CFIUS and Network Security Agreements 1

CFIUS and Network Security Agreements 1 Mark E. Plotkin 2 David M. Marchick 3 David N. Fagan 4 This memorandum provides an overview of the principal U.S. government national security considerations and requirements affecting the regulatory review by the Committee on Foreign Investment in the United States of foreign investments in U.S. companies. Background In 1988, Congress enacted the so-called Exon-Florio amendment to Section 721 of the Defense Production Act of 1950 (hereinafter Exon-Florio ). 5 Exon-Florio authorizes the President to investigate foreign acquisitions of U.S. companies from a national security 1 This memorandum has been prepared for the symposium on Foreign Direct Investment in U.S. Critical Infrastructure that Covington & Burling is co-sponsoring with the Organization for International Investment and the Critical Infrastructure Protection Project, George Mason University. 2 Tel. 202-662-5656 (MPlotkin@cov.com). Mark Plotkin is a partner with Covington & Burling, and oversees the firm s Security practice and Technology and Software Group. 3 Tel. 202-662-5527 (DMarchick@cov.com). David Marchick is counsel to Covington & Burling, and is a member of the firm s International Trade practice. 4 Tel. 202-662-5291 (DFagan@cov.com). David Fagan is an associate with Covington & Burling who divides his practice among Security, Technology and Software, and International Trade. 5 Omnibus Trade and Competitiveness Act of 1988 5021, Pub. L. No. 100-418, 102 Stat. 1107 (codified at 50 U.S.C. App. 2170). The original authorization was scheduled to expire in 1991, but was made permanent by Section 8 of the Defense Production Act Extension and Amendments of 1991. Pub. L. No. 102-99, 105 Stat. 487. DC: 1261004-2

perspective and to act, if necessary, to prohibit a transaction that appears to threaten the national security when other laws, with the exception of the International Emergency Economic Powers Act ( IEEPA ), 6 are otherwise inadequate to mitigate the threat associated with the investment. That same year, the President delegated 7 certain of these responsibilities to the Committee on Foreign Investment in the United States, or CFIUS, which had been established by Executive Order in 1975. 8 CFIUS is chaired by the Secretary of the Treasury and has eleven other members: the Secretaries of State, Defense, and Commerce, the Attorney General, the Director of the Office of Management and Budget, the U.S. Trade Representative, the Chairman of the Council of Economic Advisers, the Director of the Office of Science and Technology Policy, the Assistant to the President for National Security Affairs, the Assistant to the President for Economic Policy, and the newest member, the Department of Homeland Security. In practice, these principals generally delegate their decision-making responsibility as members of CFIUS to their deputies. Most Exon-Florio reviews are handled routinely at a staff level. Controversial transactions, particularly those that require a Presidential decision, are traditionally handled at the Deputy Secretary level. When undertaking an Exon-Florio review, CFIUS agencies try to balance national security concerns with the United States longstanding policy in favor of inward direct investment. Certain of the CFIUS agencies have as their mandate law enforcement, defense and homeland security, while other agencies are oriented to promoting an open trade and investment 6 50 U.S.C. 1701-1706. 7 Executive Order 12661 (1988). 8 Executive Order 11858 (1975). CFIUS originally was established primarily to monitor and evaluate the impact of foreign investment in the United States. - 2 -

policy. This tension among the member agencies is purposeful and is designed to elicit carefully considered judgments that take into account a myriad of economic and security considerations. At the same time, the process itself which is conducted in confidence without public disclosure can be lengthy, complex and quite opaque to private parties awaiting the interagency committee s decision. The CFIUS Review Process Exon-Florio authorizes CFIUS to initiate its investigation either upon a voluntary filing by either party to the transaction or upon an agency notice filed by one of the members of CFIUS. A filing by the parties to the transaction or an agency member can be submitted before or after the consummation of a transaction. A compelling reason for a party to file voluntary prior to consummation of the transaction is to avert a post-closing CFIUS investigation of the transaction. If the parties do not file voluntarily, the transaction is subject to potential review at any time. The authority of CFIUS is not time barred, nor is there a statute of limitations. When the parties decide to file written notice of an acquisition, merger or takeover of a U.S. corporation by a foreign entity, Exon-Florio provides for the President or his designee to receive the notice. The Department of Treasury, acting at the staff level through the Director of the Office of International Investment in the Office of the Assistant Secretary of International Affairs, receives and circulates notices to CFIUS agencies and coordinates - 3 -

