HSAG has no German government ownership or control. HSAG is a publicly traded company with a widely dispersed shareholder base; no single shareholder holds more than 8% of outstanding shares, and the German federal government and German state governments hold no equity interest. This eliminates the additional layer of concern that arises when a foreign government-controlled entity acquires a U.S. cleared contractor. Nevertheless, the 100% foreign private-sector ownership of VPI post-closing will require robust structural mitigation to satisfy DCSA and CFIUS.

C. Recommended Mitigation Proposals

Based on our analysis and our review of recent semiconductor-sector NSA precedents, we recommend proposing the following mitigation measures to address Concern No. 1:

1. Board Reconstitution. We propose reconstituting VPI's board of directors as a five-member board with the following composition:

(a) Three (3) "Security Board Members," each of whom must be a U.S. citizen holding or eligible for a security clearance at the TS/SCI level. At least one of the three Security Board Members must be an independent Security Director — i.e., an individual who is not affiliated with either HSAG or the legacy VPI shareholders, who has relevant national security and/or semiconductor industry experience, and who will serve as the chair of the Government Security Committee (described below). The remaining two Security Board Members may be drawn from VPI's existing management or board, provided they meet the citizenship and clearance requirements.

(b) Two (2) HSAG-designated directors, who may be officers or employees of HSAG or its affiliates. The HSAG designees may participate in board deliberations on commercial, financial, and strategic matters, but they may not hold or access classified information, may not participate in any deliberation or vote concerning classified programs or FOCI-related matters, and may not access classified facilities without prior approval from DCSA and the Government Security Committee.

Our Comparative NSA Precedent Analysis confirms that this 3-2 board composition — with three cleared Security Board Members and two foreign-parent designees — is the standard governance model in semiconductor-sector NSAs involving acquisitions of U.S. cleared contractors by allied-nation buyers. This structure was employed in at least eight of the twelve precedent transactions we analyzed.

2. Government Security Committee (GSC). We propose establishing a Government Security Committee composed solely of the three Security Board Members. The GSC would have exclusive authority over:

(a) All classified and ITAR-controlled programs, including decisions to bid on, accept, perform, modify, or terminate classified contracts;

(b) Personnel security decisions, including hiring, termination, and reassignment of cleared personnel, and the sponsorship of new security clearance applications;

(c) Facility security matters, including FCL maintenance, physical security measures at the Albuquerque facility, and compliance with NISPOM requirements;

(d) Oversight of the Technology Control Plan (discussed in Section IV.C below) and cybersecurity requirements (discussed in Section V.C below);

(e) Approval of any access by HSAG personnel to VPI facilities or information beyond what is expressly permitted under the NSA; and

(f) Communication and reporting to DCSA, CFIUS monitoring agencies, and the third-party compliance monitor.

The GSC would meet no less than quarterly and would have the authority to convene special sessions as needed. HSAG-designated directors would be excluded from all GSC deliberations. Minutes of GSC meetings would be maintained and made available to DCSA and the third-party compliance monitor upon request.

3. Facility Security Clearance Maintenance. We propose confirming in the NSA that VPI will retain its existing Facility Security Clearance at the SECRET level (CAGE Code 7VK92) following the closing of the transaction. To accomplish this, we recommend that the NSA be structured to function as the equivalent of a Special Security Agreement under NISPOM § 117.56(d), which DCSA has accepted in analogous transactions involving foreign acquisitions of U.S. cleared contractors by allied-nation buyers. Under this approach, the NSA itself — with its governance, access, and oversight provisions — would serve as VPI's FOCI mitigation instrument, and no separate FOCI mitigation plan would be required beyond the terms of the NSA. This approach streamlines the process and avoids duplicative compliance obligations.

We note that DCSA will need to be engaged directly regarding the FCL transition. David Caruso has an existing relationship with the DCSA FOCI Branch and recommends initiating informal outreach to DCSA's Industrial Security Field Office in Albuquerque promptly following our response to CFIUS.

4. Proposed Security Board Members. We recommend identifying the following candidates for the three Security Board Member positions:

(a) Col. (Ret.) Bryce Hendrickson, USAF — VPI's current Vice President of Government Programs and Facility Security Officer. Col. Hendrickson holds an active TS/SCI clearance, has served as VPI's FSO since 2015, and has deep institutional knowledge of all VPI classified programs. His continued presence on the board would ensure continuity and credibility with DCSA and DoD contracting officers.

(b) Adrienne Delacroix — VPI's current independent director. Ms. Delacroix has served on VPI's board since 2017, holds an active SECRET clearance, and has extensive experience in the defense electronics sector through prior executive roles at Camberwell Corporation and Halcyon Partners LLC. She is well-regarded by VPI's government customers.

(c) To-Be-Identified Independent Security Director — The third Security Board Member should be an individual not affiliated with either HSAG or legacy VPI stakeholders, with a TS/SCI clearance, relevant semiconductor industry experience, and ideally a background in senior U.S. government national security roles. We have begun identifying potential candidates and will present options to the client. The selection of this individual will require CFIUS and DCSA approval.

5. FSO Retention. We recommend confirming in the NSA that Col. (Ret.) Bryce Hendrickson will remain as VPI's Facility Security Officer following the closing of the transaction, maintaining continuity of security oversight. The FSO is the individual responsible for day-to-day compliance with NISPOM requirements, and DCSA places significant weight on FSO continuity in FOCI transitions. Col. Hendrickson's retention should be a non-negotiable commitment.

6. Facility Access Restrictions. We propose that the NSA include specific provisions prohibiting HSAG personnel — including HSAG-designated board members, officers, employees, agents, and contractors — from accessing VPI's classified facilities without prior written approval from both DCSA and the GSC. Specifically:

(a) Sections C-7 through C-12 of the Albuquerque fabrication facility — which house the classified clean rooms, testing labs, and secure storage for classified documents and materials — would be designated as restricted areas to which no HSAG personnel may have access under any circumstances without specific, advance written authorization from DCSA and the GSC.

(b) Unclassified areas at VPI's Colorado Springs headquarters and unclassified areas at the Albuquerque facility would be accessible to HSAG-designated board members and certain designated HSAG personnel for legitimate business purposes, subject to advance notice to the GSC (minimum 48 hours), escort by a VPI-designated employee at all times while on premises, and visitor logs maintained by the FSO.

These facility access restrictions are consistent with the standard approach in recent NSAs and should be acceptable to CFIUS.

IV. Analysis of Concern No. 2: Potential Transfer of ITAR/EAR-Controlled Technology to Non-U.S. Persons

A. Statement of the Concern

CFIUS raised concern regarding the risk that VPI's defense articles controlled under the ITAR and dual-use technologies controlled under the EAR could be transferred — whether deliberately or inadvertently — to HSAG's non-U.S. personnel, subsidiaries, or affiliates following the closing of the transaction. The Committee specifically identified the risk of technology diversion to HSAG's China subsidiary, Halcyon Semiconductor (Shanghai) Co., Ltd. ("Halcyon Shanghai"), as a particular sensitivity.

The factual basis for this concern is substantial. VPI's product portfolio includes items controlled under both the ITAR and the EAR:

ITAR-Controlled Items. Certain VPI products — specifically, advanced GaN power amplifier modules designed and fabricated to military specifications for defense radar, electronic warfare, and missile defense applications — are classified as defense articles under Category XI(a)(3) of the United States Munitions List ("USML"). VPI has been registered with DDTC since 2011 under Registration Number M-24817. VPI currently holds three (3) active DSP-5 (Permanent Export) licenses authorizing the export of specific defense articles to NATO allies, specifically the United Kingdom and Australia, in connection with collaborative defense programs.

EAR-Controlled Items. VPI's commercial and dual-use GaN power amplifier products are classified under Export Control Classification Numbers ("ECCNs") 3A001 (electronic components), 3A991 (electronic components not elsewhere specified), and 3E001 (technology for the development, production, or use of items in ECCN 3A001). These classifications subject VPI's products and underlying technology to export licensing requirements for most destinations, with particularly restrictive requirements for China, Russia, and other countries subject to comprehensive sanctions or heightened export controls.

intellectual Property. VPI's IP portfolio is extensive and includes forty-seven (47) issued U.S. patents and twelve (12) pending patent applications covering core technologies including GaN epitaxial growth processes, high-electron-mobility transistor (HEMT) device architectures, millimeter-wave power amplifier circuit designs, and reliability screening methodologies. Additionally, VPI maintains thirty-one (31) registered internal trade secrets, consisting primarily of proprietary GaN epitaxial recipes (specific material compositions, growth temperatures, layer structures, and doping profiles) and die-level reliability screening processes that represent VPI's critical competitive advantages and are among the most sensitive categories of VPI's intellectual property.

Significantly, twenty-three (23) of VPI's forty-seven issued patents were developed in whole or in part under U.S. government-funded contracts and are subject to the government's rights under the Bayh-Dole Act, including march-in rights under 35 U.S.C. § 203, as well as the rights reserved to the U.S. government under DFARS 252.227-7038 (Patent Rights — Ownership by the Contractor (Large Business)). While these government rights do not prevent VPI from commercializing these inventions, they impose restrictions on the disposition of the underlying intellectual property and could be exercised by the government if VPI were to fail to take effective steps to achieve practical application of the inventions or if action is necessary to alleviate health or safety needs or to meet requirements for public use.

B. Assessment

This concern was anticipated by our team and was a significant focus of both RFI responses submitted to CFIUS. In our first RFI response (filed August 18, 2023), we provided detailed information regarding HSAG's technology transfer protocols, including HSAG's internal export compliance program, technology access controls, and the organizational separation between HSAG's defense-adjacent operations and Halcyon Shanghai. In our second RFI response (filed October 6, 2023), we specifically addressed VPI IP transfer risks, including the patent-by-patent analysis of government-funded inventions and a detailed assessment of deemed export considerations.

