United States v. Thales S.A. and Gemalto N.V.; Proposed Final Judgment and Competitive Impact Statement
| Published date | 11 March 2019 |
| Record Number | 2019-04293 |
| Section | Notices |
| Court | Antitrust Division |
Federal Register, Volume 84 Issue 47 (Monday, March 11, 2019)
[Federal Register Volume 84, Number 47 (Monday, March 11, 2019)]
[Notices]
[Pages 8745-8762]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2019-04293]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF JUSTICE
Antitrust Division
United States v. Thales S.A. and Gemalto N.V.; Proposed Final
Judgment and Competitive Impact Statement
Notice is hereby given pursuant to the Antitrust Procedures and
Penalties Act, 15 U.S.C. 16(b)-(h), that a proposed Final Judgment,
Stipulation, and
[[Page 8746]]
Competitive Impact Statement have been filed with the United States
District Court for the District of Columbia in United States of America
v. Thales S.A. and Gemalto N.V., Civil Action No. 1:19-cv-00569-BAH. On
February 28, 2019, the United States filed a Complaint alleging that
Thales S.A.'s proposed acquisition of Gemalto N.V. would violate
Section 7 of the Clayton Act, 15 U.S.C. 18. The proposed Final
Judgment, filed at the same time as the Complaint, requires Thales S.A.
to divest to an acquirer, subject to the United States' approval, its
General Purpose HSM Products business.
Copies of the Complaint, proposed Final Judgment, and Competitive
Impact Statement are available for inspection on the Antitrust
Division's website at http://www.justice.gov/atr and at the Office of
the Clerk of the United States District Court for the District of
Columbia. Copies of these materials may be obtained from the Antitrust
Division upon request and payment of the copying fee set by Department
of Justice regulations.
Public comment is invited within 60 days of the date of this
notice. Such comments, including the name of the submitter, and
responses thereto, will be posted on the Antitrust Division's website,
filed with the Court, and, under certain circumstances, published in
the Federal Register. Comments should be directed to Aaron Hoag, Chief,
Technology and Financial Services Section, Antitrust Division,
Department of Justice, 450 Fifth Street NW, Suite 7100, Washington, DC
20530 (telephone: 202-307-6153).
Patricia A. Brink,
Director of Civil Enforcement.
United States District Court for the District of Columbia
United States of America, United States Department of Justice
Antitrust Division, 450 Fifth Street NW, Suite 7100, Washington, DC
20530, Plaintiff, v. Thales S.A. Tour Carpe Diem, 31 Place des
Corolles--CS 20001, 92098 Paris La Defense Cedex, France, and
Gemalto N.V. Barbara Strozzilaan 382, Amsterdam, The Netherlands,
1083 HN Defendants.
Case No.: 1:19-cv-00569-BAH
Judge: Beryl A. Howell
COMPLAINT
The United States of America, acting under the direction of the
Attorney General of the United States, brings this civil action to
enjoin the acquisition of Gemalto N.V. (Gemalto) by Thales S.A.
(Thales) and to obtain other equitable relief. The United States
alleges as follows:
I. NATURE OF THE ACTION
1. Thales intends to acquire all of the outstanding ordinary shares
of Gemalto for approximately $5.64 billion. Thales and Gemalto are the
world's leading providers of general purpose (GP) hardware security
modules (HSMs) and are significant direct competitors in the United
States.
2. Organizations, including corporations and governmental agencies,
use GP HSMs to protect their most sensitive data. GP HSMs are hardened,
tamper-resistant hardware devices that strengthen data security by,
among other things, making encryption key generation and management,
data encryption and decryption, and digital signature creation and
verification more secure. GP HSMs are used to achieve higher levels of
data security and to meet or exceed established and emerging industry
and regulatory standards for cybersecurity.
3. Together, Thales and Gemalto dominate the U.S. market for GP
HSMs and face limited competition from a few, much smaller rivals.
Thales and Gemalto are each other's closest competitors. They compete
head-to-head in the development, marketing, service, and sale of GP
HSMs. Thales' proposed acquisition of Gemalto would eliminate this
competition, resulting in higher prices; lower quality products,
support, and service; and reduced innovation.
4. Accordingly, the transaction is likely to substantially lessen
competition in the provision of GP HSMs in the United States, in
violation of Section 7 of the Clayton Act, 15 U.S.C. Sec. 18, and
should be enjoined.
II. DEFENDANTS AND THE PROPOSED ACQUISITION
5. Thales is an international company incorporated in France with
its principal office in Paris. Thales is active globally in five main
industries: (i) aeronautics; (ii) space; (iii) ground transportation;
(iv) defense; and (v) security. In 2017, it had global revenue of
approximately $19.6 billion, operations in fifty-six countries, and
approximately 65,100 employees. Thales eSecurity is a business unit of
Thales. Thales eSecurity primarily encompasses three legal entities:
(1) Thales eSecurity Inc. (based in the United States with offices in
Plantation, Florida; San Jose, California; and Boston, Massachusetts),
(2) Thales UK Ltd. (based in the United Kingdom), and (3) Thales
Transport & Security HK Ltd. (based in Hong Kong). Thales eSecurity
specializes in developing, marketing, and selling data security
products including but not limited to GP HSMs, payment HSMs, and
encryption and key management software and hardware. Thales sells GP
HSMs to customers worldwide, including government and commercial
organizations throughout the United States, under the brand name
nShield. In 2008, Thales acquired nCipher, a company that specialized
in cryptographic security and sold, among other things, GP HSMs under
the brand name nCipher. After that acquisition, Thales changed the
brand name of those GP HSMs to nShield.
6. Pursuant to its commitments to the European Commission, entered
into on November 7, 2018, Thales has agreed to divest its nShield
business. As part of these commitments, Thales has separated the
nShield business and related assets and personnel from the rest of its
businesses and appointed a hold separate manager whose responsibility
it is to manage the nShield business as a distinct and separate entity
from the businesses retained by Thales until the divestiture is
completed. This new business unit is operating under the name nCipher
Security.
7. Gemalto is an international digital security company
incorporated in the Netherlands with its principal office in Amsterdam.
Gemalto is active globally in providing authentication and data
protection technology, platforms, and services in five main areas: (i)
banking and payment; (ii) enterprise and cybersecurity; (iii)
government; (iv) mobile; and (v) machine-to-machine Internet of Things.
In 2017, Gemalto had global revenue of approximately $3.7 billion,
operations in forty-eight countries, and approximately 15,000
employees. Gemalto develops, markets, and sells GP HSMs, as well as
other security solutions and services including but not limited to
payment HSMs and encryption and key management software and hardware.
In the United States, Gemalto sells its products and services primarily
through SafeNet, Inc. (based in Belcamp, Maryland), SafeNet Assured
Technologies, LLC (based in Abingdon, Maryland), and Gemalto Inc.
(based in Austin, Texas). Gemalto sells GP HSMs to customers worldwide,
including government and commercial organizations throughout the United
States, under the brand name SafeNet Luna.
8. On December 17, 2017, Thales and Gemalto entered into an
agreement on a recommended all-cash offer by Thales to acquire all of
the issued and outstanding ordinary shares of Gemalto for approximately
$5.64 billion.
[[Page 8747]]
III. JURISDICTION, VENUE, AND INTERSTATE COMMERCE
9. The United States brings this action under Section 15 of the
Clayton Act, 15 U.S.C. Sec. 25, to prevent and restrain Defendants
from violating Section 7 of the Clayton Act, 15 U.S.C. Sec. 18. This
Court has subject-matter jurisdiction over this action under Section 15
of the Clayton Act, 15 U.S.C. Sec. 25, and 28 U.S.C. Sec. Sec. 1331,
1337(a), and 1345.
10. Defendants market, sell, and service their products, including
their GP HSMs, throughout the United States and regularly and
continuously transact business and transmit data in connection with
these activities in the flow of interstate commerce, which has a
substantial effect upon interstate commerce.
11. Defendants consent to personal jurisdiction and venue in this
district. This Court has personal jurisdiction over each Defendant and
venue is proper under Section 12 of the Clayton Act, 15 U.S.C. Sec.
22, and 28 U.S.C. Sec. 1391(b) and (c).
IV. THE RELEVANT MARKET
A. Industry Background
12. Many U.S. organizations, including commercial enterprises and
government agencies, use, transmit, and maintain sensitive electronic
data. The universe of sensitive electronic data has been expanding
rapidly and relates to a wide range of subjects, such as personally
identifiable information, classified information, health records,
financial information, tax records, trade secrets and other
confidential business information, software code, and other nonpublic
information. Access to this data is often critical to an organization's
ability to operate effectively and efficiently. Inappropriate use,
theft, corruption, or disclosure of this data could result in
significant harm to an organization's customers or constituents and the
organization itself.
13. U.S. organizations increasingly rely on encryption as a crucial
component of the security measures implemented to safeguard sensitive
data from internal and external threats. Encryption is a process that
converts readable data (plain text) into an unreadable format (cipher
text) using an algorithm and an encryption key. Decryption is the
reverse of encryption, converting cipher text back to plain text.
Encryption algorithms are based on highly complex math and are often
standardized and open source. Encryption keys consist of a randomly
generated series of numbers or pairs of randomly generated prime
numbers, expressed in bits. Because encryption algorithms are virtually
impossible to decipher using today's technology, attackers who want
unauthorized access to sensitive data generally focus their efforts on
obtaining private encryption keys instead of trying to break the
encryption algorithm directly. With the right key, an attacker can
freely access an organization's sensitive data. Moreover, a lost or
corrupted key could make encrypted data unrecoverable by the
organization. Organizations therefore must implement processes and
products that create, maintain, protect, and control their encryption
keys in a manner that safeguards against improper access or use while
simultaneously ensuring the keys are readily available when required
for authorized use.
14. GP HSMs provide the most secure way for organizations to
effectively manage and protect their encryption keys, and many U.S.
organizations use them to protect their most sensitive data. GP HSMs
are tamper-resistant hardware environments for secure encryption
processing and key management. GP HSMs provide additional security as
compared to software-based key management solutions because they are
isolated from the host information technology (IT) environment and
segregate encryption keys from encrypted data and encryption
applications. GP HSMs also enable organizations to implement strong
authentication regimes for key management administrators that prevent
unauthorized access.
15. GP HSMs are typically independently validated to confirm they
provide a level of security specified by various standards.
Certifications of compliance with these standards provides assurance to
customers that GP HSMs satisfy certain minimum security performance
benchmarks. For example, U.S. GP HSM customers frequently rely on the
Federal Information Processing Standard (FIPS) 140-2 to assess the
level of security provided by a particular GP HSM. FIPS 140-2 is a
standard defined by the U.S. National Institute of Standards, which is
part of the U.S. Department of Commerce. The standard is mandatory for
U.S. government IT security systems that use cryptographic modules to
protect sensitive but unclassified information. Commercial enterprises
also rely heavily on the standard to assess the security provided by
cryptographic modules. FIPS 140-2 comprises four increasing,
qualitative levels of security--Levels 1 through 4--for cryptographic
modules used to protect sensitive information. Cryptographic modules go
through an expensive and time consuming testing process in order to be
validated at a particular FIPS 140-2 level. Although software-only
modules can be validated under FIPS 140-2, due to increasingly
stringent security requirements, organizations must use an HSM to
attain Level 3 security. Thales and Gemalto both provide highly secure
GP HSMs that have been validated at FIPS 140-2, Level 3.
16. Thales and Gemalto sell GP HSMs and related services directly
to end-user organizations, to resellers who often combine the GP HSMs
with additional security products or services, and to cloud service
providers (CSPs) who then sell GP HSM services, or HSM-as-a-service
(HSMaaS), to their cloud customers. The leading CSPs purchase GP HSMs
from third-party suppliers, including Thales and Gemalto.