reviews, 9 which are conducted on a case-by-case basis pursuant to the following statutorily mandated process: Initial 30-day review following receipt of notice; 45-day investigation period for transactions requiring additional review following the initial 30-day period; Formal report to the President at the end of the 45-day investigation period; Presidential decision within 15 days of receiving the formal report. In practice, almost all transactions requiring Exon-Florio review are informally vetted with the CFIUS agencies before a formal notice is filed. As a result, it is rare for a CFIUS review to extend into the investigation period, and it is even more unusual for the President to be required to render a final decision. Importantly, only the President has the authority to block a transaction. The only authority delegated to CFIUS is the authority not to pursue an investigation, the functional equivalent of approval by CFIUS. If it is clear that the President will disapprove of a transaction, it is common for parties to withdraw the notice rather than receive a formal disapproval from the U.S. government. Formal Considerations of the CFIUS Process Under the Exon-Florio amendment and regulations, CFIUS agencies are required to consider a number of factors, principles and policies in their review. These include: domestic production needed for projected national defense requirements; 9 Notice can be provided by email to the Office of International Investment at the Department of Treasury. In fact, the Treasury Department prefers email notice, as opposed to hard copy notice, because it facilitates communications with other CFIUS agencies. - 4 -

the capability and capacity of domestic industries to meet national defense requirements, including the availability of human resources, products, technology, materials, and other supplies and services; the control of domestic industries and commercial activity by foreign citizens as it affects the capability and capacity of the U.S. to meet the requirements of national security; the potential effects of the transaction on the sales of military goods, equipment, or technology to a country that supports terrorism or proliferates missile technology or chemical and biological weapons; and the potential effects of the transaction on U.S. technological leadership in areas affecting U.S. national security. In addition to these considerations mandated by the statute and regulations, a number of important ambiguities in the statute could provide a trap for the unwary. First, while the sole purpose for CFIUS is to determine whether a particular transaction could threaten the United States national security, the statute does not define the term national security. Rather, the judgment as to whether a transaction threatens national security rests within the President s discretion. According to the legislative history of Exon-Florio, the term national security is to be interpreted broadly and without limitation to particular industries. Accordingly, in addition to defense industry transactions, Exon-Florio intentionally reaches transactions in other large industry sectors, including technology, telecommunications, energy, financial services and transportation. Second, potential investors in U.S. companies should note the considerable breadth of an important term foreign control that is defined in the statute and clarified in the - 5 -

regulations. Foreign control means the power, direct or indirect, whether or not exercised, and whether or not exercised or exercisable through the ownership of a majority or a dominant minority of the total outstanding voting securities of an issuer, or by proxy voting, contractual arrangements, or other means, to determine, direct, or decide matters affecting an entity. In the current security environment, the breadth of this definition enables CFIUS to sweep in to its review transactions that, as a practical matter, give the foreign acquirer very little actual control and that, before the terrorist attacks of September 11, 2001, ordinarily would not have come under CFIUS scrutiny. For example, the regulations create a rebuttable presumption of control if a foreign person acquires ten percent of the equity of a U.S. company. However, CFIUS has in the past, and could in the future, determine that a foreign person controls a U.S. entity regardless of the foreign person s actual ownership percentage where the foreign person s rights include, for example, seats on the board of directors, veto rights over certain corporate actions and/or the right to reject certain key personnel. CFIUS Review of Telecommunications Transactions in the Near Term Covington & Burling s recent experience with CFIUS as counsel to Global Crossing and Pacific Telecom makes clear that, since September 11, 2001, the weight assigned by CFIUS to national security concerns has increased considerably. It is with this background that we offer the following observations on the CFIUS process in a post-september 11 environment. These observations derive from transactions principally in the telecommunications sector, and therefore are discussed in the context of such transactions. However, we believe these considerations also apply more broadly to future CFIUS review of foreign investments in other areas of critical infrastructure, including, but not limited to, investments in the energy, transportation, biotechnology, technology and financial services sectors. - 6 -