The concern has two principal dimensions, each of which must be addressed through distinct mitigation mechanisms:

Deemed Exports. The first dimension relates to "deemed exports" — the transfer of controlled technology to foreign national persons within the United States. Under EAR § 734.2(b)(2) and ITAR § 120.54, the release of controlled technology to a foreign person, even within the United States, constitutes an export to the home country of that individual. Post-closing, HSAG's non-U.S. employees — including engineers, executives, and technical staff based in Germany, Japan, and other countries — may interact with VPI personnel in the ordinary course of business. Any release of ITAR-controlled technical data or EAR-controlled technology to these individuals without a valid export authorization would constitute a violation of applicable export control regulations. The risk of inadvertent deemed exports is heightened in the context of a corporate integration, where joint meetings, collaborative engineering discussions, shared databases, and personnel transfers could facilitate uncontrolled technology flows.

Actual Transfers. The second dimension relates to actual transfers of controlled technical data across HSAG's global network. Post-closing, HSAG may seek to integrate certain aspects of VPI's operations with its broader corporate infrastructure, creating channels through which controlled technical data could flow to HSAG's foreign subsidiaries and affiliates. The risk is compounded by the breadth of HSAG's global operations: HSAG maintains subsidiaries and affiliates in twelve countries, including Germany, Japan, South Korea, Singapore, Malaysia, Israel, and — most critically — China. While HSAG's China subsidiary, Halcyon Shanghai, generates only $81.4 million in annual revenue (approximately 1.3% of HSAG's total consolidated revenue) and engages solely in the design and testing of consumer-grade power management integrated circuits with no GaN or defense-related activities, CFIUS remains focused on the theoretical channel for technology diversion that Halcyon Shanghai represents. This focus is consistent with the Committee's well-documented scrutiny of any nexus between transaction parties and Chinese entities, regardless of the nature or scale of such entities' operations.

Per Christy Bauer's ITAR/EAR Classification Review dated September 8, 2023, six (6) items in VPI's product portfolio may require reclassification review following the closing of the transaction. This is because the change in ownership from a U.S.-owned company to a foreign-owned company may alter the end-use or end-user analysis that informs export classification determinations. Specifically, items that were previously classified as EAR99 (no license required for most destinations) may require classification under a more restrictive ECCN if the change in ownership introduces a new foreign principal or creates a new deemed export scenario. We recommend that the reclassification review be completed prior to closing to avoid any compliance gaps in the immediate post-closing period.

C. Recommended Mitigation Proposals

1. Technology Control Plan (TCP). We propose developing a comprehensive Technology Control Plan as a formal annex to the NSA. The TCP would establish binding obligations and procedures governing the handling, storage, access, and transfer of all ITAR- and EAR-controlled technical data within VPI, and would prohibit any transfer of such data to any non-U.S. person without prior U.S. government authorization (a DDTC license for ITAR-controlled defense articles and technical data, or a BIS license for EAR-controlled items and technology). The TCP should address:

(a) Physical documents and hardware, including classified and controlled unclassified documents, prototype hardware, test articles, and manufacturing tools;

(b) Electronic data, including CAD files, simulation models, fabrication process recipes, test data, and technical reports, whether stored on local servers, portable media, or cloud-based systems;

(c) Verbal disclosures, including discussions at meetings, conferences, telephone calls, and video conferences that involve controlled technical data; and

(d) Visual access, including tours of manufacturing facilities, observation of fabrication processes, and review of equipment configurations that could reveal controlled technology.

The TCP would be administered by VPI's Facility Security Officer under the oversight of the GSC and would be subject to annual review and audit by the third-party compliance monitor.

2. Data Segregation. We propose that VPI's IT systems be physically and logically separated from HSAG's global network at all times. This means:

(a) No shared cloud infrastructure — VPI may not use any cloud services, platforms, or storage that are shared with, managed by, or accessible to HSAG or any HSAG affiliate;

(b) No shared email systems — VPI personnel must use VPI-branded, VPI-administered email systems that are not connected to HSAG's Strathmore Data Systems or other enterprise email platform;

(c) No shared file servers, engineering databases, or product lifecycle management ("PLM") systems — VPI's engineering data must reside exclusively on servers physically located within the United States and accessible only to authorized VPI personnel; and

(d) No VPN tunnels, network bridges, or other electronic connections between VPI's network and HSAG's global network that could enable the transfer of data between the two environments.

This data segregation requirement reinforces the Technology Control Plan and provides an additional structural safeguard against unauthorized technology transfer.

3. Deemed Export Controls. We propose establishing internal protocols and training programs to ensure that no foreign national employee of HSAG or any HSAG affiliate is given access to VPI controlled technical data in any form — whether in documents, electronic files, verbal discussions, or visual observations — without a valid export authorization. These protocols would include:

(a) Pre-meeting review procedures for any interaction between VPI personnel and HSAG personnel (whether in person or virtual) to identify and segregate controlled technical data;

(b) Designated "export control officers" at both VPI and HSAG who are responsible for screening proposed interactions and confirming compliance;

(c) Mandatory annual training for all VPI employees on deemed export rules, covering ITAR and EAR requirements, with targeted training for VPI engineers and program managers who are most likely to interact with HSAG counterparts; and

(d) Corresponding training for HSAG personnel who may interact with VPI, emphasizing the restrictions on access to controlled technology and the consequences of violations.

4. DDTC and BIS Compliance Continuity. We propose confirming in the NSA and in our response to CFIUS that VPI will maintain its DDTC registration (Registration No. M-24817) following the closing of the transaction, with a change-of-ownership notification filed under ITAR § 122.4(a) within sixty (60) days of closing. We further propose addressing the need to amend VPI's three (3) active DSP-5 export licenses to reflect the change in VPI's ownership. Specifically, VPI will submit applications to DDTC to amend these licenses promptly following closing, and VPI will not conduct any exports under the existing licenses during the amendment period unless DDTC confirms in writing that such exports remain authorized pending amendment. VPI will also maintain all EAR compliance programs, including its internal classification procedures, license application protocols, and recordkeeping systems.

5. Firewall for China Operations. We propose including in the NSA an explicit, freestanding prohibition — going beyond the general export control compliance obligations described above — that specifically bars any sharing of VPI technical data, products, components, know-how, trade secrets, or other proprietary information with Halcyon Semiconductor (Shanghai) Co., Ltd. or any other HSAG entity located in, or substantially owned or controlled by persons or entities in, the People's Republic of China or any other country identified as a country of concern under the NSA. This provision would be a direct, contractual obligation binding on HSAG and all of its subsidiaries and affiliates worldwide, enforceable by CFIUS and subject to monitoring by the third-party compliance monitor. The inclusion of a specific, named prohibition regarding the China subsidiary — rather than relying solely on the general export control compliance framework — is consistent with the approach taken in recent semiconductor-sector NSAs and demonstrates HSAG's understanding of the sensitivity of the China nexus.

6. Trade Secret Protections. In addition to the export control measures described above, we propose enhanced internal controls specifically addressing VPI's thirty-one (31) registered trade secrets, which include the company's most competitively sensitive and strategically valuable technology — particularly the proprietary GaN epitaxial recipes and die-level reliability screening processes. These enhanced controls, as recommended in our Trade Secret Protection Assessment dated August 22, 2023, would include:

(a) Additional physical access restrictions for areas where trade secret materials are stored or used, including biometric access controls and surveillance systems;

(b) Need-to-know limitations restricting access to trade secret materials to specifically identified VPI employees whose job responsibilities require such access;

(c) Enhanced employee exit protocols, including comprehensive exit interviews, reminders of continuing confidentiality obligations, and device and document audits for departing employees who had access to trade secrets; and

(d) A trade secret registry maintained by VPI's General Counsel (or equivalent officer) documenting each registered trade secret, the individuals authorized to access it, and the date, purpose, and outcome of each access event.

V. Analysis of Concern No. 3: Cybersecurity Risks from Integration with HSAG IT Infrastructure

A. Statement of the Concern

CFIUS expressed concern that post-closing integration of VPI's information technology systems with HSAG's global IT infrastructure could create cybersecurity vulnerabilities that might expose classified information, controlled unclassified information, and proprietary technical data to foreign intelligence services, unauthorized third parties, or other threat actors. The Committee's concern reflects a broader emphasis on cybersecurity that has become a standard feature of CFIUS reviews involving defense contractors and companies handling sensitive technologies.

This concern was initially flagged during the first RFI (August 4, 2023), when CFIUS requested detailed information regarding HSAG's cybersecurity practices, certifications, and enterprise IT architecture. In our first RFI supplemental response (August 18, 2023), we provided HSAG's ISO 27001:2022 certification, a description of HSAG's enterprise cybersecurity framework (including its Security Operations Center in Dresden), and a summary of HSAG's recent cybersecurity audit results. Despite these disclosures, the Committee has identified cybersecurity as a standalone concern in its preliminary communication, indicating that the information provided to date has not fully resolved the issue.

The concern is amplified by VPI's defense-focused business profile. As a cleared defense contractor performing classified work and handling CUI, VPI is subject to stringent cybersecurity requirements under DFARS 252.204-7012 ("Safeguarding Covered Defense Information and Cyber Incident Reporting"), which requires contractors to implement the security controls specified in NIST Special Publication 800-171 ("Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations"). VPI's compliance with these requirements is a contractual obligation under its DoD contracts and is essential to its ability to receive and handle CUI.

B. Assessment

VPI currently maintains its own standalone IT infrastructure, which is independent of any external corporate network. This infrastructure includes:

(a) A secure, classified network at the Albuquerque fabrication facility, which is air-gapped — meaning it is physically disconnected from the internet and from any other network. The classified network is used for processing, storing, and transmitting classified information related to VPI's classified defense programs. This network is already fully compliant with NISPOM requirements and is inspected regularly by DCSA.

(b) An unclassified-but-controlled network, also centered at the Albuquerque facility, which handles CUI, ITAR-controlled technical data, EAR-controlled technology, and proprietary trade secrets. This network is connected to the internet through a protected perimeter and is subject to VPI's NIST SP 800-171 compliance framework.