17. There are, however, many organizations that are reluctant to
move their sensitive data to the cloud and use HSMaaS because of
security concerns. These organizations continue to rely, to at least
some degree, on purchasing and using their own GP HSMs to protect their
sensitive data.
18. GP HSMs typically must be integrated into or configured to
operate within an organization's existing IT environment. An
organization needs assurance that a GP HSM will be an effective
component of what may be an already complex data security
infrastructure. Because of this, the GP HSM sales process typically
includes a comprehensive exchange of information between the potential
customer organization and GP HSM supplier.
19. Once an organization has installed a GP HSM into its IT
environment and is using it to protect its keys and to provide a secure
data encryption environment, any breakdowns or malfunctions in the GP
HSM could not only compromise the sensitive data but also jeopardize
the organization's ability to perform day-to-day tasks that are
necessary for the organization to carry out its business. Post-sales
customer support and service are therefore essential conduct carried
out by successful GP HSM suppliers. Many customers will not even
consider a potential GP HSM supplier who has not established a strong
reputation for providing quality GP HSMs and continuous and effective
post-sales service and support. Thales and Gemalto both have strong
reputations for high-quality post-sales service and support. Thales and
Gemalto provide this service and support to their direct customers and
indirectly to other customers by assisting their resellers.
20. Thales and Gemalto both create and maintain confidential price
lists for
[[Page 8748]]
their respective GP HSMs, additional GP HSM components and accessories,
and services. Confidential discount rates are then applied to the price
list to determine the prices that are applicable to resellers. Thales
and Gemalto authorize, customer-by-customer, confidential discounts
from the prices on the price list, and in the case of resellers,
additional discounts to the discounted prices already available to the
reseller. Thales and Gemalto regularly approve significant discounts on
GP HSMs when competing against each other.
B. Relevant Market
21. GP HSMs are most frequently included as components of complex
encryption solutions used by government and private organizations to
safeguard their most sensitive data. Use of GP HSMs is often specified
by regulations, industry standards, or an organization's auditors or
security policies, or is otherwise deemed necessary to safeguard the
organization's most sensitive data or provide the organization's
customers or constituents with confidence that their sensitive data
will be adequately protected. Organizations that use GP HSMs have
determined that less expensive alternatives to GP HSMs, such as
software-based key management solutions, provide inadequate security
for their most sensitive data. Some organizations will not even use
cloud-based GP HSMaaS, and, if they do, will require an on-premises GP
HSM to provide an additional layer of encryption security for
encryption keys stored in a cloud-based GP HSM. Many customers are
unwilling to entrust the protection of their most sensitive data to
HSMaaS provided by a CSP. In order to provide HSMaaS to those customers
that are willing to outsource at least some their GP HSM needs, CSPs
purchase GP HSMs from the Defendants and the Defendants' GP HSM
competitors.
22. Defendants market, sell, and service GP HSMs for use by
organizations across the United States. Because GP HSMs are used to
protect an organization's most sensitive data, U.S. customers require
GP HSM suppliers to possess the demonstrated ability to provide both
high-quality GP HSMs and high-quality post-sales service and support in
the United States.
23. A hypothetical GP HSM monopolist could profitably impose a
small but significant and non-transitory increase in price on GP HSM
customers in the United States. Accordingly, GP HSMs sold to U.S.
customers is a relevant market for purposes of analyzing the likely
competitive effects of the proposed acquisition under Section 7 of the
Clayton Act, 15 U.S.C. Sec. 18.
V. ANTICOMPETITIVE EFFECTS OF THE PROPOSED ACQUISITION
24. Together, Thales and Gemalto dominate the GP HSM market in the
United States. Thales and Gemalto are the two leading providers of GP
HSMs in the United States, with individual market shares of
approximately 30% and 36%, respectively, and a combined market share of
approximately 66%. Thales' proposed acquisition of Gemalto likely would
substantially lessen competition and harm customers in the U.S. GP HSM
market by eliminating head-to-head competition between the two leading
suppliers in the United States. The acquisition likely would result in
higher prices, lower quality, reduced choice, and reduced innovation.
Thales' proposed acquisition of Gemalto would substantially increase
market concentration in an already highly concentrated market. The
proposed acquisition violates Section 7 of the Clayton Act.
25. Thales and Gemalto currently compete head-to-head and their
respective GP HSMs are each other's closest substitutes. Thales and
Gemalto regularly approve significant discounts on GP HSMs when
competing against each other. Competition between the two companies has
also spurred innovation in the past. Thales' proposed acquisition of
Gemalto would eliminate this head-to-head competition and reduce
innovation, in addition to significantly increasing concentration in a
highly concentrated market. As a result, Thales would emerge as the
clearly dominant provider of GP HSMs in the United States with the
ability to exercise substantial market power, increasing the likelihood
that Thales could unilaterally increase prices or reduce its efforts to
improve the quality of its products and services.
VI. ABSENCE OF COUNTERVAILING FACTORS
26. It is unlikely that any firm would enter the relevant product
and geographic markets alleged herein in a timely manner sufficient to
defeat the likely anticompetitive effects of the proposed acquisition.
Successful entry in the development, marketing, sale, and service of GP
HSMs is difficult, time-consuming, and costly.
27. Any new entrant would be required to expend significant time
and capital to design and develop a series of GP HSMs that are at least
comparable to Defendants' GP HSM product lines in terms of
functionality and ability to interoperate with a wide range of
encryption solutions and IT resources. Moreover, a new entrant, as well
as any existing GP HSM provider seeking to expand and become a viable
competitor in the supply of GP HSMs for use by individual organizations
in the United States in on-premises security solutions, would need to
spend significant time and effort to demonstrate its ability to provide
quality GP HSMs for such use and continuous, high-quality post-sales
service in the United States. It is unlikely that any such entry or
expansion effort would produce an economically viable alternative to
the merged firm in time to counteract the competitive harm likely to
result from the proposed transaction.
28. Defendants cannot demonstrate merger-specific, verifiable
efficiencies sufficient to offset the proposed merger's likely
anticompetitive effects.
VII. VIOLATION ALLEGED
29. The United States incorporates the allegations of paragraphs 1
through 28 above.
30. The proposed acquisition of Gemalto by Thales is likely to
substantially lessen competition for the development and supply of GP
HSMs in the United States in violation of Section 7 of the Clayton Act,
15 U.S.C. Sec. 18.
31. Unless enjoined, the proposed acquisition likely will have the
following anticompetitive effects, among others:
(a) actual and potential competition between Thales and Gemalto in
the development, sale, and service of GP HSMs in the United States will
be eliminated;
(b) competition in the development, sale, and service of GP HSMs in
the United States in general will be substantially lessened;
(c) prices of GP HSMs will increase;
(d) improvements or upgrades to the quality or functionality of GP
HSMs will be less frequent and less substantial;
(e) the quality of service for GP HSMs will decline; and
(f) organizations in the United States that require GP HSMs for use
in on-premises security solutions will be especially vulnerable to an
exercise of market power by the merged firm.
VIII. REQUEST FOR RELIEF
32. The United States requests that this Court:
(a) adjudge and decree that Thales' proposed acquisition of Gemalto
would be unlawful and would violate Section 7 of the Clayton Act, 15
U.S.C. Sec. 18;
(b) permanently enjoin and restrain Defendants and all persons
acting on
[[Page 8749]]
their behalf from carrying out the December 17, 2017, agreement on a
recommended all-cash offer by Thales to acquire all of the issued and
outstanding ordinary shares of Gemalto, or from entering into or
carrying out any other contract, agreement, plan, or understanding, or
taking any other action, to combine Thales and Gemalto;
(c) award the United States its costs for this action; and
(d) award the United States such other and further relief as this
Court deems just and proper.
Dated: February 28, 2019
Respectfully submitted,
FOR PLAINTIFF UNITED STATES OF AMERICA:
-----------------------------------------------------------------------
Makan Delrahim (D.C. Bar 457795),
Assistant Attorney General for Antitrust.
-----------------------------------------------------------------------
Bernard A. Nigro, Jr. (D.C. Bar 412357),
Deputy Assistant Attorney General.
-----------------------------------------------------------------------
Patricia A. Brink,
Director of Civil Enforcement.
-----------------------------------------------------------------------
Aaron D. Hoag,
Chief, Technology and Financial Services.
-----------------------------------------------------------------------
Danielle G. Hauck,
Adam T. Severt,
Assistant Chiefs, Technology and Financial Services Section.
-----------------------------------------------------------------------
Kelly M. Schoolmeester,
(D.C. Bar 1008354),
Maureen T. Casey,
(D.C. Bar 415893)
(D.C. Bar 1019454),
Chinita M. Sinkler,
Bindi R. Bhagat,
Cory Brader Leuchten,
R. Cameron Gower,
Ryan T. Karr,
David J. Shaw, (D.C. Bar 996525),
Aaron Comenetz, (D.C. Bar 479572),
Kent Brown,
Attorneys for the United States, United States Department of
Justice, Antitrust Division, 450 Fifth Street, NW, Suite 7100,
Washington, D.C. 20530, Tel.: (202) 598-2693, Fax: (202) 616-8544,
Email: [email protected].
United States District Court for the District of Columbia
United States of America, Plaintiff, v. Thales S.A. and Gemalto
N.V., Defendants.
Case No.: 1:19-cv-00569-BAH
Judge: Beryl A. Howell
PROPOSED FINAL JUDGMENT
WHEREAS, Plaintiff, United States of America, filed its Complaint
on February 28, 2019, the United States and Defendants, Thales S.A. and
Gemalto N.V., by their respective attorneys, have consented to the
entry of this Final Judgment without trial or adjudication of any issue
of fact or law and without this Final Judgment constituting any
evidence against or admission by any party regarding any issue of fact
or law;
AND WHEREAS, Defendants agree to be bound by the provisions of this
Final Judgment pending its approval by the Court;
AND WHEREAS, the essence of this Final Judgment is the prompt and
certain divestiture of certain rights or assets by Defendants to assure
that competition is not substantially lessened;
AND WHEREAS, the United States requires Defendants to make certain
divestitures for the purpose of remedying the loss of competition
alleged in the Complaint;
AND WHEREAS, Defendants have represented to the United States that
the divestitures required below can and will be made and that
Defendants will later raise no claim of hardship or difficulty as
grounds for asking the Court to modify any of the divestiture
provisions contained below;
NOW THEREFORE, before any testimony is taken, without trial or
adjudication of any issue of fact or law, and upon consent of the
parties, it is ORDERED, ADJUDGED, AND DECREED:
I. JURISDICTION
This Court has jurisdiction over the subject matter of and each of
the parties to this action. The Complaint states a claim upon which
relief may be granted against Defendants under Section 7 of the Clayton
Act, as amended (15 U.S.C. Sec. 18).
II. DEFINITIONS
As used in this Final Judgment:
A. ``Acquirer'' means the entity to whom Defendants divest the
Divestiture Assets.
B. ``Thales'' means Defendant Thales S.A., a French corporation
with its principal office in Paris, France; its successors and assigns;
and its subsidiaries, divisions, groups, affiliates, partnerships, and
joint ventures, and their directors, officers, managers, agents, and
employees.
C. ``Gemalto'' means Defendant Gemalto N.V., a Netherlands
corporation with its headquarters in Amsterdam; its successors and
assigns; and its subsidiaries, divisions, groups, affiliates,
partnerships, and joint ventures, and their directors, officers,
managers, agents, and employees.
D. ``Defendants'' means Thales and Gemalto, acting individually or
collectively.