CFIUS s review of a potential foreign investment in a U.S. telecommunications company generally can be expected to focus on three related national security concerns: ensuring U.S. law enforcement access to the domestic portion of the communications infrastructure (i.e., the U.S. network and supporting facilities) and any data stored or transiting thereon; ensuring that most or all control over the U.S. portion of the communications infrastructure remains largely or entirely within the territorial borders of the U.S. and, to a certain extent, in the hands of U.S. citizens; and ensuring that most or all control over the communications infrastructure and U.S. customer data remains largely or entirely within the territorial borders of the U.S. and in the hands of U.S. citizens. To satisfy the concerns outlined above, the national security agencies within CFIUS (i.e., the Departments of Defense, Homeland Security and Justice) will require the parties engaged in the transaction to enter into a network security agreement ( NSA ). The NSA typically applies to any subsidiary, division, department, branch or other component of the U.S. telecommunications network receiving the foreign investment that provides communications between locations in the U.S. or originating or terminating in the U.S. The breadth and depth of an NSA will depend on the security risk associated with the transaction. The security risk will, in turn, depend on a number of factors including: (i) the importance of the acquisition from a national security and/or critical infrastructure perspective; (ii) the strategic relationship (or lack thereof) between the United States and the host government of the investor; and (iii) whether the acquiree performs any classified or otherwise sensitive work for the U.S. government, particularly with respect to U.S. defense, law enforcement and national security agencies. - 7 -

NSAs have included provisions requiring that: all domestic communications infrastructure of the U.S. carrier be located largely or exclusively in the U.S.; transactional and call associated data relating to domestic communications be stored largely or exclusively in the U.S.; subscriber information and billing records of U.S. customers or customers who make a domestic communication be stored largely or exclusively in the U.S.; outsourcing functions covered by the NSA to non-u.s. entities be restricted or prohibited, unless such outsourcing occurs pursuant to an agreement with the Department of Homeland Security; the acquiree guarantee on a strict liability basis that any third-party contractor performing a function covered by the NSA will comply with its terms; and the acquiree guarantee U.S. government access to inspect U.S.-based facilities and to interview U.S.-based personnel on very short notice. The national security agencies also may require that a range of redundant security measures be included in the NSA. For example, CFIUS has begun to require that the U.S. entity receiving the foreign investment (i) implement strict visitation policies for critical U.S. infrastructure assets and more stringent information security plans to protect network assets and data; (ii) assure that only U.S. citizens serve in sensitive positions and to conduct screening of such personnel; (iii) retain a third-party auditor to conduct periodic audits of compliance with the NSA; and (iv) appoint U.S. government-approved security directors to the Board of the U.S. entity. There may be some latitude to negotiate certain of these additional security measures depending upon the size and nature of the particular proposed transaction. The Future of Transactions Under Exon-Florio In reviewing future transactions in any sector of critical infrastructure, the security and law enforcement agencies will be most sensitive to those sectors that are interdependent and that directly impact the ability of these agencies to protect national security. We believe that the - 8 -

most immediate candidates for such scrutiny are the energy and transportation sectors, which together play an essential role in the economic vitality and defense of the United States, particularly in times of emergency. In particular, we expect CFIUS agencies to conduct a careful assessment of the risk associated with any controlling foreign investment in the energy sector including nuclear, electrical power, coal and natural gas facilities and in surface transportation infrastructure such as ports, ships and rolling stock. * * * Companies that may be involved in a transaction in which a foreign investor acquires a U.S. entity would be well advised to consult an expert on Exon-Florio well in advance of a transaction. The most frequent mistake we have seen in both the CFIUS and other regulatory contexts is for M&A personnel inside a company (often in concert with their corporate attorneys and investment banks) to reach a commercial arrangement without proper consideration of the regulatory risk associated with a particular transaction. Failure to consider the regulatory risks has cost companies valuable time and money associated with delays in approval. We would welcome the opportunity to answer any questions you might have concerning the issues addressed above. - 9 -