(c) A general-purpose corporate network at VPI's Colorado Springs headquarters, which handles routine business functions such as human resources, accounting, marketing, and general correspondence.

The cybersecurity risk identified by CFIUS relates primarily to VPI's unclassified-but-controlled network and the sensitive information it contains. The classified network, being air-gapped, is inherently protected from the risks associated with integration with HSAG's corporate infrastructure. However, the unclassified-but-controlled network — which handles CUI, ITAR/EAR technical data, and proprietary trade secrets — would be exposed to significant risk if it were connected to or integrated with HSAG's global IT infrastructure. The potential attack vectors include:

• Lateral movement by threat actors who compromise HSAG's network and use the connection to VPI's network as an access point;

• Data exfiltration by authorized HSAG users who intentionally or inadvertently access VPI data through shared systems;

• Insider threats from HSAG IT administrators who may have access to VPI systems in a shared IT environment; and

• Supply chain attacks targeting shared software, cloud services, or third-party IT vendors that serve both HSAG and VPI.

Regarding HSAG's existing cybersecurity posture: HSAG holds ISO 27001:2022 certification for its enterprise IT systems, which is a recognized international standard for information security management. However, ISO 27001 certification does not meet the U.S. government's NIST SP 800-171 requirements that apply to defense contractors handling CUI. The two frameworks have different scopes, controls, and assessment methodologies. NIST SP 800-171 includes 110 specific security requirements organized into 14 families, many of which address U.S. government-specific concerns (such as CUI marking, controlled access to government data, and incident reporting to DoD) that are not covered by ISO 27001. Accordingly, even though HSAG maintains a robust cybersecurity program by commercial standards, its existing framework is not sufficient to meet the requirements that apply to VPI's defense-related systems.

Our review of recent semiconductor-sector NSAs confirms that cybersecurity has become a standard and significant component of mitigation agreements. All twelve precedent NSAs we analyzed included cybersecurity provisions, with the level of specificity and rigor increasing markedly in NSAs executed after 2021. The baseline standard in recent NSAs is NIST SP 800-171 compliance, with several NSAs also requiring alignment with the Cybersecurity Maturity Model Certification ("CMMC") framework — specifically CMMC Level 2, which corresponds to the 110 practices in NIST SP 800-171.

C. Recommended Mitigation Proposals

1. IT System Separation. We propose that VPI's IT systems — including all three network tiers (classified, unclassified-but-controlled, and general corporate) — remain physically and logically separated from HSAG's global network at all times. This separation would be absolute and without exception for the classified and unclassified-but-controlled networks. Specifically:

(a) No shared cloud infrastructure — VPI may not use any cloud computing, storage, or software-as-a-service platforms that are shared with, hosted by, or accessible to HSAG or any HSAG affiliate;

(b) No VPN tunnels, leased lines, or other network connections between VPI's networks and HSAG's networks;

(c) No common identity management, single sign-on, or directory services (e.g., shared Active Directory or Azure AD tenants);

(d) No shared IT management tools, monitoring platforms, or helpdesk systems; and

(e) Separate IT staff — VPI's IT infrastructure must be managed by VPI employees or U.S.-based contractors who have been vetted and approved by the GSC, not by HSAG's global IT organization.

2. NIST SP 800-171 Compliance. We propose that VPI maintain full compliance with NIST SP 800-171 for all information systems that process, store, or transmit CUI. This commitment would include:

(a) Annual self-assessments of VPI's NIST SP 800-171 compliance, with results documented in a System Security Plan ("SSP") and a Plan of Action and Milestones ("POA&M") for any identified gaps;

(b) Triennial third-party assessments conducted by a qualified cybersecurity firm, with results reported to DCSA and the third-party compliance monitor; and

(c) A proactive commitment to obtain Cybersecurity Maturity Model Certification ("CMMC") at Level 2 when the CMMC certification framework becomes operational, demonstrating VPI's readiness to meet evolving DoD cybersecurity requirements. Given the current trajectory of the CMMC rulemaking process, we anticipate that CMMC certification requirements will begin appearing in DoD solicitations in 2025, making early compliance advantageous for VPI's competitive position.

3. Annual Penetration Testing. We propose that VPI undergo annual penetration testing of its IT systems — including both external and internal penetration tests — conducted by a qualified, independent cybersecurity firm. The penetration testing firm would be selected from a list approved by the GSC and DCSA. The scope of testing would cover VPI's unclassified-but-controlled network and general corporate network (the classified network would be excluded from external penetration testing due to its air-gapped configuration, but internal security assessments of the classified network would be conducted under DCSA oversight). Penetration test reports, including identified vulnerabilities and remediation plans, would be provided to DCSA and the third-party compliance monitor within thirty (30) days of completion.

4. Incident Reporting. We propose a mandatory incident reporting obligation requiring VPI to notify DCSA within seventy-two (72) hours of discovering any cybersecurity incident affecting VPI's information systems, whether classified or unclassified. This obligation would apply to any incident involving:

(a) Unauthorized access to VPI systems or data;

(b) Loss, theft, or compromise of CUI, ITAR-controlled technical data, or trade secrets;

(d) Any incident that triggers a DFARS 252.204-7012 reporting obligation; or

(e) Any incident that, in the judgment of VPI's Facility Security Officer or Chief Information Security Officer, could have implications for national security or the integrity of VPI's defense programs.

The 72-hour reporting timeline aligns with the existing requirements under DFARS 252.204-7012 and is consistent with the incident reporting obligations in recent NSA precedents. Reports would be provided concurrently to DCSA, the CFIUS monitoring agencies (Treasury, DoD, and DOE), and the third-party compliance monitor.

5. Cybersecurity Requirements Annex. We propose developing a detailed Cybersecurity Requirements annex to the NSA that consolidates all cybersecurity-related obligations into a single, comprehensive document. The annex would address:

(a) Technical security controls aligned with NIST SP 800-171;

(b) IT system separation requirements;

(d) Data encryption standards (at rest and in transit);

(e) Incident response and reporting procedures;

(f) Penetration testing and vulnerability management;

(g) Personnel security requirements for IT staff;

(h) Physical security for IT infrastructure; and

(i) Annual review and update procedures.

The Cybersecurity Requirements annex would be reviewed and updated annually by the GSC and the third-party compliance monitor, with updates reported to DCSA and CFIUS monitoring agencies.

6. HSAG Access Controls for Limited Business Information Sharing. We recognize that, as the parent company of VPI post-closing, HSAG will have legitimate needs to receive certain categories of VPI information for business purposes — principally financial reporting data required for HSAG's consolidated financial statements under IFRS, tax compliance data, and high-level business performance metrics. We propose that any such information sharing occur exclusively through a defined, secure data exchange mechanism with the following safeguards:

(a) Encrypted transmission channels using AES-256 encryption or equivalent;

(b) Restricted data categories — only financial and business data, with no technical data, engineering data, classified information, CUI, ITAR/EAR-controlled technology, or trade secrets;

(d) Comprehensive audit logging of all data exchanges, with logs retained for a minimum of five (5) years and available for review by the third-party compliance monitor; and

(e) Annual review of the data exchange mechanism by the GSC and the third-party compliance monitor to confirm that it continues to meet security requirements and that no unauthorized data categories are being shared.

VI. Analysis of Concern No. 4: Continuity of Critical DoD Supply Chain

A. Statement of the Concern

CFIUS raised concern about the continuity and reliability of VPI as a supplier of critical defense components — specifically, GaN power amplifier chips for defense radar, satellite communications, electronic warfare, and missile defense systems — following the acquisition by a foreign owner. This concern reflects the Committee's focus on the integrity of the defense industrial base and the potential for foreign ownership to disrupt, degrade, or deprioritize a U.S. company's defense-sector activities.

The concern is grounded in VPI's significant role in the DoD supply chain. VPI's top five government contracts, ranked by remaining backlog, total approximately $193 million:

CFIUS's concern encompasses two related risks: first, that foreign ownership could disrupt VPI's ability to fulfill its existing government contracts, either through interference with classified programs, loss of key personnel, or degradation of manufacturing capability; and second, that a foreign owner might make strategic decisions to deprioritize government work — which typically carries lower margins and higher compliance costs — in favor of more profitable commercial opportunities, gradually eroding VPI's defense-sector capabilities and its value as a defense supplier.

B. Assessment

This concern reflects broader U.S. government anxiety about the integrity of the defense industrial base, particularly in the semiconductor sector. The concern is well-founded in objective terms: VPI's Albuquerque fabrication facility is one of a very small number of U.S.-based facilities capable of producing GaN-on-SiC power amplifiers at the performance levels, reliability standards, and security classifications required for advanced defense applications. The limited number of domestic sources for these components — which are critical to current and next-generation radar, electronic warfare, satellite communications, and missile defense systems — means that any disruption to VPI's defense-sector operations could have cascading effects on multiple defense programs.

The concern also encompasses the risk of personnel attrition. VPI's most senior leaders — Dr. Nathan Trevorrow (CEO, TS/SCI), Marissa Sung-Avila (President & COO, SECRET), and Col. (Ret.) Bryce Hendrickson (VP Government Programs/FSO, TS/SCI) — possess deep institutional knowledge of VPI's classified programs, established relationships with DoD contracting officers and program managers, and familiarity with VPI's unique manufacturing processes. These individuals are, in a real sense, irreplaceable in the near term. Their departure following the closing of the transaction — whether due to dissatisfaction with new ownership, organizational changes, or competing employment opportunities — would pose a significant risk to VPI's ability to maintain its defense programs and its relationships with government customers.