E. ``Transaction'' means Thales' acquisition of Gemalto through a
public offer by Thales for all issued and outstanding ordinary shares
of Gemalto pursuant to the Merger Agreement between Thales and Gemalto
dated December 17, 2017.
F. ``Confidential Information'' means non-public information
related to the Divestiture Assets.
G. ``Divestiture Assets'' means Thales' GP HSM Products business,
including:
(1) all tangible assets primarily related to the production,
operation, research, development, sale, or support of any GP HSM
Product, including but not limited to manufacturing equipment, tooling
and fixed assets, computers, tapes, disks, other storage devices, other
IT hardware, equipment used in research and development, testing
equipment, tools used in design or simulation, personal property,
inventory, office furniture, materials, supplies, and other tangible
property;
(2) all Shared Intangible Assets; and
(3) all other intangible assets primarily related to the
production, operation, research, development, sale, or support of any
GP HSM Product, including but not limited to (i) licenses, permits,
certifications, and authorizations issued by any governmental
organization; contracts or portions of contracts, teaming arrangements,
agreements, leases, commitments, certifications, and understandings,
including supply agreements; customer lists, histories, contracts,
accounts, and credit records; repair and performance records;
documentation relating to software development and changes; manuals and
technical information Defendants provide to their own employees,
customers, suppliers, agents, or licensees; data and records relating
to historic and current research and development efforts, including but
not limited to designs of experiments and the results of successful and
unsuccessful experiments; records relating to designs or simulations,
safety procedures for the handling of materials and substances, and
quality assurance and control procedures; and other records; and (ii)
intellectual property rights, including but not limited to patents,
licenses and sublicenses, copyrights, trademarks, trade names, service
marks, service names, technical information, computer software and
related documentation, know-how, trade secrets, drawings, blueprints,
designs, design protocols, specifications for materials, and
specifications for parts and devices (but not including the name
``THALES'' in any trademark, domain name, trade name, or service).
[[Page 8750]]
The Divestiture Assets include but are not limited to: CodeSafe,
nShield Remote Administration, nShield Bring Your Own Key, Key
Authority (at the option of Acquirer), and Security World Architecture
and monitoring tool nShield Monitor. The Divestiture Assets do not
include any assets owned by Gemalto prior to the closing of the
Transaction.
H. ``Divestiture Closing Date'' means the date on which Thales
divests the Divestiture Assets to Acquirer.
I. ``GP HSM Product'' means a hardened, tamper-resistant general
purpose hardware security module and includes all add-ons, value-added
features, and accessories. ``GP HSM Product'' does not include the
Vormetric Data Security Manager, but does include any GP HSM Product
that is incorporated into or otherwise used with the Vormetric Data
Security Manager.
J. ``Regulatory Approvals'' means any approvals or clearances
pursuant to filings with the Committee on Foreign Investments in the
United States (``CFIUS''), or under antitrust, competition, or other
U.S. or international laws in connection with Acquirer's acquisition of
the Divestiture Assets.
K. ``Relevant Personnel'' means all Thales employees who have
supported or whose job related to the Divestiture Assets at any time
between July 1, 2017 and the Divestiture Closing Date.
L. ``Retained Solution'' means any solution that is sold by
Defendants, including but not limited to Vormetric Data Security
Manager, Vormetric Transparent Encryption, CipherTrust Cloud Key
Manager, SafeNet KeySecure, SafeNet Virtual KeySecure, SafeNet
ProtectApp, and any upgrades, revisions, or new versions of any such
solutions, in each case solely to the extent such solution has
interfaced or interoperated with any of the Divestiture Assets at any
time since January 11, 2017.
M. ``Shared Intangible Assets'' means intangible assets that are
used, or have been under development for use as of January 7, 2019, in
relation to (i) Thales' GP HSM Products business and (ii) Thales'
business relating to products other than GP HSM Products.
III. APPLICABILITY
A. This Final Judgment applies to Thales and Gemalto, as defined
above, and all other persons in active concert or participation with
any of them who receive actual notice of this Final Judgment by
personal service or otherwise.
B. If, prior to complying with Section IV and Section V of this
Final Judgment, Defendants sell or otherwise dispose of all or
substantially all of their assets or of lesser business units that
include the Divestiture Assets, Defendants shall require the purchaser
to be bound by the provisions of this Final Judgment. Defendants need
not obtain such an agreement from the acquirer of the assets divested
pursuant to this Final Judgment.
IV. DIVESTITURES
A. Defendants are ordered and directed, within thirty-five (35)
calendar days following the signing by the parties of the Stipulation
and Order in this matter or five (5) calendar days after the notice of
entry of this Final Judgment by the Court, whichever is later, to
divest the Divestiture Assets to Acquirer in a manner consistent with
this Final Judgment. The United States, in its sole discretion, may
agree to one or more extensions of this time period and shall notify
the Court in such circumstances. If Acquirer, and/or Defendants, as
applicable, have initiated contact with any governmental unit to seek
any Regulatory Approval within five (5) calendar days after the United
States provides written notice pursuant to Paragraph VI(C) that it does
not object to the proposed Acquirer, the period shall be extended (if
necessary) until fifteen (15) calendar days after such Regulatory
Approval is received. The extension allowed for Regulatory Approvals
shall be no longer than ninety (90) calendar days, unless further
extended by the United States, in its sole discretion. Nothing in this
section shall require Defendants to divest the Divestiture Assets
earlier than five (5) calendar days after the closing of the
Transaction. Defendants agree to use their best efforts to divest the
Divestiture Assets as expeditiously as possible.
B. For Divestiture Assets that are Shared Intangible Assets, the
divestiture shall be completed in the following manner:
(1) For each Shared Intangible Asset listed on Schedule 1 and any
other Shared Intangible Asset that has been used, or has been under
development for use, primarily in relation to Thales' GP HSM Products
business, Thales shall transfer or otherwise assign to Acquirer all of
Thales' ownership interest or other rights in the Shared Intangible
Asset, and (a) for any asset listed on Schedule 1, Acquirer shall
provide Defendants a non-exclusive, perpetual, worldwide, fully paid-up
license to use (or, at the Acquirer's option, a covenant not to sue
Defendants for using) the asset in the manner specified on Schedule 1,
and (b) for any other Shared Intangible Asset transferred to Acquirer
under this paragraph, Acquirer shall provide Defendants a non-
exclusive, perpetual, worldwide, fully paid-up license to use (or, at
the Acquirer's option, a covenant not to sue Defendants for using) the
asset in the manner in which it is currently used, or currently under
development for use, in relation to any Thales product other than GP
HSM Products.
(2) For each Shared Intangible Asset listed on Schedule 2 and any
other Shared Intangible Asset that has been used, or has been under
development for use, primarily in relation to Thales' business relating
to products other than GP HSM Products, Defendants shall provide
Acquirer a, perpetual, worldwide, fully paid-up license to use (or, at
the Acquirer's option, a covenant not to sue Acquirer for use of) the
asset. At the Acquirer's option, such licenses shall (i) be exclusive
in relation to GP HSM Products and/or (ii) include non-exclusive rights
in relation to products other than GP HSM products.
C. In accomplishing the divestiture ordered by this Final Judgment,
Defendants promptly shall make known, by usual and customary means, the
availability of the Divestiture Assets. Defendants shall inform any
person making an inquiry regarding a possible purchase of the
Divestiture Assets that they are being divested pursuant to this Final
Judgment and provide that person with a copy of this Final Judgment.
Defendants shall offer to furnish to all prospective Acquirers, subject
to customary confidentiality assurances, all information and documents
relating to the Divestiture Assets customarily provided in a due
diligence process, except information or documents subject to the
attorney-client privilege or work-product doctrine. Defendants shall
make available such information to the United States at the same time
that such information is made available to any other person.
D. Defendants shall permit prospective Acquirers of the Divestiture
Assets to have reasonable access to personnel and to make inspections
of the physical facilities included in the Divestiture Assets; access
to any and all environmental, zoning, and other permit documents and
information; and access to any and all financial, operational, or other
documents and information customarily provided as part of a due
diligence process.
E. Defendants shall not take any action that will impede in any way
the permitting, operation, or divestiture of the Divestiture Assets.
[[Page 8751]]
F. Employees
(1) Within ten (10) business days following the filing of the
Complaint in this matter, Thales shall provide to Acquirer, the United
States, and the Monitoring Trustee organization charts including any
Relevant Personnel for each year since July 1, 2017. Within ten (10)
business days of receiving a request from Acquirer, Thales shall
provide, subject to applicable law, to Acquirer, the United States, and
the Monitoring Trustee, additional information related to identified
Relevant Personnel, including name, job title, reporting relationships,
past experience, and responsibilities from July 1, 2017 through the
Divestiture Closing Date, training and educational history, relevant
certifications, job performance evaluations, and current salary and
benefits information to enable Acquirer to make offers of employment.
(2) Upon request by the Acquirer, Thales shall make Relevant
Personnel available for interviews with Acquirer during normal business
hours at a mutually agreeable location. Defendants will not interfere
with any negotiations by Acquirer to employ any Relevant Personnel.
Interference includes but is not limited to offering to increase the
salary or benefits of Relevant Personnel other than as part of an
increase in salary or benefits granted in the ordinary course of
business.
(3) For any Relevant Personnel who elect employment with Acquirer
as part of the divestiture required by this Final Judgment, or pursuant
to Paragraph IV(F)(7) of this Final Judgment, Thales shall waive all
non-compete and non-disclosure agreements (except as noted in Paragraph
IV(F)(6)), vest all unvested pension and other equity rights, and
provide all benefits which those Relevant Personnel would be provided
if transferred to a buyer of an ongoing business.
(4) For a period of two (2) years from the Divestiture Closing
Date, Thales may not solicit to hire Relevant Personnel who were hired
by Acquirer as part of the divestiture required by this Final Judgment,
or pursuant to Paragraph IV(F)(7) of this Final Judgment, unless (a)
such individual is terminated or laid off by Acquirer or (b) Acquirer
agrees in writing that Thales may solicit or hire that individual;
provided, however, that nothing in this paragraph shall be construed as
prohibiting Defendants from utilizing general solicitations or
advertisements.
(5) For a period of one (1) year from the Divestiture Closing Date,
Thales may not hire Relevant Personnel who were hired by Acquirer as
part of the divestiture pursuant to this Final Judgment or pursuant to
Paragraph IV(F)(7) of this Final Judgment, unless (a) such individual
is terminated or laid off by Acquirer or (b) Acquirer agrees in writing
that Thales may solicit or hire that individual.
(6) Nothing in Paragraph IV(F) shall prohibit Thales from
maintaining any reasonable restrictions on the disclosure by any
employee who accepts an offer of employment with Acquirer of Thales'
proprietary non-public information that is (a) not otherwise required
to be disclosed by this Final Judgment, (b) related solely to Thales'
retained businesses and clients, and (c) unrelated to the Divestiture
Assets.
(7) Acquirer's right to hire Relevant Personnel pursuant to
Paragraph IV(F)(2) and Thales' obligations under Paragraph IV(F)(3)
shall remain in effect for a period of ninety (90) days after the
Divestiture Closing Date.
G. Asset Warranties
In addition to any other warranties in the divestiture-related
agreements entered into by Defendants, Thales shall warrant to Acquirer
(a) that each asset will be operational and without material defect as
of the Divestiture Closing Date; (b) that there are no material defects
in the environmental, zoning, or other permits pertaining to the
operation of the Divestiture Assets; and (c) that, following the sale
of the Divestiture Assets, Defendants will not undertake, directly or
indirectly, any challenges to the environmental, zoning, or other
permits relating to the operation of the Divestiture Assets.
