MANAGING FACILITY CLEARANCES AND CHANGES OF CONTROL Mary Beth Bosco Patton Boggs LLP 2550 M Street, N.W. Washington, D.C

What is a Change of Control? The NISPOM states the following events must be reported to DSS: Any change of ownership, including stock transfers that affect control of the company. Any change of operating name or address of the company or any of its cleared locations. Any change to the information previously submitted for key management personnel including, as appropriate, the names of the individuals they are replacing. Action to terminate business or operations for any reason, imminent adjudication or reorganization in bankruptcy, or any change that might affect the validity of the FCL. Any material change concerning the information previously reported by the contractor concerning foreign ownership, control or influence (FOCI).

What are the Practical Considerations? Is there a deadline for the notice? No, but it should occur as soon as you are reasonably certain the change will occur. (We will cover the FOCI notice separately.) What must the notice say? There is no standard format, but it should provide the essential information. For example, in the case of an acquisition, provide the names and CAGE Codes of the involved companies. Introduce DSS to the new company, describe whether it does business with the government, and advise DSS if the new company is cleared. What are the considerations if we consolidate facilities after an acquisition or merger? You may need to get a new CAGE Code for the facility, or may be able to continue to use your old one, depending on the nature of the change.

What happens if a new owner wants board seats? DSS will need a new Key Management Personnel List, and will need information about the citizenship of the new Board members. If the new Board member does not have a clearance, you may need to prepare an Exclusionary Board Resolution. What happens if my company does not have a clearance and wants to acquire a cleared company, or if a company without a clearance wants to acquire my company and we have a clearance? You may need to prepare Board resolutions excluding the non- cleared company from access to classified information. Who gets notified? Your CSA, and the CSA of the acquiring company, if applicable.

The NISPOM states: “A U.S. company is considered under FOCI whenever a foreign interest has the power, direct or indirect, whether or not exercised, and whether or not exercisable through the ownership of the U.S. company's securities, by contractual arrangements or other means, to direct or decide matters affecting the management or operations of that company in a manner which may result in unauthorized access to classified information or may adversely affect the performance of classified contracts.” NISPOM Section 3, a. Under the NISPOM, FOCI may arise through ownership: “The source, nature and extent of FOCI, including whether foreign interests hold a majority or substantial minority position in the company, taking into consideration the immediate, intermediate, and ultimate parent companies. A minority position is deemed substantial if it consists of greater than 5 percent of the ownership interests or greater than 10 percent of the voting interest.” NISPOM Section 3, d. What is FOCI?

FOCI also includes “control” and “influence.” In order to determine whether a foreign entity controls or influences a cleared company to the extent of risking unauthorized access to classified information, DSS requires companies to fill out Standard Form 328, Certificate Pertaining to Foreign Interests. The SF 328 questions are: 1.a. (For entities which issue stock): Do any foreign person(s), directly or indirectly, own or have beneficial ownership of 5 percent or more of the outstanding shares of any class of your organization's equity securities? 1.b. (For entities which do not issue stock): Has any foreign person directly or indirectly subscribed 5 percent or more of your organization's total capital commitment? 2. Does your organization directly, or indirectly through your subsidiaries and/or affiliates, own 10 percent or more of any foreign interest? 3. Do any non-U.S. citizens serve as members of your organization's board of directors (or similar governing body), officers, executive personnel, general partners, regents, trustees or senior management officials?

4. Does any foreign person(s) have the power, direct or indirect, to control the election, appointment, or tenure of members of your organization's board of directors (or similar governing body) or other management positions of your organization, or have the power to control or cause the direction of other decisions or activities of your organization? 5. Does your organization have any contracts, agreements, understandings, or arrangements with a foreign person(s)? 6. Does your organization, whether as borrower, surety, guarantor or otherwise have any indebtedness, liabilities or obligations to a foreign person(s)? 7. During your last fiscal year, did your organization derive: a. 5 percent or more of its total revenues or net income from any single foreign person? or b. In the aggregate 30 percent or more of its revenues or net income from foreign persons? 8. Is 10 percent or more of any class of your organization's voting securities held in "nominee" shares, in "street names" or in some other method which does not identify the beneficial owner? 9. Do any of the members of your organization's board of directors (or similar governing body), officers, executive personnel, general partners, regents, trustees or senior management officials hold any positions with, or serve as consultants for, any foreign person(s)? 10. Is there any other factor(s) that indicates or demonstrates a capability on the part of foreign persons to control or influence the operations or management of your organization?

A company must complete the SF 328 as part of the clearance application process, and it must complete a revised SF 328 when there is a change in control. Importantly, a cleared company must notice DSS in advance when it contemplates a change in control that will involve FOCI: NISPOM d states: “When a contractor with an FCL enters into negotiations for the proposed merger, acquisition, or takeover by a foreign interest, the contractor shall submit notification to the CSA of the commencement of such negotiations. The submission shall include the type of transaction under negotiation (stock purchase, asset purchase, etc.), the identity of the potential foreign interest investor, and a plan to negate the FOCI by a method outlined in The company shall submit copies of loan, purchase and shareholder agreements, annual reports, bylaws, articles of incorporation, partnership agreements, and reports filed with other Federal agencies to the CSA.”

What Happens if FOCI is Present? A U.S. company determined to be under FOCI is ineligible for an FCL unless and until security measures have been put in place to negate or mitigate FOCI. When a contractor determined to be under FOCI is negotiating an acceptable FOCI mitigation/negation measure, an existing FCL shall continue so long as there is no indication that classified information is at risk of compromise.

What are the Mitigation Measures? The mitigation measures increase in scope with the extent and nature of the FOCI. In instances in which there is no foreign ownership, the mitigation measures may be limited to exclusionary board resolutions. NISPOM c provides: “When factors not related to ownership are present, positive measures shall assure that the foreign interest can be effectively mitigated and cannot otherwise adversely affect performance on classified contracts. Examples of such measures include modification or termination of loan agreements, contracts and other understandings with foreign interests; diversification or reduction of foreign-source income; demonstration of financial viability independent of foreign interests; elimination or resolution of problem debt; assignment of specific oversight duties and responsibilities to board members; formulation of special executive-level security committees to consider and oversee matters that affect the performance of classified contracts; physical or organizational separation of the contractor component performing on classified contracts; the appointment of a technology control officer; adoption of special Board Resolutions; and other actions that negate or mitigate foreign influence.”

Where foreign ownership is present, board resolutions may not be enough: NISPOM a: “When a foreign interest does not own voting interests sufficient to elect, or otherwise is not entitled to representation on the company's governing board, a resolution(s) by the governing board shall normally be adequate.” When the foreign owner can name board members, DSS may require a Voting Proxy Agreement, a Security Control Agreement, or a Special Security Agreement.

Examples