From a regulatory perspective, the Federal Acquisition Regulation ("FAR") imposes specific requirements when a government contractor undergoes a change in ownership. Under FAR 42.12 (Novation and Change-of-Name Agreements), a contractor that is acquired by a successor in interest must execute a novation agreement with the applicable contracting officer, under which the successor assumes all rights and obligations of the predecessor contractor under the affected contracts. Per our Government Contracts Novation/Change-of-Name Analysis dated July 18, 2023, eight (8) of VPI's fourteen (14) active government contracts will require formal novation agreements. The novation process requires the contracting officer to determine that the successor is "responsible" — i.e., that the successor has the financial resources, technical capability, and organizational integrity to perform the contract. In practice, contracting officers in the defense sector

PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT THIS MEMORANDUM IS PROTECTED FROM DISCLOSURE BY THE ATTORNEY-CLIENT PRIVILEGE AND THE WORK PRODUCT DOCTRINE. IT IS INTENDED SOLELY FOR THE USE OF THE ADDRESSEES AND SHOULD NOT BE DISCLOSED TO ANY THIRD PARTY WITHOUT THE PRIOR WRITTEN CONSENT OF CALDERWOOD & HARKNESS LLP.
CALDERWOOD & HARKNESS LLP 1501 K Street, N.W., Suite 1200 Washington, D.C. 20005
INTERNAL MEMORANDUM
FROM: Margaret "Peggy" Ashworth, Of Counsel, National Security & CFIUS Lt. Col. (Ret.) David Caruso, Senior Counsel, Government Contracts & Export Controls
TO: Beatrice Holloway, Responsible Partner, Mergers & Acquisitions James Prentice, Billing Partner, Mergers & Acquisitions
CC: Priya Venkataraman, Associate, International Trade & Sanctions Kenneth Morales, Associate, Corporate/M&A Omar Siddiqui, Lead Associate, intellectual Property Christy Bauer, Working Associate, intellectual Property
DATE: October 23, 2023
RE: Assessment of CFIUS Preliminary National Security Concerns — Acquisition of Marlowe Asset Management Photonics Inc. by Halcyon Semiconductor AG; CFIUS Case No. CFIUS-023-07-3841
MATTER NO.: 1032-00004
Right-click to update Table of Contents
I. Executive Summary
On October 20, 2023, the Committee on Foreign Investment in the United States ("CFIUS" or the "Committee") communicated four preliminary national security concerns regarding the proposed acquisition of one hundred percent (100%) of the outstanding equity interests of Marlowe Asset Management Photonics Inc. ("VPI") by Halcyon Semiconductor Aktiengesellschaft ("HSAG"), to be effected through its wholly owned subsidiary, Halcyon US Holdings Inc. ("Halcyon Holdings"), a Delaware corporation. This communication was received during the 45-day investigation phase, which commenced on September 4, 2023, following the conclusion of the initial 45-day review period.
The four preliminary national security concerns identified by CFIUS are as follows:
1. Foreign Access to Classified Defense Programs: The risk that HSAG, as a German parent company with no U.S. security clearances, would have the ability to access, influence, or compromise VPI's classified defense programs.
2. Potential Transfer of ITAR/EAR-Controlled Technology to Non-U.S. Persons: The risk that VPI's defense articles controlled under the International Traffic in Arms Regulations ("ITAR") and dual-use technologies controlled under the Export Administration Regulations ("EAR") could be transferred, whether deliberately or inadvertently, to HSAG's non-U.S. personnel, subsidiaries, or affiliates — including HSAG's China subsidiary, Halcyon Semiconductor (Shanghai) Co., Ltd.
3. Cybersecurity Risks from Integration with HSAG IT Infrastructure: The risk that post-closing integration of VPI's information technology systems with HSAG's global IT infrastructure could create cybersecurity vulnerabilities, potentially exposing classified and controlled unclassified information ("CUI") to foreign intelligence services or unauthorized access.
4. Continuity of Critical DoD Supply Chain: The risk that foreign ownership could disrupt VPI's ability to serve as a reliable supplier of critical defense components — GaN power amplifier chips for defense radar, satellite communications, and missile defense systems — or lead to decisions that deprioritize government work in favor of commercial opportunities.
It is important to note that CFIUS's communication of preliminary concerns is a standard procedural step in the investigation phase, and it signals that the Committee is considering mitigation of the identified national security risks through a National Security Agreement ("NSA") rather than recommending a presidential block of the transaction under Section 721 of the Defense Production Act. We view this as a positive development. The communication of concerns, rather than an adverse finding or a request for withdrawal and refiling, indicates that the Committee believes the transaction can proceed subject to appropriate conditions.
This memorandum analyzes each of the four preliminary concerns in detail, assesses the factual basis and legal framework underlying each concern, and recommends specific responses and proposed mitigation measures. These recommendations are intended for discussion with the client — Stefan Lohse, HSAG General Counsel — and for potential incorporation into a draft NSA proposal that we would submit to CFIUS in our formal response.
Our overarching recommendation is that HSAG should proactively propose a comprehensive mitigation framework addressing all four concerns, positioning the parties for efficient NSA negotiation. Based on our analysis of twelve (12) recent semiconductor-sector NSA precedents from 2019 through 2023 — set forth in our Comparative NSA Precedent Analysis memo dated July 3, 2023 and updated September 15, 2023 — the concerns raised by CFIUS in this matter are typical of foreign acquisitions of U.S. defense-focused semiconductor companies, and all four are addressable through well-established mitigation mechanisms. A cooperative, proactive posture will expedite the process and increase the likelihood of achieving clearance on terms acceptable to HSAG.
II. Background and Procedural Context
A. Transaction Overview
HSAG is acquiring one hundred percent (100%) of the outstanding equity of VPI for a base purchase price of $1.42 billion, payable in cash, on a cash-free, debt-free basis with a normalized net working capital target of $34.6 million. The maximum aggregate consideration, including an earnout component, is $1.505 billion. The earnout comprises $85 million in two tranches: $50 million based on government-contract revenue milestones in calendar year 2024, and $35 million based on government-contract revenue milestones in calendar year 2025. The Stock Purchase Agreement ("SPA") was executed on June 10, 2023.
The acquisition is being effected through Halcyon US Holdings Inc. ("Halcyon Holdings"), a Delaware corporation formed on June 5, 2023, as a wholly owned direct subsidiary of HSAG. Halcyon Holdings was organized specifically as the acquisition vehicle for this transaction and has no independent operations, assets, or employees other than those incidental to serving as the acquiring entity.
The Buyer. HSAG is a German Aktiengesellschaft (stock corporation organized under German law), publicly traded on the Frankfurt Stock Exchange under the ticker symbol XETRA: HLC. As of the date of this memorandum, HSAG has an approximate market capitalization of €14.8 billion. For fiscal year 2022, HSAG reported consolidated revenue of €6.12 billion. HSAG is headquartered in Dresden, Saxony, Germany, and is a global leader in power semiconductor design and fabrication, with operations in twelve countries. HSAG's product portfolio includes power management integrated circuits, silicon carbide ("SiC") power modules, insulated-gate bipolar transistors ("IGBTs"), and analog semiconductor devices, serving the automotive, industrial, and consumer electronics markets. HSAG's existing U.S. operations consist of Halcyon US Inc., a fabless semiconductor design center located in Austin, Texas, with approximately 320 employees focused on analog and mixed-signal IC design for the commercial automotive market. Halcyon US Inc. does not perform any classified work, does not hold a Facility Security Clearance, and is not registered with the Directorate of Defense Trade Controls ("DDTC").
The Target. VPI is a Delaware C-corporation incorporated on February 14, 2009. VPI's principal executive offices are located at 7400 Ridgeline Parkway, Colorado Springs, Colorado 80919. VPI's primary manufacturing facility — a gallium-nitride on silicon-carbide ("GaN-on-SiC") fabrication facility — is located at 9200 Innovation Boulevard, Albuquerque, New Mexico 87113. The Albuquerque facility comprises approximately 45,000 square feet of fabrication, testing, and office space. The facility holds an active Facility Security Clearance ("FCL") at the SECRET level, issued by the Defense Counterintelligence and Security Agency ("DCSA"), under CAGE Code 7VK92.
VPI designs and manufactures advanced gallium-nitride power amplifier chips used in defense radar systems, satellite communications, electronic warfare applications, and 5G telecommunications infrastructure. VPI occupies a strategically significant position in the U.S. defense industrial base as one of a limited number of domestic manufacturers capable of producing high-performance GaN-on-SiC power amplifiers at the specifications required for advanced defense applications.
For fiscal year 2022, VPI reported revenue of $287.4 million and adjusted EBITDA of $61.2 million. VPI employs 486 individuals, of whom 212 (approximately 43.6%) hold active U.S. government security clearances at the SECRET, TOP SECRET, or TS/SCI levels. VPI holds 14 active contracts with the U.S. Department of Defense ("DoD"), both as a prime contractor and as a subcontractor, with aggregate contract backlog of approximately $193 million.
VPI's key government customers include: the U.S. Army Program Executive Office for intelligence, Electronic Warfare & Sensors ("PEO IEW&S"); the U.S. Air Force Research Laboratory ("AFRL"); the Missile Defense Agency ("MDA"); the U.S. Navy Naval Sea Systems Command ("NAVSEA"), via subcontract to Ironclad Defense Systems Inc.; and the Department of Homeland Security Science and Technology Directorate ("DHS S&T").
VPI's management team includes Dr. Nathan Trevorrow, Chief Executive Officer, who holds a TS/SCI clearance; Marissa Sung-Avila, President and Chief Operating Officer, who holds a SECRET clearance; and Col. (Ret.) Bryce Hendrickson, USAF, Vice President of Government Programs and Facility Security Officer, who holds a TS/SCI clearance.
B. CFIUS Filing History
Calderwood & Harkness LLP was engaged on June 12, 2023 to serve as counsel to HSAG for the CFIUS filing and mitigation aspects of the transaction. The following is a chronological summary of the CFIUS proceedings to date:
• June 19, 2023: Pre-filing consultation with the Treasury Department's Office of Investment Security ("OIS"). During this meeting, we presented the key elements of the proposed transaction, VPI's defense-sector activities, and HSAG's corporate profile. OIS indicated that the transaction would likely be subject to a full review given VPI's Facility Security Clearance and classified contract portfolio, and that DoD and DOE would likely serve as co-lead agencies.
• July 14, 2023: Joint voluntary notice filed by HSAG and VPI under 31 C.F.R. Part 800. The notice was prepared and submitted in accordance with 31 C.F.R. § 800.501 et seq. and included all required transaction documents, party information, and national security–related disclosures.
• July 21, 2023: CFIUS formally accepted the filing as complete, triggering the commencement of the initial 45-day review period under 50 U.S.C. § 4565(b)(1)(E).