H. Additional Assets
In addition to any other remedial provisions in the divestiture-
related agreements entered into by Defendants, for a period of up to
one (1) year following the Divestiture Closing Date, if Acquirer
determines that any assets not included in the Divestiture Assets were
related to the GP HSM Products business and reasonably necessary for
the continued competitiveness of the divested GP HSM Products business,
it shall notify the United States, the Monitoring Trustee, and the
Defendants in writing that it requires such assets. If, after taking
into account Acquirer's assets and business and providing Defendants an
opportunity to demonstrate that such assets were not related to, and/or
not reasonably necessary for the continued competitiveness of the
divested GP HSM Products business, the United States, in its sole
discretion, determines that such assets should be transferred or
licensed, Defendants and Acquirer will negotiate an agreement within
thirty (30) calendar days providing for the transfer or licensing of
such assets in a period to be determined by the United States in
consultation with the Defendants. The terms of any such transfer or
license agreement shall be commercially reasonable and must be
acceptable to the United States, in its sole discretion.
I. Transition Services
At the option of Acquirer, on or before the Divestiture Closing
Date, Thales shall enter into transition services or reverse transition
services agreements to provide any transition services reasonably
necessary to allow Acquirer to operate any Divestiture Assets or to
facilitate the transfer of Thales facilities to Acquirer. Thales will
provide transition services under any such agreement for an initial
period of up to one (1) year, on terms and conditions reasonably
related to market conditions for the provision of the relevant
services, subject to the approval of the United States in its sole
discretion. Upon Acquirer's request, the United States, in its sole
discretion, may approve one or more extensions of any such agreement
for a total of up to an additional one (1) year.
J. Third-Party Agreements
At Acquirer's option, on or before the Divestiture Closing Date,
Thales shall use its best efforts to assign or otherwise transfer to
Acquirer all transferable or assignable agreements, or any assignable
portions thereof, included in the Divestiture Assets, including but not
limited to customer contracts, licenses, and collaborations. If Thales
is unable to assign or transfer any such agreements, Thales shall use
best efforts to ensure that Acquirer is put in the same economic
position as if such agreements were assigned or transferred to Acquirer
on the Divestiture Closing Date. The terms and conditions of any
contractual arrangement intended to satisfy this provision must be
reasonably related to market conditions for the provision of such
services.
K. Licenses, Registrations, and Permits
Thales will make best efforts to assist Acquirer with acquiring new
licenses, registrations, and permits to support the Divestiture Assets
and, until Acquirer has the necessary licenses, registrations, and
permits, Thales will provide Acquirer with the benefit of Thales'
licenses, registrations, and permits in Acquirer's operation of the
Divestiture Assets to the extent permissible by law.
[[Page 8752]]
L. Interoperability
(1) In order for the Divestiture Assets to have the uninterrupted
ability to interface and interoperate with any solution that is
provided by Defendants, for two (2) years following the date of sale of
the Divestiture Assets, Defendants shall continue to enable, at cost
and on the same quality and terms, the interface and interoperation
between any GP HSM Product offered by Acquirer using the Divested
Assets and any Retained Solutions to the extent such interface or
interoperation existed at any time since January 1, 2017 in the then-
current release of that Retained Solution. Defendants shall, upon
receiving a written request from Acquirer at least thirty (30) calendar
days before expiration of the second year, continue to provide the
capability covered by this Section for another one (1) year, if
approved by the United States in its sole discretion.
(2) Defendants may impose, as a condition of enabling any interface
and interoperation that is required by Paragraph IV(L)(1), conditions
that are reasonably related to maintaining the security, integrity, and
confidentiality of customer data or the composition or means of
operation of the applicable Retained Solution, except that Defendants
may not impose conditions that are materially less favorable than the
conditions under which Defendants provide or would provide an interface
and interoperation between any of Defendants' GP HSMs and any Retained
Solution.
(3) Defendants shall not change, during the period of Defendants'
obligations under Paragraph IV(L)(1), except for good cause, the format
of any interface and interoperation that is required by Paragraph
IV(L)(1). For any such change, Defendants shall provide adequate notice
and information for Acquirer to modify its Divested Assets, including
any such products that are already installed with customers, to use the
new format without disruption.
(4) Defendants shall take all reasonable steps to cooperate with
and assist Acquirer in obtaining any third-party license or permission
that may be required for Defendants to convey, license, sublicense,
assign, or otherwise transfer to Acquirer rights, any interface or
interoperability required by Paragraph IV(L)(1), or the use of any data
transmitted as a result of any such interface or interoperation.
M. Patents
Thales shall provide a worldwide, non-exclusive, irrevocable,
perpetual covenant not to assert against Acquirer or its customers in
the field of use of GP HSM Products all U.S. or international patents,
patent applications, or rights related to a patent or patent
application (e.g., continuation, continuation-in-part, divisional,
counterpart foreign application, or related international patent
application filed under the Patent Cooperation Treaty), with a priority
date or invention date prior to the closing of the Transaction (a)
related to the Divestiture Assets and (b) owned, controlled, licensed,
or used by Thales prior to the closing of the Transaction.
N. Unless the United States otherwise consents in writing, the
divestiture pursuant to Section IV or by the Divestiture Trustee
appointed pursuant to Section V of this Final Judgment shall include
the entire Divestiture Assets and shall be accomplished in such a way
as to satisfy the United States, in its sole discretion, that the
Divestiture Assets can and will be used by Acquirer (approval of which
is in the United States' sole discretion) as part of a viable, ongoing
business of the production, operation, research, development, sale, and
support of the GP HSM Products. The divestitures, whether pursuant to
Section IV or Section V of this Final Judgment,
(1) shall be made to an Acquirer that, in the United States' sole
judgment, has the intent and capability (including the necessary
managerial, operational, technical, and financial capability) of
competing effectively in the business of producing, operating,
researching, developing, selling, and supporting GP HSM Products; and
(2) shall be accomplished so as to satisfy the United States, in
its sole discretion, that none of the terms of any agreement between an
Acquirer and Defendants give Defendants the ability unreasonably to
raise the Acquirer's costs, to lower the Acquirer's efficiency, or
otherwise to interfere in the ability of the Acquirer to compete
effectively.
V. APPOINTMENT OF DIVESTITURE TRUSTEE
A. If Defendants have not divested the Divestiture Assets to
Acquirer within the time period specified in Paragraph IV(A),
Defendants shall notify the United States of that fact in writing. Upon
application of the United States, the Court shall appoint a Divestiture
Trustee selected by the United States and approved by the Court to
effect the divestiture of the Divestiture Assets.
B. After the appointment of a Divestiture Trustee becomes
effective, only the Divestiture Trustee shall have the right to sell
the Divestiture Assets. The Divestiture Trustee shall have the power
and authority to accomplish the divestiture to an Acquirer acceptable
to the United States, in its sole discretion, at such price and on such
terms as are then obtainable upon reasonable effort by the Divestiture
Trustee, subject to the provisions of Sections IV and V of this Final
Judgment, and shall have such other powers as the Court deems
appropriate. Subject to Paragraph V(D) of this Final Judgment, the
Divestiture Trustee may hire at the cost and expense of Defendants any
agents, investment bankers, attorneys, accountants, or consultants, who
shall be solely accountable to the Divestiture Trustee, reasonably
necessary in the Divestiture Trustee's judgment to assist in the
divestiture. Any such agents or consultants shall serve on such terms
and conditions as the United States approves, including confidentiality
requirements and conflict of interest certifications.
C. Defendants shall not object to a sale by the Divestiture Trustee
on any ground other than the Divestiture Trustee's malfeasance. Any
such objections by Defendants must be conveyed in writing to the United
States and the Divestiture Trustee within ten (10) calendar days after
the Divestiture Trustee has provided the notice required under Section
VI.
D. The Divestiture Trustee shall serve at the cost and expense of
Defendants pursuant to a written agreement, on such terms and
conditions as the United States approves, including confidentiality
requirements and conflict of interest certifications. The Divestiture
Trustee shall account for all monies derived from the sale of the
assets sold by the Divestiture Trustee and all costs and expenses so
incurred. After approval by the Court of the Divestiture Trustee's
accounting, including fees for any of its services yet unpaid and those
of any professionals and agents retained by the Divestiture Trustee,
all remaining money shall be paid to Defendants and the trust shall
then be terminated. The compensation of the Divestiture Trustee and any
professionals and agents retained by the Divestiture Trustee shall be
reasonable in light of the value of the Divestiture Assets and based on
a fee arrangement that provides the Divestiture Trustee with incentives
based on the price and terms of the divestiture and the speed with
which it is accomplished, but the timeliness of the divestiture is
paramount. If the Divestiture Trustee and Defendants are unable to
reach agreement on the Divestiture Trustee's or any agents' or
consultants' compensation or other terms and conditions of engagement
within fourteen (14) calendar days of the
[[Page 8753]]
appointment of the Divestiture Trustee, the United States may, in its
sole discretion, take appropriate action, including making a
recommendation to the Court. The Divestiture Trustee shall, within
three (3) business days of hiring any other agents or consultants,
provide written notice of such hiring and the rate of compensation to
Defendants and the United States.
E. Defendants shall use their best efforts to assist the
Divestiture Trustee in accomplishing the required divestiture. The
Divestiture Trustee and any agents or consultants retained by the
Divestiture Trustee shall have full and complete access to the
personnel, books, records, and facilities of the business to be
divested, and Defendants shall provide or develop financial and other
information relevant to such business as the Divestiture Trustee may
reasonably request, subject to reasonable protection for trade secrets;
other confidential research, development, or commercial information; or
any applicable privileges. Defendants shall take no action to interfere
with or to impede the Divestiture Trustee's accomplishment of the
divestiture.
F. After its appointment, the Divestiture Trustee shall file
monthly reports with the United States and, as appropriate, the Court,
setting forth the Divestiture Trustee's efforts to accomplish the
divestiture ordered under this Final Judgment. To the extent such
reports contain information that the Divestiture Trustee deems
confidential, such reports shall not be filed in the public docket of
the Court. Such reports shall include the name, address, and telephone
number of each person who, during the preceding month, made an offer to
acquire, expressed an interest in acquiring, entered into negotiations
to acquire, or was contacted or made an inquiry about acquiring any
interest in the Divestiture Assets and shall describe in detail each
contact with any such person. The Divestiture Trustee shall maintain
full records of all efforts made to divest the Divestiture Assets.
G. If the Divestiture Trustee has not accomplished the divestiture
ordered under this Final Judgment within six (6) months after its
appointment, the Divestiture Trustee shall promptly file with the Court
a report setting forth (1) the Divestiture Trustee's efforts to
accomplish the required divestiture; (2) the reasons, in the
Divestiture Trustee's judgment, why the required divestiture has not
been accomplished; and (3) the Divestiture Trustee's recommendations.
To the extent such reports contain information that the Divestiture
Trustee deems confidential, such reports shall not be filed in the
public docket of the Court. The Divestiture Trustee shall at the same
time furnish such report to the United States, which shall have the
right to make additional recommendations consistent with the purpose of
the trust. The Court thereafter shall enter such orders as it shall
deem appropriate to carry out the purpose of the Final Judgment, which
may, if necessary, include extending the trust and the term of the
Divestiture Trustee's appointment by a period requested by the United
States.
H. If the United States determines that the Divestiture Trustee has
ceased to act or failed to act diligently or in a reasonably cost-
effective manner, the United States may recommend the Court appoint a
substitute Divestiture Trustee.