• August 4, 2023: CFIUS issued its first Request for Information ("RFI"). The RFI comprised thirty-four (34) questions spanning multiple areas, including: HSAG's relationships with German and European Union government entities; HSAG's cybersecurity practices and certifications; VPI's and HSAG's technology transfer protocols; HSAG's exposure to the Chinese market, including a detailed description of HSAG's China subsidiary; HSAG's corporate governance structure and any foreign government influence or ownership; and VPI's classified programs and cleared personnel.
• August 18, 2023: We submitted HSAG's supplemental response to the first RFI, together with supporting exhibits including HSAG's ISO 27001 certification, enterprise cybersecurity framework documentation, a description of HSAG's China subsidiary operations, HSAG's corporate governance charter, and VPI's export compliance manual.
• September 4, 2023: The initial 45-day review period concluded. CFIUS determined that the review period was insufficient to complete its assessment and initiated the 45-day investigation phase under 50 U.S.C. § 4565(b)(2)(A). The notification confirming initiation of the investigation identified the Department of Defense and the Department of Energy as co-lead agencies, reflecting VPI's defense-sector activities and VPI's work with dual-use semiconductor technologies that implicate DOE equities related to advanced materials and energy applications.
• September 22, 2023: CFIUS issued its second RFI. This RFI comprised twenty-two (22) follow-up questions, principally drafted by representatives of DoD and DOE. The second RFI focused on: detailed VPI intellectual property transfer risks, including patent-by-patent analysis of government-funded inventions; VPI supply chain dependencies, with a request for a full bill-of-materials mapping and country-of-origin analysis for critical materials; HSAG's relationships with non-allied foreign governments, including detailed questions about HSAG's customer base in countries of concern; personnel continuity plans; and the proposed post-closing corporate governance structure.
• October 6, 2023: We submitted HSAG's supplemental response to the second RFI, together with extensive supporting exhibits including VPI's supply chain map (identifying all critical-path suppliers by country of origin), a detailed IP transfer risk analysis prepared by Omar Siddiqui and Christy Bauer, HSAG's customer lists segregated by country, and a preliminary post-closing governance proposal.
• October 20, 2023: CFIUS communicated its preliminary national security concerns to the parties. This is the communication that is the subject of the present memorandum.
C. Significance of Preliminary Concerns Communication
The communication of preliminary national security concerns is a discretionary step that CFIUS may take during the investigation phase. It is not required by statute or regulation, but it has become a routine practice in matters where the Committee identifies specific, articulable national security risks that it believes can be addressed through mitigation. The significance of this communication should be understood in context:
First, the communication of specific concerns — rather than an adverse recommendation to the President, a request for withdrawal and refiling, or silence — indicates that CFIUS has concluded that the transaction presents genuine national security issues but that those issues are amenable to resolution through a negotiated National Security Agreement. This is the procedural pathway that leads to transaction clearance in the substantial majority of cases involving foreign acquisitions of U.S. defense contractors.
Second, the four concerns identified by CFIUS align closely with the seven risk factors we identified in our CFIUS Risk Assessment & Mitigation Strategy Memo dated June 26, 2023, which was prepared at the outset of the engagement. Specifically, Concerns 1 through 4 correspond directly to Risk Factors 1, 2, 4, and 5 in that memo. The remaining three risk factors we identified — relating to supply chain dependencies on Chinese-origin materials (Risk Factor 3, now mitigated by VPI's allied-nation supply chain), VPI's role in national critical technology (Risk Factor 6), and HSAG's German government relationships (Risk Factor 7) — were not raised as separate concerns. This suggests that our proactive disclosures and mitigation proposals in the notice and RFI responses have effectively framed the discussion, and that CFIUS has narrowed its focus to the four issues that we anticipated would be most significant.
Third, based on our experience and precedent review, we expect CFIUS to circulate an initial draft NSA within approximately two weeks of the preliminary concerns communication, targeting early November 2023. The concerns communication effectively functions as CFIUS's opening position in the mitigation negotiation. By submitting a detailed, proactive response with specific proposed mitigation measures, we can influence the content of the initial draft NSA and accelerate the negotiation timeline.
III. Analysis of Concern No. 1: Foreign Access to Classified Defense Programs
A. Statement of the Concern
In its October 20, 2023 communication, CFIUS expressed concern that, following the closing of the transaction, HSAG — as a German parent company with no U.S. security clearances — would have the ability to access, influence, or compromise VPI's participation in classified defense programs. The Committee's concern encompasses several related dimensions: direct access by HSAG personnel to classified information or classified facilities; indirect influence over classified program decisions through HSAG's exercise of ownership and governance rights over VPI; and the potential for compromise of classified programs through the introduction of foreign ownership, control, or influence ("FOCI") into VPI's corporate structure.
This concern is grounded in the following key facts:
VPI holds an active Facility Security Clearance at the SECRET level, issued by DCSA, for its fabrication facility at 9200 Innovation Boulevard, Albuquerque, New Mexico 87113 (CAGE Code 7VK92). The FCL is a condition of VPI's ability to perform classified work under its government contracts and to receive, store, and process classified information at the facility.
Of VPI's 486 employees, 212 — representing 43.6% of the total workforce — hold active U.S. government security clearances. The clearance levels range from SECRET to TOP SECRET/SCI. Notably, VPI's CEO, Dr. Nathan Trevorrow, and its Vice President of Government Programs / Facility Security Officer, Col. (Ret.) Bryce Hendrickson, USAF, both hold TS/SCI clearances, which are required for their roles in overseeing VPI's most sensitive classified programs.
VPI holds 14 active contracts with the DoD, several of which involve classified work at the SECRET level or above. The key classified programs include:
• U.S. Army CERDEC (AN/TPS-80 Radar Program): VPI supplies GaN high-electron-mobility transistor ("HEMT") modules for the AN/TPS-80 multi-mission radar system. Remaining contract backlog: $52.3 million. This program involves classified technical specifications, performance parameters, and integration data.
• U.S. Air Force Research Laboratory (Next-Generation mmWave Power Amplifiers): VPI is developing next-generation millimeter-wave power amplifiers under an AFRL research contract. Remaining contract backlog: $41.7 million. This program involves classified performance objectives and potential applications in advanced radar and electronic warfare systems.
• Missile Defense Agency (GaN-Based T/R Modules): VPI fabricates GaN-based transmit/receive modules for missile defense radar applications. Remaining contract backlog: $38.9 million. This program involves classified system-level requirements and integration specifications.
In aggregate, VPI's classified program backlog exceeds $130 million, representing a substantial portion of VPI's overall $193 million government contract backlog. The classified nature of these programs means that any disruption to VPI's Facility Security Clearance — or any unauthorized access to classified information by uncleared foreign persons — could have serious national security consequences.
B. Assessment
This is the most significant of the four preliminary concerns and will serve as the primary driver of the governance and structural provisions in any National Security Agreement. The concern strikes at the core of the FOCI issue that arises in every foreign acquisition of a U.S. company holding a Facility Security Clearance and performing classified work.
Several factors contribute to the significance of this concern:
HSAG's Lack of U.S. Security Clearances. HSAG currently holds no U.S. security clearances at any level — neither entity-level Facility Security Clearances nor individual personnel security clearances for any HSAG officer, director, or employee. HSAG's existing U.S. operations through Halcyon US Inc. in Austin, Texas — a fabless design center with approximately 320 employees — are entirely focused on commercial semiconductor design and do not involve any classified work. Accordingly, HSAG has no existing FOCI mitigation framework and no existing relationship with DCSA's FOCI Branch.
HSAG Senior Management. Dr. Maximilian Ehrhardt, HSAG's Chief Executive Officer, is a German citizen residing in Dresden, Germany, who does not hold and is not eligible for a U.S. security clearance. Katarina Brückner, HSAG's Chief Financial Officer, is likewise a German citizen without U.S. clearance eligibility. Stefan Lohse, HSAG's General Counsel, is a German/U.S. dual citizen admitted to the bar of the State of New York, but he does not currently hold a U.S. security clearance. While Mr. Lohse's dual citizenship and U.S. bar admission may facilitate certain aspects of the mitigation process, he would need to obtain a clearance if he were to have any role in overseeing classified programs, which we do not recommend.
FOCI Implications. The proposed acquisition presents a paradigmatic FOCI scenario under the National Industrial Security Program Operating Manual ("NISPOM"), 32 C.F.R. Part 117. One hundred percent foreign ownership of a cleared contractor is the most intensive FOCI configuration and requires the most robust structural mitigation measures. Per our FOCI Analysis memo dated July 1, 2023, we assessed the full spectrum of FOCI mitigation instruments and concluded that a Special Security Agreement ("SSA") is the appropriate instrument for this transaction, given that VPI's classified work is at the SECRET level and that HSAG is a company from a closely allied nation (Germany is a NATO ally and a member of the "Five Eyes Plus" Intelligence-sharing framework for certain purposes).
One favorable factor in the FOCI analysis is that HSAG has no German government ownership or control. HSAG is a publicly traded company with a widely dispersed shareholder base; no single shareholder holds more than 8% of outstanding shares, and the German federal government and German state governments hold no equity interest. This eliminates the additional layer of concern that arises when a foreign government-controlled entity acquires a U.S. cleared contractor. Nevertheless, the 100% foreign private-sector ownership of VPI post-closing will require robust structural mitigation to satisfy DCSA and CFIUS.
C. Recommended Mitigation Proposals
Based on our analysis and our review of recent semiconductor-sector NSA precedents, we recommend proposing the following mitigation measures to address Concern No. 1:
1. Board Reconstitution. We propose reconstituting VPI's board of directors as a five-member board with the following composition:
(a) Three (3) "Security Board Members," each of whom must be a U.S. citizen holding or eligible for a security clearance at the TS/SCI level. At least one of the three Security Board Members must be an independent Security Director — i.e., an individual who is not affiliated with either HSAG or the legacy VPI shareholders, who has relevant national security and/or semiconductor industry experience, and who will serve as the chair of the Government Security Committee (described below). The remaining two Security Board Members may be drawn from VPI's existing management or board, provided they meet the citizenship and clearance requirements.