VI. NOTICE OF PROPOSED DIVESTITURE
A. Within two (2) business days following execution of a definitive
divestiture agreement, Defendants or the Divestiture Trustee, whichever
is then responsible for effecting the divestiture required herein,
shall notify the United States of any proposed divestiture required by
Section IV or Section V of this Final Judgment. If the Divestiture
Trustee is responsible, it shall similarly notify Defendants. The
notice shall set forth the details of the proposed divestiture and list
the name, address, and telephone number of each person not previously
identified who offered or expressed an interest in or desire to acquire
any ownership interest in the Divestiture Assets, together with full
details of the same.
B. Within fifteen (15) calendar days of receipt by the United
States of such notice, the United States may request from Defendants,
the proposed Acquirer(s), any other third party, or the Divestiture
Trustee, if applicable, additional information concerning the proposed
divestiture, the proposed Acquirer(s), and any other potential
Acquirer. Defendants and the Divestiture Trustee shall furnish any
additional information requested within fifteen (15) calendar days of
the receipt of the request, unless the parties shall otherwise agree.
C. Within thirty (30) calendar days after receipt of the notice or
within twenty (20) calendar days after the United States has been
provided the additional information requested from Defendants, the
proposed Acquirer(s), any third party, and the Divestiture Trustee,
whichever is later, the United States shall provide written notice to
Defendants and the Divestiture Trustee, if there is one, stating
whether or not, in its sole discretion, it objects to the Acquirer or
any other aspect of the proposed divestiture. If the United States
provides written notice that it does not object, the divestiture may be
consummated, subject only to Defendants' limited right to object to the
sale under Paragraph V(C) of this Final Judgment. Absent written notice
that the United States does not object to the proposed Acquirer(s) or
upon objection by the United States, a divestiture proposed under
Section IV or Section V shall not be consummated. Upon objection by
Defendants under Paragraph V(C), a divestiture proposed under Section V
shall not be consummated unless approved by the Court.
VII. FINANCING
Neither Thales nor Gemalto shall finance all or any part of any
purchase made pursuant to this Final Judgment.
VIII. HOLD SEPARATE AND ASSET PRESERVATION
Until the divestiture required by this Final Judgment has been
accomplished, Defendants shall take all steps necessary to comply with
the Stipulation and Order entered by the Court. Defendants shall take
no action that would jeopardize the divestiture ordered by the Court.
IX. AFFIDAVITS
A. Within twenty (20) calendar days of the filing of the Complaint
in this matter, and every thirty (30) calendar days thereafter until
the divestiture has been completed under Section IV or Section V,
Thales and Gemalto shall deliver to the United States an affidavit,
signed by each defendant's Chief Financial Officer and General Counsel,
which shall describe the fact and manner of Defendants' compliance with
Section IV or Section V of this Final Judgment. Each such affidavit
shall include the name, address, and telephone number of each person
who, during the preceding thirty (30) calendar days, made an offer to
acquire, expressed an interest in acquiring, entered into negotiations
to acquire, or was contacted or made an inquiry about acquiring, any
interest in the Divestiture Assets, and shall describe in detail each
contact with any such person during that period. Each such affidavit
shall also include a description of the efforts Defendants have taken
to solicit buyers for the Divestiture Assets, and to provide required
information to prospective Acquirers, including the limitations, if
any, on such information. Assuming the information set forth in the
affidavit is true and complete, any objection by the United States to
[[Page 8754]]
information provided by Thales and Gemalto, including limitation on
information, shall be made within fourteen (14) calendar days of
receipt of such affidavit.
B. Within twenty (20) calendar days of the filing of the Complaint
in this matter, Defendants shall deliver to the United States and the
Monitoring Trustee an affidavit that describes in reasonable detail all
actions Defendants have taken and all steps Defendants have implemented
on an ongoing basis to comply with Section VIII of this Final Judgment.
Each of the Defendants shall deliver to the United States and the
Monitoring Trustee an affidavit describing any changes to the efforts
and actions outlined in Defendants' earlier affidavits filed pursuant
to this Section within fifteen (15) calendar days after the change is
implemented.
C. Defendants shall keep all records of all efforts made to
preserve and divest the Divestiture Assets until one (1) year after
such divestiture has been completed.
X. APPOINTMENT OF MONITORING TRUSTEE
A. Upon application of the United States, the Court shall appoint a
Monitoring Trustee selected by the United States and approved by the
Court.
B. The Monitoring Trustee shall have the power and authority to
monitor Defendants' compliance with the terms of this Final Judgment
and the Stipulation and Order entered by the Court and shall have such
other powers as the Court deems appropriate. The Monitoring Trustee
shall be required to investigate and report on the Defendants'
compliance with this Final Judgment and the Stipulation and Order, and
Defendants' progress toward effectuating the purposes of this Final
Judgment, including but not limited to reviewing (1) the implementation
and execution of the compliance plan required by Section XI, and (2)
any applications by the Acquirer for additional employees or assets
under Paragraphs IV(F) and IV(H) respectively.
C. Subject to Paragraph X(E) of this Final Judgment, the Monitoring
Trustee may hire at the cost and expense of Defendants any agents,
investment bankers, attorneys, accountants, or consultants, who shall
be solely accountable to the Monitoring Trustee, reasonably necessary
in the Monitoring Trustee's judgment. Any such agents or consultants
shall serve on such terms and conditions as the United States approves,
including confidentiality requirements and conflict of interest
certifications.
D. Defendants shall not object to actions taken by the Monitoring
Trustee in fulfillment of the Monitoring Trustee's responsibilities
under any Order of the Court on any ground other than the Monitoring
Trustee's malfeasance. Any such objections by Defendants must be
conveyed in writing to the United States and the Monitoring Trustee
within ten (10) calendar days after the action taken by the Monitoring
Trustee giving rise to Defendants' objection.
E. The Monitoring Trustee shall serve at the cost and expense of
Defendants, pursuant to a written agreement with Defendants and on such
terms and conditions as the United States approves, including
confidentiality requirements and conflict of interest certifications.
The compensation of the Monitoring Trustee and any agents or
consultants retained by the Monitoring Trustee shall be on reasonable
and customary terms commensurate with the individuals' experience and
responsibilities. If the Monitoring Trustee and Defendants are unable
to reach agreement on the Monitoring Trustee's or any agents' or
consultants' compensation or other terms and conditions of engagement
within fourteen (14) calendar days of the appointment of the Monitoring
Trustee, the United States may, in its sole discretion, take
appropriate action, including making a recommendation to the Court. The
Monitoring Trustee shall, within three (3) business days of hiring any
agents or consultants, provide written notice of such hiring and the
rate of compensation to Defendants and the United States.
F. The Monitoring Trustee shall have no responsibility or
obligation for the operation of Defendants' businesses.
G. Defendants shall use their best efforts to assist the Monitoring
Trustee in monitoring Defendants' compliance with their individual
obligations under this Final Judgment and under the Stipulation and
Order. The Monitoring Trustee and any agents or consultants retained by
the Monitoring Trustee shall have full and complete access to the
personnel, books, records, and facilities relating to compliance with
this Final Judgment, subject to reasonable protection for trade
secrets; other confidential research, development, or commercial
information; or any applicable privileges. Defendants shall take no
action to interfere with or to impede the Monitoring Trustee's
accomplishment of its responsibilities.
H. After its appointment, the Monitoring Trustee shall file reports
semiannually, or more frequently as needed, with the United States and,
as appropriate, the Court setting forth Defendants' efforts to comply
with Defendants' obligations under this Final Judgment and under the
Stipulation and Order. To the extent such reports contain information
that the Monitoring Trustee deems confidential, such reports shall not
be filed in the public docket of the Court.
I. The Monitoring Trustee shall serve until the divestiture of all
the Divestiture Assets is finalized pursuant to either Section IV or
Section V of this Final Judgment, any agreement entered into pursuant
to Paragraph IV(I) has expired, and until Thales' obligations pursuant
to Paragraphs IV(F) and IV(H) have concluded, unless the United States,
in its sole discretion, terminates earlier or extends this period.
J. If the United States determines that the Monitoring Trustee has
ceased to act or failed to act diligently or in a reasonably cost-
effective manner, it may recommend the Court appoint a substitute
Monitoring Trustee.
XI. PROTECTION OF CONFIDENTIAL INFORMATION
A. Thales and Gemalto shall implement and maintain reasonable
procedures to prevent the disclosure or use of Confidential Information
for any purpose other than:
(1) in connection with complying with this Final Judgment;
(2) in connection with complying with regulatory, financial
reporting, audit, legal, compliance, or similar administrative
purposes; or
(3) Defendants' use of Shared Intangible Assets as permitted by
this Final Judgment.
B. Any representative of Thales who possesses any Confidential
Information shall disclose or use such information only to the extent
necessary to perform activities authorized in Paragraph XI(A).
C. Defendants shall implement procedures to prevent Confidential
Information from being used or accessed by representatives of
Defendants other than those with a need for such information in
connection with the permitted uses set forth in Paragraph XI(A) (such
procedures constituting a ``compliance plan''). Defendants' compliance
plan shall include identification of an individual with primary
responsibility for implementing the compliance plan, monitoring
adherence to the compliance plan, taking measures against individuals
who fail to adhere to the compliance plan, and developing instruction
materials and providing instruction to Defendants' representatives
relating to their obligations under this Section.
[[Page 8755]]
D. Defendants shall, within twenty (20) business days of the entry
of the Stipulation and Order, submit to the United States and the
Monitoring Trustee a document setting forth in detail the compliance
plan. Upon receipt of the document, the United States shall notify the
Defendants within twenty (20) business days whether, in its sole
discretion, it approves of or rejects the compliance plan. In the event
that the compliance plan is rejected, the United States shall provide
the reasons for the rejection. Defendants shall be given the
opportunity to submit, within ten (10) business days of receiving a
notice of rejection, a revised compliance plan. If Defendants cannot
agree with the United States on a compliance plan, the United States
shall have the right to request that this Court rule on whether the
Defendants' proposed compliance plan fulfills the requirements of
Section XI.
E. Defendants shall:
(1) furnish a copy of this Final Judgment and related Competitive
Impact Statement within five (5) business days of entry of the Final
Judgment to (a) each officer, director, and any other employee who
possesses, will possess, or may receive Confidential Information;
(2) furnish a copy of this Final Judgment and related Competitive
Impact Statement to any successor to a person designated in Paragraph
XI(C) upon assuming that position;
(3) annually brief each person designated in Paragraph XI(C) on the
meaning and requirements of this Final Judgment and the antitrust laws;
and
(4) obtain from each person designated in Paragraph XI(C), within
ten (10) business days of that person's receipt of the Final Judgment
and annually thereafter for five (5) years, a certification that he or
she (a) has read and, to the best of his or her ability, understands
and agrees to abide by the terms of this Final Judgment; (b) is not
aware of any violation of the Final Judgment that has not been reported
to the company; and (c) understands that any person's failure to comply
with this Final Judgment may result in an enforcement action for civil
or criminal contempt of court against each Defendant or any person who
violates this Final Judgment; and
(5) six (6) months from the Divestiture Closing Date and annually
thereafter for five (5) years, furnish an affidavit to the United
States and the Monitoring Trustee, certifying compliance with Section
XI. For five (5) years following the Divestiture Closing Date, if
violations of Section XI are found, affidavits describing such
violations will be furnished to the United States and the Monitoring
Trustee within five (5) days of the discovery of a violation.
F. The provisions of this Section shall expire five (5) years after
the Divestiture Closing Date.
XII. COMPLIANCE INSPECTION
A. For the purposes of determining or securing compliance with this
Final Judgment, or of any related orders such as any Stipulation and
Order or of determining whether the Final Judgment should be modified
or vacated, and subject to any legally-recognized privilege, from time
to time authorized representatives of the United States, including the
Monitoring Trustee or any other agents and consultants retained by the
United States, shall, upon written request of an authorized
representative of the Assistant Attorney General in charge of the
Antitrust Division and on reasonable notice to Defendants, be
permitted:
(1) access during Defendants' office hours to inspect and copy or,
at the option of the United States, to require Defendants to provide
electronic copies of all books, ledgers, accounts, records, data, and
documents in the possession, custody, or control of Defendants relating
to any matters contained in this Final Judgment; and
(2) to interview, either informally or on the record, Defendants'
officers, employees, or agents, who may have their individual counsel
present, regarding such matters. The interviews shall be subject to the
reasonable convenience of the interviewee and without restraint or
interference by Defendants.
B. Upon the written request of an authorized representative of the
Assistant Attorney General in charge of the Antitrust Division,
Defendants shall submit written reports or responses to written
interrogatories, under oath if requested, relating to any of the
matters contained in this Final Judgment as may be requested.
C. No information or documents obtained by the means provided in
Section XI shall be divulged by the United States to any person other
than an authorized representative of the executive branch of the United
States, except in the course of legal proceedings to which the United
States is a party (including grand jury proceedings), for the purpose
of securing compliance with this Final Judgment, or as otherwise
required by law.
D. If at the time that Defendants furnish information or documents
to the United States, Defendants represent and identify in writing the
material in any such information or documents to which a claim of
protection may be asserted under Rule 26(c)(1)(G) of the Federal Rules
of Civil Procedure, and Defendants mark each pertinent page of such
material, ``Subject to claim of protection under Rule 26(c)(1)(G) of
the Federal Rules of Civil Procedure,'' then the United States shall
give Defendants ten (10) calendar days' notice prior to divulging such
material in any legal proceeding (other than a grand jury proceeding).
XIII. NOTIFICATION OF FUTURE TRANSACTIONS
A. Unless such transaction has a value less than $10 million or is
otherwise subject to the reporting and waiting period requirements of
the Hart-Scott-Rodino Antitrust Improvements Act of 1976, as amended,
15 U.S.C. Sec. 18a (the ``HSR Act''), Defendants, without providing
advance notification to the United States, shall not directly or
indirectly acquire any assets of or any interest, including any
financial, security, loan, equity, or management interest, in any
company that researches, develops, or manufactures GP HSM Products
during the term of this Final Judgment.
B. Such notification shall be provided to the United States in the
same format as, and per the instructions relating to, the Notification
and Report Form set forth in the Appendix to Part 803 of Title 16 of
the Code of Federal Regulations as amended, except that the information
requested in Items 5 through 8 of the instructions must be provided
only about GP HSM Products and related services. Notification shall be
provided at least thirty (30) calendar days prior to acquiring any such
interest, and shall include, beyond what may be required by the
applicable instructions, the names of the principal representatives of
the parties to the agreement who negotiated the agreement, and any
management or strategic plans discussing the proposed transaction. If
within the 30-day period after notification, representatives of the
United States make a written request for additional information,
Defendants shall not consummate the proposed transaction or agreement
until thirty (30) calendar days after submitting all such additional
information. Early termination of the waiting periods in this Paragraph
may be requested and, where appropriate, granted in the same manner as
is applicable under the requirements and provisions of the HSR Act and
rules promulgated thereunder. Section XIII shall be broadly construed
and any ambiguity or uncertainty regarding the filing of notice under
[[Page 8756]]
Section XII shall be resolved in favor of filing notice.
XIV. NO REACQUISITION OF DIVESTITURE ASSETS
Defendants may not reacquire any part of the Divestiture Assets
during the term of this Final Judgment.
XV. RETENTION OF JURISDICTION
The Court retains jurisdiction to enable any party to this Final
Judgment to apply to the Court at any time for further orders and
directions as may be necessary or appropriate to carry out or construe
this Final Judgment, to modify any of its provisions, to enforce
compliance, and to punish violations of its provisions.
XVI. ENFORCEMENT OF FINAL JUDGMENT
A. The United States retains and reserves all rights to enforce the
provisions of this Final Judgment, including the right to seek an order
of contempt from the Court. Defendants agree that in any civil contempt
action, any motion to show cause, or any similar action brought by the
United States regarding an alleged violation of this Final Judgment,
the United States may establish a violation of the decree and the
appropriateness of any remedy therefor by a preponderance of the
evidence, and Defendants waive any argument that a different standard
of proof should apply.
B. The Final Judgment should be interpreted to give full effect to
the procompetitive purposes of the antitrust laws and to restore all
competition the United States alleged was harmed by the challenged
conduct. Defendants agree that they may be held in contempt of, and
that the Court may enforce, any provision of this Final Judgment that,
as interpreted by the Court in light of these procompetitive principles
and applying ordinary tools of interpretation, is stated specifically
and in reasonable detail, whether or not it is clear and unambiguous on
its face. In any such interpretation, the terms of this Final Judgment
should not be construed against either party as the drafter.
C. In any enforcement proceeding in which the Court finds that
Defendants have violated this Final Judgment, the United States may
apply to the Court for a one-time extension of this Final Judgment,
together with such other relief as may be appropriate. In connection
with any successful effort by the United States to enforce this Final
Judgment against a Defendant, whether litigated or resolved prior to
litigation, that Defendant agrees to reimburse the United States for
the fees and expenses of its attorneys, as well as any other costs
including experts' fees, incurred in connection with that enforcement
effort, including in the investigation of the potential violation.
XVII. EXPIRATION OF FINAL JUDGMENT
Unless the Court grants an extension, this Final Judgment shall
expire ten (10) years from the date of its entry, except that after
five (5) years from the date of its entry, this Final Judgment may be
terminated upon notice by the United States to the Court and Defendants
that the divestitures have been completed and that the continuation of
the Final Judgment no longer is necessary or in the public interest.
XVIII. PUBLIC INTEREST DETERMINATION
Entry of this Final Judgment is in the public interest. The parties
have complied with the requirements of the Antitrust Procedures and
Penalties Act, 15 U.S.C. Sec. 16, including making copies available to
the public of this Final Judgment, the Competitive Impact Statement,
any comments thereon, and the United States' responses to comments.
Based upon the record before the Court, which includes the Competitive
Impact Statement and any comments and responses to comments filed with
the Court, entry of this Final Judgment is in the public interest.
Date:------------------------------------------------------------------
[Court approval subject to procedures of Antitrust Procedures and
Penalties Act, 15 U.S.C. Sec. 16]
-----------------------------------------------------------------------
United States District Judge
Schedule 1
Shared Intangible Assets Transferred to Acquirer and Licensed Back to
Defendants
In each case the ``Field of Use for License-Back to Defendants`` is
limited to the manner in which the listed asset is currently used, or
currently under development for use.
Patents
----------------------------------------------------------------------------------------------------------------
Field of use for license-
Title Patent/application No. Jurisdiction back to defendants
----------------------------------------------------------------------------------------------------------------
A method of data transfer, a BR11201801525-44.............. Brazil............. (1) Payment HSMs and
method of controlling use of their derived
data and a cryptographic device. applications and (2)
encryption software
products (not including
key management).
A method of data transfer, a 3013687....................... Canada............. (1) Payment HSMs and
method of controlling use of their derived
data and a cryptographic device. applications and (2)
encryption software
products (not including
key management).
A method of data transfer, a 20178000986.41................ China.............. (1) Payment HSMs and
method of controlling use of their derived
data and a cryptographic device. applications and (2)
encryption software
products (not including
key management).
A method of data transfer, a 17704057.3.................... European Patent (1) Payment HSMs and
method of controlling use of Office. their derived
data and a cryptographic device. applications and (2)
encryption software
products (not including
key management).
A method of data transfer, a 2018-540867................... Japan.............. (1) Payment HSMs and
method of controlling use of their derived
data and a cryptographic device. applications and (2)
encryption software
products (not including
key management).
A method of data transfer, a PCT/GB2017/050264............. Patent Cooperation (1) Payment HSMs and
method of controlling use of Treaty. their derived
data and a cryptographic device. applications and (2)
encryption software
products (not including
key management).
A method of data transfer, a 10-2018-7025706............... Republic of Korea.. (1) Payment HSMs and
method of controlling use of their derived
data and a cryptographic device. applications and (2)
encryption software
products (not including
key management).
A method of data transfer, a 1602088.5..................... United Kingdom..... (1) Payment HSMs and
method of controlling use of their derived
data and a cryptographic device. applications and (2)
encryption software
products (not including
key management).
A method of data transfer, a 16/075575..................... United States...... (1) Payment HSMs and
method of controlling use of their derived
data and a cryptographic device. applications and (2)
encryption software
products (not including
key management).
A method and system of securely GB2413880..................... United Kingdom..... Payment HSMs and their
enforcing a computer policy. derived applications.
[[Page 8757]]
Cryptographic security module GB2409387..................... United Kingdom..... Payment HSMs and their
method and apparatus. derived applications.
Secure transmission of data GB2404535..................... United Kingdom..... Encryption software
within a distributed computer products.
system.
Secure transmission of data US7266705..................... United States of Encryption software
within a distributed computer America. products.
system.
Controlling access to a resource CA2400940..................... Canada............. Payment HSMs and their
by a program using a digital derived applications.
signature.
Controlling access to a resource EP1257892..................... Switzerland........ Payment HSMs and their
by a program using a digital derived applications.
signature.
Controlling access to a resource EP1257892..................... Germany............ Payment HSMs and their
by a program using a digital derived applications.
signature.
Controlling access to a resource EP1257892..................... France............. Payment HSMs and their
by a program using a digital derived applications.
signature.
Controlling access to a resource EP1257892..................... United Kingdom..... Payment HSMs and their
by a program using a digital derived applications.
signature.
Controlling access to a resource EP1257892..................... Ireland............ Payment HSMs and their
by a program using a digital derived applications.
signature.
Controlling access to a resource US7900239..................... United States of Payment HSMs and their
by a program using a digital America. derived applications.
signature.
----------------------------------------------------------------------------------------------------------------
Software
----------------------------------------------------------------------------------------------------------------
Category Software Field of use for license-back to defendants
----------------------------------------------------------------------------------------------------------------
External API................... SmartCards........ Payment HSMs and their derived applications.
TVD (Remote Admin) Payment HSMs and their derived applications.
CodeSafe....................... CodeSafe v2....... Payment HSMs and their derived applications.
Remote Administration.......... JavaCard Applet... Payment HSMs and their derived applications.
Solo XC Source................. security-processor Payment HSMs and their derived applications.
signing--infra.... Payment HSMs and their derived applications.
----------------------------------------------------------------------------------------------------------------
Schedule 2
Shared Intangible Assets Retained by Thales and Licensed to Acquirer
Software
------------------------------------------------------------------------
Category Software
------------------------------------------------------------------------
Cipher Trust Monitor...................... Cipher Trust Monitor common
code.
Agate.
Augite.
Bauxite.
Cordierite.
Fabric core / Authorizer.
Fabric core / building-block-
template.
Fabric core / crypto.
TD & Fabric Activities.................... Fabric core / protector.
FIDO U2F.
Granite.
OpenID Connect Study.
Phenakite.
Pyrite.
TLS Token Binding Study.
------------------------------------------------------------------------
United States District Court for the District of Columbia
United States of America, Plaintiff, v. Thales S.A. and Gemalto
N.V., Defendants.
Case No.: 1:19-cv-00569-BAH
Judge: Beryl A. Howell
COMPETITIVE IMPACT STATEMENT
Plaintiff United States of America (United States), pursuant to
Section 2(b) of the Antitrust Procedures and Penalties Act (APPA or
Tunney Act), 15 U.S.C. Sec. 16(b)-(h), files this Competitive Impact
Statement relating to the proposed Final Judgment submitted for entry
in this civil antitrust proceeding.