(b) Two (2) HSAG-designated directors, who may be officers or employees of HSAG or its affiliates. The HSAG designees may participate in board deliberations on commercial, financial, and strategic matters, but they may not hold or access classified information, may not participate in any deliberation or vote concerning classified programs or FOCI-related matters, and may not access classified facilities without prior approval from DCSA and the Government Security Committee.
Our Comparative NSA Precedent Analysis confirms that this 3-2 board composition — with three cleared Security Board Members and two foreign-parent designees — is the standard governance model in semiconductor-sector NSAs involving acquisitions of U.S. cleared contractors by allied-nation buyers. This structure was employed in at least eight of the twelve precedent transactions we analyzed.
2. Government Security Committee (GSC). We propose establishing a Government Security Committee composed solely of the three Security Board Members. The GSC would have exclusive authority over:
(a) All classified and ITAR-controlled programs, including decisions to bid on, accept, perform, modify, or terminate classified contracts;
(b) Personnel security decisions, including hiring, termination, and reassignment of cleared personnel, and the sponsorship of new security clearance applications;
(c) Facility security matters, including FCL maintenance, physical security measures at the Albuquerque facility, and compliance with NISPOM requirements;
(d) Oversight of the Technology Control Plan (discussed in Section IV.C below) and cybersecurity requirements (discussed in Section V.C below);
(e) Approval of any access by HSAG personnel to VPI facilities or information beyond what is expressly permitted under the NSA; and
(f) Communication and reporting to DCSA, CFIUS monitoring agencies, and the third-party compliance monitor.
The GSC would meet no less than quarterly and would have the authority to convene special sessions as needed. HSAG-designated directors would be excluded from all GSC deliberations. Minutes of GSC meetings would be maintained and made available to DCSA and the third-party compliance monitor upon request.
3. Facility Security Clearance Maintenance. We propose confirming in the NSA that VPI will retain its existing Facility Security Clearance at the SECRET level (CAGE Code 7VK92) following the closing of the transaction. To accomplish this, we recommend that the NSA be structured to function as the equivalent of a Special Security Agreement under NISPOM § 117.56(d), which DCSA has accepted in analogous transactions involving foreign acquisitions of U.S. cleared contractors by allied-nation buyers. Under this approach, the NSA itself — with its governance, access, and oversight provisions — would serve as VPI's FOCI mitigation instrument, and no separate FOCI mitigation plan would be required beyond the terms of the NSA. This approach streamlines the process and avoids duplicative compliance obligations.
We note that DCSA will need to be engaged directly regarding the FCL transition. David Caruso has an existing relationship with the DCSA FOCI Branch and recommends initiating informal outreach to DCSA's Industrial Security Field Office in Albuquerque promptly following our response to CFIUS.
4. Proposed Security Board Members. We recommend identifying the following candidates for the three Security Board Member positions:
(a) Col. (Ret.) Bryce Hendrickson, USAF — VPI's current Vice President of Government Programs and Facility Security Officer. Col. Hendrickson holds an active TS/SCI clearance, has served as VPI's FSO since 2015, and has deep institutional knowledge of all VPI classified programs. His continued presence on the board would ensure continuity and credibility with DCSA and DoD contracting officers.
(b) Adrienne Delacroix — VPI's current independent director. Ms. Delacroix has served on VPI's board since 2017, holds an active SECRET clearance, and has extensive experience in the defense electronics sector through prior executive roles at Camberwell Corporation and Halcyon Partners LLC. She is well-regarded by VPI's government customers.
(c) To-Be-Identified Independent Security Director — The third Security Board Member should be an individual not affiliated with either HSAG or legacy VPI stakeholders, with a TS/SCI clearance, relevant semiconductor industry experience, and ideally a background in senior U.S. government national security roles. We have begun identifying potential candidates and will present options to the client. The selection of this individual will require CFIUS and DCSA approval.
5. FSO Retention. We recommend confirming in the NSA that Col. (Ret.) Bryce Hendrickson will remain as VPI's Facility Security Officer following the closing of the transaction, maintaining continuity of security oversight. The FSO is the individual responsible for day-to-day compliance with NISPOM requirements, and DCSA places significant weight on FSO continuity in FOCI transitions. Col. Hendrickson's retention should be a non-negotiable commitment.
6. Facility Access Restrictions. We propose that the NSA include specific provisions prohibiting HSAG personnel — including HSAG-designated board members, officers, employees, agents, and contractors — from accessing VPI's classified facilities without prior written approval from both DCSA and the GSC. Specifically:
(a) Sections C-7 through C-12 of the Albuquerque fabrication facility — which house the classified clean rooms, testing labs, and secure storage for classified documents and materials — would be designated as restricted areas to which no HSAG personnel may have access under any circumstances without specific, advance written authorization from DCSA and the GSC.
(b) Unclassified areas at VPI's Colorado Springs headquarters and unclassified areas at the Albuquerque facility would be accessible to HSAG-designated board members and certain designated HSAG personnel for legitimate business purposes, subject to advance notice to the GSC (minimum 48 hours), escort by a VPI-designated employee at all times while on premises, and visitor logs maintained by the FSO.
These facility access restrictions are consistent with the standard approach in recent NSAs and should be acceptable to CFIUS.
IV. Analysis of Concern No. 2: Potential Transfer of ITAR/EAR-Controlled Technology to Non-U.S. Persons
A. Statement of the Concern
CFIUS raised concern regarding the risk that VPI's defense articles controlled under the ITAR and dual-use technologies controlled under the EAR could be transferred — whether deliberately or inadvertently — to HSAG's non-U.S. personnel, subsidiaries, or affiliates following the closing of the transaction. The Committee specifically identified the risk of technology diversion to HSAG's China subsidiary, Halcyon Semiconductor (Shanghai) Co., Ltd. ("Halcyon Shanghai"), as a particular sensitivity.
The factual basis for this concern is substantial. VPI's product portfolio includes items controlled under both the ITAR and the EAR:
ITAR-Controlled Items. Certain VPI products — specifically, advanced GaN power amplifier modules designed and fabricated to military specifications for defense radar, electronic warfare, and missile defense applications — are classified as defense articles under Category XI(a)(3) of the United States Munitions List ("USML"). VPI has been registered with DDTC since 2011 under Registration Number M-24817. VPI currently holds three (3) active DSP-5 (Permanent Export) licenses authorizing the export of specific defense articles to NATO allies, specifically the United Kingdom and Australia, in connection with collaborative defense programs.
EAR-Controlled Items. VPI's commercial and dual-use GaN power amplifier products are classified under Export Control Classification Numbers ("ECCNs") 3A001 (electronic components), 3A991 (electronic components not elsewhere specified), and 3E001 (technology for the development, production, or use of items in ECCN 3A001). These classifications subject VPI's products and underlying technology to export licensing requirements for most destinations, with particularly restrictive requirements for China, Russia, and other countries subject to comprehensive sanctions or heightened export controls.
intellectual Property. VPI's IP portfolio is extensive and includes forty-seven (47) issued U.S. patents and twelve (12) pending patent applications covering core technologies including GaN epitaxial growth processes, high-electron-mobility transistor (HEMT) device architectures, millimeter-wave power amplifier circuit designs, and reliability screening methodologies. Additionally, VPI maintains thirty-one (31) registered internal trade secrets, consisting primarily of proprietary GaN epitaxial recipes (specific material compositions, growth temperatures, layer structures, and doping profiles) and die-level reliability screening processes that represent VPI's critical competitive advantages and are among the most sensitive categories of VPI's intellectual property.
Significantly, twenty-three (23) of VPI's forty-seven issued patents were developed in whole or in part under U.S. government-funded contracts and are subject to the government's rights under the Bayh-Dole Act, including march-in rights under 35 U.S.C. § 203, as well as the rights reserved to the U.S. government under DFARS 252.227-7038 (Patent Rights — Ownership by the Contractor (Large Business)). While these government rights do not prevent VPI from commercializing these inventions, they impose restrictions on the disposition of the underlying intellectual property and could be exercised by the government if VPI were to fail to take effective steps to achieve practical application of the inventions or if action is necessary to alleviate health or safety needs or to meet requirements for public use.
B. Assessment
This concern was anticipated by our team and was a significant focus of both RFI responses submitted to CFIUS. In our first RFI response (filed August 18, 2023), we provided detailed information regarding HSAG's technology transfer protocols, including HSAG's internal export compliance program, technology access controls, and the organizational separation between HSAG's defense-adjacent operations and Halcyon Shanghai. In our second RFI response (filed October 6, 2023), we specifically addressed VPI IP transfer risks, including the patent-by-patent analysis of government-funded inventions and a detailed assessment of deemed export considerations.
The concern has two principal dimensions, each of which must be addressed through distinct mitigation mechanisms:
Deemed Exports. The first dimension relates to "deemed exports" — the transfer of controlled technology to foreign national persons within the United States. Under EAR § 734.2(b)(2) and ITAR § 120.54, the release of controlled technology to a foreign person, even within the United States, constitutes an export to the home country of that individual. Post-closing, HSAG's non-U.S. employees — including engineers, executives, and technical staff based in Germany, Japan, and other countries — may interact with VPI personnel in the ordinary course of business. Any release of ITAR-controlled technical data or EAR-controlled technology to these individuals without a valid export authorization would constitute a violation of applicable export control regulations. The risk of inadvertent deemed exports is heightened in the context of a corporate integration, where joint meetings, collaborative engineering discussions, shared databases, and personnel transfers could facilitate uncontrolled technology flows.