I. NATURE AND PURPOSE OF THE PROCEEDING
Defendant Thales S.A. (Thales) and Defendant Gemalto N.V. (Gemalto)
entered into an agreement, dated December 17, 2017, pursuant to which
Thales would acquire, by means of an all-cash tender offer, all of the
outstanding ordinary shares of Gemalto for approximately $5.64 billion.
The United States filed a civil antitrust Complaint on February 28,
2019, seeking to enjoin the proposed acquisition. The Complaint alleges
that the likely effect of this acquisition would be to substantially
lessen competition in the provision of General Purpose (GP) Hardware
Security Modules (HSMs) in the United States in violation of Section 7
of the Clayton Act, 15 U.S.C. Sec. 18. This loss of competition likely
would result in higher prices for GP HSMs as well as a reduction in
quality, product support, and innovation.
At the same time the Complaint was filed, the United States filed a
Stipulation and Order and proposed Final Judgment, which are designed
to eliminate the anticompetitive effects of the acquisition. Under the
proposed Final Judgment, which is explained more fully below,
Defendants are required to make certain divestures for the purpose of
remedying the loss of competition in the U.S. market for GP HSMs that
would have resulted from the merger. Under the terms of the Stipulation
and Order, Defendants will take certain steps to ensure that the
divested GP HSM Products business is operated as a competitively
independent, economically viable and ongoing business concern, that
will remain independent and uninfluenced by the consummation of the
acquisition, and that competition is maintained during the pendency of
the ordered divestiture. The United States and Defendants have
stipulated that the proposed Final Judgment may be entered after
compliance with the APPA. Entry of the proposed Final Judgment would
terminate this action, except that the Court would retain jurisdiction
to construe, modify, or enforce the provisions of the proposed Final
Judgment and to punish violations thereof.
II. DESCRIPTION OF THE EVENTS GIVING RISE TO THE ALLEGED VIOLATION
A. The Defendants and the Proposed Transaction
Thales is an international company incorporated in France with its
principal office in Paris. Thales is active globally in five main
industries: (i)
[[Page 8758]]
aeronautics; (ii) space; (iii) ground transportation; (iv) defense; and
(v) security. In 2017, it had global revenue of approximately $19.6
billion, operations in fifty-six countries, and approximately 65,100
employees. Thales eSecurity is a business unit of Thales that primarily
encompasses three legal entities: (1) Thales eSecurity Inc. (based in
the United States with offices in Plantation, Florida; San Jose,
California; and Boston, Massachusetts); (2) Thales UK Ltd. (based in
the United Kingdom); and (3) Thales Transport & Security HK Ltd. (based
in Hong Kong). Thales eSecurity specializes in developing, marketing,
and selling data security products, including but not limited to GP
HSMs, payment HSMs, and encryption and key management software and
hardware.
Thales sells GP HSMs to customers worldwide, including government
and commercial organizations throughout the United States. In 2008,
Thales acquired nCipher, a company that specialized in cryptographic
security and sold, among other things, GP HSMs under the brand name
nCipher. After that acquisition, Thales changed the brand name of those
GP HSMs to nShield. To resolve the United States' concerns in this
matter, and pursuant to commitments made to the European Commission on
November 7, 2018, Thales has agreed to divest its nShield business. As
part of the commitments to the European Commission, Thales has already
separated the nShield business and related assets and personnel from
the rest of its businesses and appointed a hold separate manager whose
responsibility it is to manage the nShield business as a distinct and
separate entity from the businesses retained by Thales until the
divestiture is completed. This new business unit is operating under the
name nCipher Security.
Gemalto is an international digital security company incorporated
in the Netherlands with its principal office in Amsterdam. Gemalto is
active globally in providing authentication and data protection
technology, platforms, and services in five main areas: (i) banking and
payment; (ii) enterprise and cybersecurity; (iii) government; (iv)
mobile; and (v) machine-to-machine Internet of Things. In 2017, Gemalto
had global revenue of approximately $3.7 billion, operations in forty-
eight countries, and approximately 15,000 employees. Gemalto develops,
markets, and sells GP HSMs, as well as other security solutions and
services, including but not limited to payment HSMs and encryption and
key management software and hardware. In the United States, Gemalto
sells its products and services primarily through SafeNet, Inc. (based
in Belcamp, Maryland), SafeNet Assured Technologies, LLC (based in
Abingdon, Maryland), and Gemalto Inc. (based in Austin, Texas). Gemalto
sells GP HSMs to customers worldwide, including government and
commercial organizations throughout the United States, under the brand
name SafeNet Luna.
The proposed acquisition of Gemalto by Thales, as initially agreed
to by Defendants on December 17, 2017, would lessen competition
substantially in the U.S. market for GP HSMs. This acquisition is the
subject of the Complaint and proposed Final Judgment filed by the
United States on February 28, 2019.
B. The Competitive Effects of the Transaction on the Market for GP HSMs
GP HSMs are tamper-resistant hardware environments for secure
encryption processing and key management. They are most frequently
included as components of complex encryption solutions used by
government and private organizations to safeguard their most sensitive
data. The universe of sensitive electronic data has been expanding
rapidly and relates to a wide range of subjects, such as personally
identifiable information, health records, financial information, tax
records, trade secrets, software code, and other confidential
information. Inappropriate use, theft, corruption, or disclosure of
this data could result in significant harm to an organization's
customers or constituents and the organization itself.
Organizations increasingly rely on encryption as a crucial
component of the security measures implemented to safeguard sensitive
data from internal and external threats. Encryption is a process that
converts readable data (plain text) into an unreadable format (cipher
text) using an algorithm and an encryption key. Decryption is the
reverse of encryption, converting cipher text back to plain text.
Encryption algorithms are based on highly complex math and are often
standardized and open source.
Encryption keys consist of a randomly generated series of numbers.
Because encrypted data is virtually impossible to decipher using
today's technology without the encryption key, attackers who want
unauthorized access to sensitive data generally focus their efforts on
obtaining those encryption keys. With the right key, an attacker can
freely access an organization's sensitive data. Conversely, a lost or
corrupted key could make encrypted data unrecoverable by the
organization. Organizations therefore must implement processes that
safeguard against improper use of the encryption keys while
simultaneously ensuring they are readily available when required for
authorized use.
GP HSMs provide the most secure way for organizations to
effectively manage and protect their encryption keys, and many
organizations use them to protect their most sensitive data. Key
management functionality is also available from software-based
solutions. While these software solutions are generally less expensive
than GP HSMs, GP HSMs are more secure. GP HSMs provide additional
security, in part, because they are isolated from the rest of the
organization's IT system. Use of GP HSMs is often required by
regulations, industry standards, or an organization's auditors or
security policies.
GP HSMs are typically validated by independent testing
organizations to confirm they meet certain specified levels of
security; software-based key systems, by contrast, are not able to meet
the most stringent levels of security.
Thales and Gemalto sell GP HSMs and related services directly to
end-user organizations and through resellers who often combine the GP
HSMs with additional security products or services. Thales and Gemalto
also sell GP HSMs to cloud service providers (CSPs) such as Amazon Web
Services and Microsoft Azure, who then sell GP HSM services, or HSM-as-
a-service (HSMaaS), to their cloud customers. There are, however, many
organizations that are reluctant to use HSMaaS because they want more
control over the security of their data. Even if an organization
chooses to use HSMaaS, it may also require an on-premises GP HSM to
provide an additional layer of encryption security.
GP HSMs typically must be integrated into or configured to operate
within an organization's existing IT environment. An organization needs
assurance that a GP HSM will be an effective component of what may be
an already complex data security infrastructure. Because of this, the
GP HSM sales process typically includes a comprehensive exchange of
information between the potential customer organization and GP HSM
supplier.
Once an organization has installed a GP HSM into its IT
infrastructure and is using it to protect its keys and to provide a
secure data encryption environment, any breakdowns or malfunctions in
the GP HSM could not only compromise the sensitive data but
[[Page 8759]]
also jeopardize the organization's ability to perform day-to-day tasks
that are necessary for the organization to carry out its business.
Post-sales customer support and service are therefore essential. Many
customers will not even consider a potential GP HSM supplier who has
not established a strong reputation for providing quality GP HSMs and
continuous and effective post-sales service and support.
Thales and Gemalto are the two leading providers of GP HSMs in the
United States, with market shares of approximately 30% and 36%,
respectively, and a combined market share of approximately 66%.
Together, Thales and Gemalto dominate the GP HSM market in the United
States. As originally proposed, Thales' acquisition of Gemalto would
substantially increase market concentration in an already highly
concentrated market. Acquisitions that reduce the number of competitors
in already concentrated markets tend to to substantially lessen
competition.
Thales' proposed acquisition of Gemalto likely would substantially
lessen competition and harm customers in the U.S. GP HSM market by
eliminating head-to-head competition between the two leading suppliers
in the United States. Thales and Gemalto are each other's closest
competitors for GP HSMs. Thales and Gemalto regularly approve
significant discounts on GP HSMs when competing against each other.
Thales and Gemalto both have strong reputations for high-quality post-
sales service and support. Competition between the two companies has
also spurred innovation in the past. Thales' proposed acquisition of
Gemalto would eliminate this head-to-head competition and reduce
innovation, in addition to significantly increasing concentration in a
highly concentrated market. The acquisition likely would result in
higher prices, lower quality, and reduced supplier choices for
customers.
It is unlikely that any firm would enter the market for GP HSM
sales to customers in the United States in a manner sufficient to
defeat the likely anticompetitive effects of the proposed acquisition.
Successful entry in the development, marketing, sale, and service of GP
HSMs would be difficult, time-consuming, and costly.
Any new entrant would be required to expend significant time and
capital to design and develop a series of GP HSMs that are at least
comparable to Thales' and Gemalto's GP HSM product lines in terms of
functionality and the ability to interoperate with a wide range of
encryption solutions and IT resources. Moreover, a new entrant, as well
as any existing foreign-based GP HSM provider seeking to expand and
become a viable competitor in the supply of GP HSMs for use by
individual organizations in the United States, would need to spend
significant time and effort to demonstrate its ability to provide high-
quality GP HSMs and continuous, high-quality post-sales service in the
United States. It is unlikely that any such entry or expansion effort
would produce an economically viable alternative to the merged firm in
time to counteract the competitive harm likely to result from the
proposed transaction.
As a result of its acquisition of Gemalto, as originally proposed,
Thales would have emerged as the clearly dominant provider of GP HSMs
in the United States with the ability to exercise substantial market
power, increasing the likelihood that Thales could unilaterally
increase prices or reduce its efforts to improve the quality of its
products and services.
III. EXPLANATION OF THE PROPOSED FINAL JUDGMENT
The divestiture requirement of the proposed Final Judgment will
eliminate the anticompetitive effects of the acquisition in the market
for GP HSMs by establishing a new, independent, and economically viable
competitor. The proposed Final Judgment requires Thales, within thirty-
five (35) calendar days after the filing of the Complaint, or five (5)
days after notice of the entry of the Final Judgment by the Court,
whichever is later, to divest, as a viable ongoing business, Thales' GP
HSM Products business. This includes all tangible and intangible assets
primarily related to the production, operation, research, development,
sale, or support of any Thales GP HSM Product.
Further, the proposed Final Judgment specifies the manner in which
shared intangible assets shall be divested. These are assets that are
used or have been under development for use as of January 7, 2019,
which was the date Thales' GP HSM Products business was formally
separated from the rest of Thales, in relation to both (i) Thales' GP
HSM Products business and (ii) Thales' business relating to products
other than GP HSM Products.