Actual Transfers. The second dimension relates to actual transfers of controlled technical data across HSAG's global network. Post-closing, HSAG may seek to integrate certain aspects of VPI's operations with its broader corporate infrastructure, creating channels through which controlled technical data could flow to HSAG's foreign subsidiaries and affiliates. The risk is compounded by the breadth of HSAG's global operations: HSAG maintains subsidiaries and affiliates in twelve countries, including Germany, Japan, South Korea, Singapore, Malaysia, Israel, and — most critically — China. While HSAG's China subsidiary, Halcyon Shanghai, generates only $81.4 million in annual revenue (approximately 1.3% of HSAG's total consolidated revenue) and engages solely in the design and testing of consumer-grade power management integrated circuits with no GaN or defense-related activities, CFIUS remains focused on the theoretical channel for technology diversion that Halcyon Shanghai represents. This focus is consistent with the Committee's well-documented scrutiny of any nexus between transaction parties and Chinese entities, regardless of the nature or scale of such entities' operations.
Per Christy Bauer's ITAR/EAR Classification Review dated September 8, 2023, six (6) items in VPI's product portfolio may require reclassification review following the closing of the transaction. This is because the change in ownership from a U.S.-owned company to a foreign-owned company may alter the end-use or end-user analysis that informs export classification determinations. Specifically, items that were previously classified as EAR99 (no license required for most destinations) may require classification under a more restrictive ECCN if the change in ownership introduces a new foreign principal or creates a new deemed export scenario. We recommend that the reclassification review be completed prior to closing to avoid any compliance gaps in the immediate post-closing period.
C. Recommended Mitigation Proposals
1. Technology Control Plan (TCP). We propose developing a comprehensive Technology Control Plan as a formal annex to the NSA. The TCP would establish binding obligations and procedures governing the handling, storage, access, and transfer of all ITAR- and EAR-controlled technical data within VPI, and would prohibit any transfer of such data to any non-U.S. person without prior U.S. government authorization (a DDTC license for ITAR-controlled defense articles and technical data, or a BIS license for EAR-controlled items and technology). The TCP should address:
(a) Physical documents and hardware, including classified and controlled unclassified documents, prototype hardware, test articles, and manufacturing tools;
(b) Electronic data, including CAD files, simulation models, fabrication process recipes, test data, and technical reports, whether stored on local servers, portable media, or cloud-based systems;
(c) Verbal disclosures, including discussions at meetings, conferences, telephone calls, and video conferences that involve controlled technical data; and
(d) Visual access, including tours of manufacturing facilities, observation of fabrication processes, and review of equipment configurations that could reveal controlled technology.
The TCP would be administered by VPI's Facility Security Officer under the oversight of the GSC and would be subject to annual review and audit by the third-party compliance monitor.
2. Data Segregation. We propose that VPI's IT systems be physically and logically separated from HSAG's global network at all times. This means:
(a) No shared cloud infrastructure — VPI may not use any cloud services, platforms, or storage that are shared with, managed by, or accessible to HSAG or any HSAG affiliate;
(b) No shared email systems — VPI personnel must use VPI-branded, VPI-administered email systems that are not connected to HSAG's Strathmore Data Systems or other enterprise email platform;
(c) No shared file servers, engineering databases, or product lifecycle management ("PLM") systems — VPI's engineering data must reside exclusively on servers physically located within the United States and accessible only to authorized VPI personnel; and
(d) No VPN tunnels, network bridges, or other electronic connections between VPI's network and HSAG's global network that could enable the transfer of data between the two environments.
This data segregation requirement reinforces the Technology Control Plan and provides an additional structural safeguard against unauthorized technology transfer.
3. Deemed Export Controls. We propose establishing internal protocols and training programs to ensure that no foreign national employee of HSAG or any HSAG affiliate is given access to VPI controlled technical data in any form — whether in documents, electronic files, verbal discussions, or visual observations — without a valid export authorization. These protocols would include:
(a) Pre-meeting review procedures for any interaction between VPI personnel and HSAG personnel (whether in person or virtual) to identify and segregate controlled technical data;
(b) Designated "export control officers" at both VPI and HSAG who are responsible for screening proposed interactions and confirming compliance;
(c) Mandatory annual training for all VPI employees on deemed export rules, covering ITAR and EAR requirements, with targeted training for VPI engineers and program managers who are most likely to interact with HSAG counterparts; and
(d) Corresponding training for HSAG personnel who may interact with VPI, emphasizing the restrictions on access to controlled technology and the consequences of violations.
4. DDTC and BIS Compliance Continuity. We propose confirming in the NSA and in our response to CFIUS that VPI will maintain its DDTC registration (Registration No. M-24817) following the closing of the transaction, with a change-of-ownership notification filed under ITAR § 122.4(a) within sixty (60) days of closing. We further propose addressing the need to amend VPI's three (3) active DSP-5 export licenses to reflect the change in VPI's ownership. Specifically, VPI will submit applications to DDTC to amend these licenses promptly following closing, and VPI will not conduct any exports under the existing licenses during the amendment period unless DDTC confirms in writing that such exports remain authorized pending amendment. VPI will also maintain all EAR compliance programs, including its internal classification procedures, license application protocols, and recordkeeping systems.
5. Firewall for China Operations. We propose including in the NSA an explicit, freestanding prohibition — going beyond the general export control compliance obligations described above — that specifically bars any sharing of VPI technical data, products, components, know-how, trade secrets, or other proprietary information with Halcyon Semiconductor (Shanghai) Co., Ltd. or any other HSAG entity located in, or substantially owned or controlled by persons or entities in, the People's Republic of China or any other country identified as a country of concern under the NSA. This provision would be a direct, contractual obligation binding on HSAG and all of its subsidiaries and affiliates worldwide, enforceable by CFIUS and subject to monitoring by the third-party compliance monitor. The inclusion of a specific, named prohibition regarding the China subsidiary — rather than relying solely on the general export control compliance framework — is consistent with the approach taken in recent semiconductor-sector NSAs and demonstrates HSAG's understanding of the sensitivity of the China nexus.
6. Trade Secret Protections. In addition to the export control measures described above, we propose enhanced internal controls specifically addressing VPI's thirty-one (31) registered trade secrets, which include the company's most competitively sensitive and strategically valuable technology — particularly the proprietary GaN epitaxial recipes and die-level reliability screening processes. These enhanced controls, as recommended in our Trade Secret Protection Assessment dated August 22, 2023, would include:
(a) Additional physical access restrictions for areas where trade secret materials are stored or used, including biometric access controls and surveillance systems;
(b) Need-to-know limitations restricting access to trade secret materials to specifically identified VPI employees whose job responsibilities require such access;
(c) Enhanced employee exit protocols, including comprehensive exit interviews, reminders of continuing confidentiality obligations, and device and document audits for departing employees who had access to trade secrets; and
(d) A trade secret registry maintained by VPI's General Counsel (or equivalent officer) documenting each registered trade secret, the individuals authorized to access it, and the date, purpose, and outcome of each access event.
V. Analysis of Concern No. 3: Cybersecurity Risks from Integration with HSAG IT Infrastructure
A. Statement of the Concern
CFIUS expressed concern that post-closing integration of VPI's information technology systems with HSAG's global IT infrastructure could create cybersecurity vulnerabilities that might expose classified information, controlled unclassified information, and proprietary technical data to foreign intelligence services, unauthorized third parties, or other threat actors. The Committee's concern reflects a broader emphasis on cybersecurity that has become a standard feature of CFIUS reviews involving defense contractors and companies handling sensitive technologies.
This concern was initially flagged during the first RFI (August 4, 2023), when CFIUS requested detailed information regarding HSAG's cybersecurity practices, certifications, and enterprise IT architecture. In our first RFI supplemental response (August 18, 2023), we provided HSAG's ISO 27001:2022 certification, a description of HSAG's enterprise cybersecurity framework (including its Security Operations Center in Dresden), and a summary of HSAG's recent cybersecurity audit results. Despite these disclosures, the Committee has identified cybersecurity as a standalone concern in its preliminary communication, indicating that the information provided to date has not fully resolved the issue.
The concern is amplified by VPI's defense-focused business profile. As a cleared defense contractor performing classified work and handling CUI, VPI is subject to stringent cybersecurity requirements under DFARS 252.204-7012 ("Safeguarding Covered Defense Information and Cyber Incident Reporting"), which requires contractors to implement the security controls specified in NIST Special Publication 800-171 ("Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations"). VPI's compliance with these requirements is a contractual obligation under its DoD contracts and is essential to its ability to receive and handle CUI.
B. Assessment
VPI currently maintains its own standalone IT infrastructure, which is independent of any external corporate network. This infrastructure includes:
(a) A secure, classified network at the Albuquerque fabrication facility, which is air-gapped — meaning it is physically disconnected from the internet and from any other network. The classified network is used for processing, storing, and transmitting classified information related to VPI's classified defense programs. This network is already fully compliant with NISPOM requirements and is inspected regularly by DCSA.
(b) An unclassified-but-controlled network, also centered at the Albuquerque facility, which handles CUI, ITAR-controlled technical data, EAR-controlled technology, and proprietary trade secrets. This network is connected to the internet through a protected perimeter and is subject to VPI's NIST SP 800-171 compliance framework.
(c) A general-purpose corporate network at VPI's Colorado Springs headquarters, which handles routine business functions such as human resources, accounting, marketing, and general correspondence.
The cybersecurity risk identified by CFIUS relates primarily to VPI's unclassified-but-controlled network and the sensitive information it contains. The classified network, being air-gapped, is inherently protected from the risks associated with integration with HSAG's corporate infrastructure. However, the unclassified-but-controlled network — which handles CUI, ITAR/EAR technical data, and proprietary trade secrets — would be exposed to significant risk if it were connected to or integrated with HSAG's global IT infrastructure. The potential attack vectors include:
• Lateral movement by threat actors who compromise HSAG's network and use the connection to VPI's network as an access point;
• Data exfiltration by authorized HSAG users who intentionally or inadvertently access VPI data through shared systems;
• Insider threats from HSAG IT administrators who may have access to VPI systems in a shared IT environment; and
• Supply chain attacks targeting shared software, cloud services, or third-party IT vendors that serve both HSAG and VPI.
Regarding HSAG's existing cybersecurity posture: HSAG holds ISO 27001:2022 certification for its enterprise IT systems, which is a recognized international standard for information security management. However, ISO 27001 certification does not meet the U.S. government's NIST SP 800-171 requirements that apply to defense contractors handling CUI. The two frameworks have different scopes, controls, and assessment methodologies. NIST SP 800-171 includes 110 specific security requirements organized into 14 families, many of which address U.S. government-specific concerns (such as CUI marking, controlled access to government data, and incident reporting to DoD) that are not covered by ISO 27001. Accordingly, even though HSAG maintains a robust cybersecurity program by commercial standards, its existing framework is not sufficient to meet the requirements that apply to VPI's defense-related systems.
Our review of recent semiconductor-sector NSAs confirms that cybersecurity has become a standard and significant component of mitigation agreements. All twelve precedent NSAs we analyzed included cybersecurity provisions, with the level of specificity and rigor increasing markedly in NSAs executed after 2021. The baseline standard in recent NSAs is NIST SP 800-171 compliance, with several NSAs also requiring alignment with the Cybersecurity Maturity Model Certification ("CMMC") framework — specifically CMMC Level 2, which corresponds to the 110 practices in NIST SP 800-171.
C. Recommended Mitigation Proposals
1. IT System Separation. We propose that VPI's IT systems — including all three network tiers (classified, unclassified-but-controlled, and general corporate) — remain physically and logically separated from HSAG's global network at all times. This separation would be absolute and without exception for the classified and unclassified-but-controlled networks. Specifically:
(a) No shared cloud infrastructure — VPI may not use any cloud computing, storage, or software-as-a-service platforms that are shared with, hosted by, or accessible to HSAG or any HSAG affiliate;
(b) No VPN tunnels, leased lines, or other network connections between VPI's networks and HSAG's networks;
(c) No common identity management, single sign-on, or directory services (e.g., shared Active Directory or Azure AD tenants);
(d) No shared IT management tools, monitoring platforms, or helpdesk systems; and
(e) Separate IT staff — VPI's IT infrastructure must be managed by VPI employees or U.S.-based contractors who have been vetted and approved by the GSC, not by HSAG's global IT organization.
2. NIST SP 800-171 Compliance. We propose that VPI maintain full compliance with NIST SP 800-171 for all information systems that process, store, or transmit CUI. This commitment would include:
(a) Annual self-assessments of VPI's NIST SP 800-171 compliance, with results documented in a System Security Plan ("SSP") and a Plan of Action and Milestones ("POA&M") for any identified gaps;
(b) Triennial third-party assessments conducted by a qualified cybersecurity firm, with results reported to DCSA and the third-party compliance monitor; and
(c) A proactive commitment to obtain Cybersecurity Maturity Model Certification ("CMMC") at Level 2 when the CMMC certification framework becomes operational, demonstrating VPI's readiness to meet evolving DoD cybersecurity requirements. Given the current trajectory of the CMMC rulemaking process, we anticipate that CMMC certification requirements will begin appearing in DoD solicitations in 2025, making early compliance advantageous for VPI's competitive position.
3. Annual Penetration Testing. We propose that VPI undergo annual penetration testing of its IT systems — including both external and internal penetration tests — conducted by a qualified, independent cybersecurity firm. The penetration testing firm would be selected from a list approved by the GSC and DCSA. The scope of testing would cover VPI's unclassified-but-controlled network and general corporate network (the classified network would be excluded from external penetration testing due to its air-gapped configuration, but internal security assessments of the classified network would be conducted under DCSA oversight). Penetration test reports, including identified vulnerabilities and remediation plans, would be provided to DCSA and the third-party compliance monitor within thirty (30) days of completion.
4. Incident Reporting. We propose a mandatory incident reporting obligation requiring VPI to notify DCSA within seventy-two (72) hours of discovering any cybersecurity incident affecting VPI's information systems, whether classified or unclassified. This obligation would apply to any incident involving:
(a) Unauthorized access to VPI systems or data;
(b) Loss, theft, or compromise of CUI, ITAR-controlled technical data, or trade secrets;
(c) Malware infections, ransomware attacks, or denial-of-service events;
(d) Any incident that triggers a DFARS 252.204-7012 reporting obligation; or
(e) Any incident that, in the judgment of VPI's Facility Security Officer or Chief Information Security Officer, could have implications for national security or the integrity of VPI's defense programs.
The 72-hour reporting timeline aligns with the existing requirements under DFARS 252.204-7012 and is consistent with the incident reporting obligations in recent NSA precedents. Reports would be provided concurrently to DCSA, the CFIUS monitoring agencies (Treasury, DoD, and DOE), and the third-party compliance monitor.
5. Cybersecurity Requirements Annex. We propose developing a detailed Cybersecurity Requirements annex to the NSA that consolidates all cybersecurity-related obligations into a single, comprehensive document. The annex would address:
(a) Technical security controls aligned with NIST SP 800-171;
(b) IT system separation requirements;
(c) Access controls and authentication requirements;
(d) Data encryption standards (at rest and in transit);
(e) Incident response and reporting procedures;
(f) Penetration testing and vulnerability management;
(g) Personnel security requirements for IT staff;
(h) Physical security for IT infrastructure; and
(i) Annual review and update procedures.
The Cybersecurity Requirements annex would be reviewed and updated annually by the GSC and the third-party compliance monitor, with updates reported to DCSA and CFIUS monitoring agencies.
6. HSAG Access Controls for Limited Business Information Sharing. We recognize that, as the parent company of VPI post-closing, HSAG will have legitimate needs to receive certain categories of VPI information for business purposes — principally financial reporting data required for HSAG's consolidated financial statements under IFRS, tax compliance data, and high-level business performance metrics. We propose that any such information sharing occur exclusively through a defined, secure data exchange mechanism with the following safeguards:
(a) Encrypted transmission channels using AES-256 encryption or equivalent;
(b) Restricted data categories — only financial and business data, with no technical data, engineering data, classified information, CUI, ITAR/EAR-controlled technology, or trade secrets;
(c) Pre-defined, limited data fields approved by the GSC;
(d) Comprehensive audit logging of all data exchanges, with logs retained for a minimum of five (5) years and available for review by the third-party compliance monitor; and
(e) Annual review of the data exchange mechanism by the GSC and the third-party compliance monitor to confirm that it continues to meet security requirements and that no unauthorized data categories are being shared.
VI. Analysis of Concern No. 4: Continuity of Critical DoD Supply Chain
A. Statement of the Concern
CFIUS raised concern about the continuity and reliability of VPI as a supplier of critical defense components — specifically, GaN power amplifier chips for defense radar, satellite communications, electronic warfare, and missile defense systems — following the acquisition by a foreign owner. This concern reflects the Committee's focus on the integrity of the defense industrial base and the potential for foreign ownership to disrupt, degrade, or deprioritize a U.S. company's defense-sector activities.
The concern is grounded in VPI's significant role in the DoD supply chain. VPI's top five government contracts, ranked by remaining backlog, total approximately $193 million:
CFIUS's concern encompasses two related risks: first, that foreign ownership could disrupt VPI's ability to fulfill its existing government contracts, either through interference with classified programs, loss of key personnel, or degradation of manufacturing capability; and second, that a foreign owner might make strategic decisions to deprioritize government work — which typically carries lower margins and higher compliance costs — in favor of more profitable commercial opportunities, gradually eroding VPI's defense-sector capabilities and its value as a defense supplier.
B. Assessment
This concern reflects broader U.S. government anxiety about the integrity of the defense industrial base, particularly in the semiconductor sector. The concern is well-founded in objective terms: VPI's Albuquerque fabrication facility is one of a very small number of U.S.-based facilities capable of producing GaN-on-SiC power amplifiers at the performance levels, reliability standards, and security classifications required for advanced defense applications. The limited number of domestic sources for these components — which are critical to current and next-generation radar, electronic warfare, satellite communications, and missile defense systems — means that any disruption to VPI's defense-sector operations could have cascading effects on multiple defense programs.
The concern also encompasses the risk of personnel attrition. VPI's most senior leaders — Dr. Nathan Trevorrow (CEO, TS/SCI), Marissa Sung-Avila (President & COO, SECRET), and Col. (Ret.) Bryce Hendrickson (VP Government Programs/FSO, TS/SCI) — possess deep institutional knowledge of VPI's classified programs, established relationships with DoD contracting officers and program managers, and familiarity with VPI's unique manufacturing processes. These individuals are, in a real sense, irreplaceable in the near term. Their departure following the closing of the transaction — whether due to dissatisfaction with new ownership, organizational changes, or competing employment opportunities — would pose a significant risk to VPI's ability to maintain its defense programs and its relationships with government customers.
From a regulatory perspective, the Federal Acquisition Regulation ("FAR") imposes specific requirements when a government contractor undergoes a change in ownership. Under FAR 42.12 (Novation and Change-of-Name Agreements), a contractor that is acquired by a successor in interest must execute a novation agreement with the applicable contracting officer, under which the successor assumes all rights and obligations of the predecessor contractor under the affected contracts. Per our Government Contracts Novation/Change-of-Name Analysis dated July 18, 2023, eight (8) of VPI's fourteen (14) active government contracts will require formal novation agreements. The novation process requires the contracting officer to determine that the successor is "responsible" — i.e., that the successor has the financial resources, technical capability, and organizational integrity to perform the contract. In practice, contracting officers in the defense sector

INTERNAL MEMORANDUM

MATTER NO.: 1032-00004

Record

Parties

Dates

Amounts