The proposed Final Judgment provides that, in the event that
government approvals needed to complete the divestiture have been
timely filed but remain outstanding at the end of the permitted
divesture period, additional, limited extensions may be granted to
allow Defendants and the acquirer time to obtain those approvals.
The proposed Final Judgment also provides that Thales must provide
the Acquirer relevant information to allow the Acquirer to evaluate
whether to make offers of employment to Thales employees, and provides
that Thales must not interfere in any hiring process. Under the terms
of the proposed Final Judgment, the Acquirer may seek to hire
additional employees up to 90 days after they acquire the divested
assets. Thales may not re-hire employees hired by the Acquirer for one
year after the divestiture is complete, and may not specifically
solicit any of those individuals for two years.
The assets must be divested in such a way as to satisfy the United
States in its sole discretion that the operations can and will be
operated by the purchaser as a viable, ongoing business that can
compete effectively to develop, service, and sell GP HSMs to customers
in the United States. Defendants must take all reasonable steps
necessary to accomplish the divestiture quickly and shall cooperate
with prospective purchasers. The proposed Final Judgment also includes
procedures pursuant to which the Acquirer may apply to the United
States for the right to acquire additional assets that would be
materially useful to the divested business, or hire specific additional
personnel, for a limited time after the divesture date.
The proposed Final Judgment provides that Defendants must ensure
that their products continue to interface and interoperate with the
divested GP HSM Products for at least two years. This interoperability
must be provided at cost, and on the same quality (which may be
measured, for example, by reference to speed and frequency of content
transmission, lag time, uptime, database or API synchronization, or
data fields transmitted, exposed, or used) and terms that were provided
at any time since January 1, 2017. Should the Acquirer determine that a
third year of interoperability is necessary, it may request that this
provision be extended an additional year.
The proposed Final Judgment also provides that Thales must provide
certain transition services to Acquirer, at the Acquirer's request for
a period of one year. The acquirer may request that the United States
allow the period of these transition services to be extended for
another year if necessary.
The proposed Final Judgment provides that Thales must use its best
efforts to ensure that all contracts involving GP HSM Products be
transferred to the Acquirer. When contracts involve both GP HSM
Products and other products, the
[[Page 8760]]
portions of the contracts relating to GP HSM Products will be conveyed.
If Thales is unable to convey any of these contractual rights, the
proposed Final Judgment provides that it will use its best efforts to
make the Acquirer whole.
The proposed Final Judgment also provides that Thales will grant
the Acquirer a covenant not to sue for breach, in the field of GP HSMs,
of any patent held by Thales.
The proposed Final Judgment provides that the United States may
apply to the Court for appointment of a Monitoring Trustee with the
power and authority to investigate and report on the parties'
compliance with the terms of the Final Judgment and Stipulation and
Order filed with the Court for entry during the pendency of the
divestiture. The Monitoring Trustee's duties would include reviewing:
(1) the implementation and execution of a compliance plan to prevent
any misuse of confidential information relating to the divested
business; and (2) any application by the Acquirer for additional
employees or assets.
The Monitoring Trustee will not have any responsibility or
obligation for the operation of the parties' businesses. The Monitoring
Trustee will serve at Defendants' expense, on such terms and conditions
as the United States approves, and Defendants must assist the trustee
in fulfilling its obligations. The Monitoring Trustee will file
semiannual reports and shall serve until the provisions regarding
employees, additional assets, and transition services have expired.
In the event that Defendants do not accomplish the divestiture
within the periods prescribed in the proposed Final Judgment, the
proposed Final Judgment provides that the Court will appoint a
Divestiture Trustee selected by the United States to effect the
divestiture. Defendants will pay all costs and expenses of any such
trustee. After his or her appointment becomes effective, the
Divestiture Trustee will file monthly reports with the Court and the
United States setting forth his or her efforts to accomplish the
divestiture. At the end of six months, if the divestiture has not been
accomplished, the Divestiture Trustee and the United States will make
recommendations to the Court, which shall enter such orders as
appropriate, in order to carry out the purpose of the trust, including
extending the trust or the term of the Divestiture Trustee's
appointment.
The proposed Final Judgment contains provisions to require, for
five years, that Defendants refrain from using any Confidential
Information that they possess about the GP HSM Products business,
except for certain permitted uses. Defendants must prepare a compliance
plan to promote the success of these provisions and regularly report to
the Division whether there has been a breach.
The proposed Final Judgment also contains provisions that require
Defendants to report to the Division subsequent transactions that are
related to GP HSMs, if those transactions otherwise would not be
reportable under the Hart-Scott-Rodino Antitrust Improvements Act of
1976, as amended, 15 U.S.C. Sec. 18a.
The proposed Final Judgment also contains provisions designed to
promote compliance and make the enforcement of Division consent decrees
as effective as possible. Paragraph XVI(A) provides that the United
States retains and reserves all rights to enforce the provisions of the
proposed Final Judgment, including its rights to seek an order of
contempt from the Court. Under the terms of this paragraph, Defendants
have agreed that in any civil contempt action, any motion to show
cause, or any similar action brought by the United States regarding an
alleged violation of the Final Judgment, the United States may
establish the violation and the appropriateness of any remedy by a
preponderance of the evidence and that Defendants have waived any
argument that a different standard of proof should apply. This
provision aligns the standard for compliance obligations with the
standard of proof that applies to the underlying offense that the
compliance commitments address.
Paragraph XVI(B) provides additional clarification regarding the
interpretation of the provisions of the proposed Final Judgment. The
proposed Final Judgment was drafted to restore all competition that
would otherwise be harmed by the merger. Defendants agree that they
will abide by the proposed Final Judgment, and that they may be held in
contempt of this Court for failing to comply with any provision of the
proposed Final Judgment that is stated specifically and in reasonable
detail, as interpreted in light of this procompetitive purpose.
Paragraph XVI(C) of the proposed Final Judgment provides that
should the Court find in an enforcement proceeding that Defendants have
violated the Final Judgment, the United States may apply to the Court
for a one-time extension of the Final Judgment, together with such
other relief as may be appropriate. In addition, in order to compensate
American taxpayers for any costs associated with the investigation and
enforcement of violations of the proposed Final Judgment, Paragraph
XIV(C) provides that in any successful effort by the United States to
enforce the Final Judgment against a Defendant, whether litigated or
resolved prior to litigation, that Defendant agrees to reimburse the
United States for attorneys' fees, experts' fees, or costs incurred in
connection with any enforcement effort, including the investigation of
the potential violation.
Finally, Section XVII of the proposed Final Judgment provides that
the Final Judgment shall expire ten (10) years from the date of its
entry, except that after five (5) years from the date of its entry, the
Final Judgment may be terminated upon notice by the United States to
the Court and Defendants that the divestitures have been completed and
that the continuation of the Final Judgment is no longer necessary or
in the public interest.
The divestiture provisions of the proposed Final Judgment will
eliminate the anticompetitive effects of the acquisition in the
provision of GP HSMs.
IV. REMEDIES AVAILABLE TO POTENTIAL PRIVATE LITIGANTS
Section 4 of the Clayton Act, 15 U.S.C. Sec. 15, provides that any
person who has been injured as a result of conduct prohibited by the
antitrust laws may bring suit in federal court to recover three times
the damages the person has suffered, as well as costs and reasonable
attorneys' fees. Entry of the proposed Final Judgment will neither
impair nor assist the bringing of any private antitrust damage action.
Under the provisions of Section 5(a) of the Clayton Act, 15 U.S.C.
Sec. 16(a), the proposed Final Judgment has no prima facie effect in
any subsequent private lawsuit that may be brought against Defendants.
V. PROCEDURES AVAILABLE FOR MODIFICATION OF THE PROPOSED FINAL JUDGMENT
The United States and Defendants have stipulated that the proposed
Final Judgment may be entered by the Court after compliance with the
provisions of the APPA, provided that the United States has not
withdrawn its consent. The APPA conditions entry upon the Court's
determination that the proposed Final Judgment is in the public
interest.
The APPA provides a period of at least sixty (60) days preceding
the effective date of the proposed Final Judgment within which any
person may submit to the United States written comments regarding the
proposed Final Judgment. Any person who wishes to comment should do so
within sixty (60) days of the date of publication of this Competitive
Impact Statement in the
[[Page 8761]]
Federal Register, or the last date of publication in a newspaper of the
summary of this Competitive Impact Statement, whichever is later. All
comments received during this period will be considered by the United
States Department of Justice, which remains free to withdraw its
consent to the proposed Final Judgment at any time prior to the Court's
entry of judgment. The comments and the response of the United States
will be filed with the Court. In addition, comments will be posted on
the United States Department of Justice, Antitrust Division's internet
website and, under certain circumstances, published in the Federal
Register.
Written comments should be submitted to:
Aaron Hoag
Chief, Technology and Financial Services Section
Antitrust Division
United States Department of Justice
450 Fifth Street, N.W., Room 7100
Washington, DC 20530
The proposed Final Judgment provides that the Court retains
jurisdiction over this action, and the parties may apply to the Court
for any order necessary or appropriate for the modification,
interpretation, or enforcement of the Final Judgment.
VI. ALTERNATIVES TO THE PROPOSED FINAL JUDGMENT
The United States considered, as an alternative to the proposed
Final Judgment, a full trial on the merits against Defendants. The
United States could have continued the litigation and sought
preliminary and permanent injunctions against Thales' acquisition of
Gemalto. The United States is satisfied, however, that the divestiture
of assets described in the proposed Final Judgment will preserve
competition for the provision of GP HSMs in the United States. Thus,
the proposed Final Judgment would achieve all or substantially all of
the relief the United States would have obtained through litigation,
but avoids the time, expense, and uncertainty of a full trial on the
merits of the Complaint.
VII. STANDARD OF REVIEW UNDER THE APPA FOR THE PROPOSED FINAL JUDGMENT
The Clayton Act, as amended by the APPA, requires that proposed
consent judgments in antitrust cases brought by the United States be
subject to a 60-day comment period, after which the court shall
determine whether entry of the proposed Final Judgment ``is in the
public interest.'' 15 U.S.C. Sec. 16(e)(1). In making that
determination, the court, in accordance with the statute as amended in
2004, is required to consider:
(A) the competitive impact of such judgment, including termination
of alleged violations, provisions for enforcement and modification,
duration of relief sought, anticipated effects of alternative remedies
actually considered, whether its terms are ambiguous, and any other
competitive considerations bearing upon the adequacy of such judgment
that the court deems necessary to a determination of whether the
consent judgment is in the public interest; and
(B) the impact of entry of such judgment upon competition in the
relevant market or markets, upon the public generally and individuals
alleging specific injury from the violations set forth in the complaint
including consideration of the public benefit, if any, to be derived
from a determination of the issues at trial.
15 U.S.C. Sec. 16(e)(1)(A) & (B). In considering these statutory
factors, the court's inquiry is necessarily a limited one as the
government is entitled to ``broad discretion to settle with the
defendant within the reaches of the public interest.'' United States v.
Microsoft Corp., 56 F.3d 1448, 1461 (D.C. Cir. 1995); see generally
United States v. SBC Commc'ns, Inc., 489 F. Supp. 2d 1 (D.D.C. 2007)
(assessing public interest standard under the Tunney Act); United
States v. U.S. Airways Group, Inc., 38 F. Supp. 3d 69, 75 (D.D.C. 2014)
(explaining that the ``court's inquiry is limited'' in Tunney Act
settlements); United States v. InBev N.V./S.A., No. 08-1965 (JR), 2009
U.S. Dist. LEXIS 84787, at *3 (D.D.C. Aug. 11, 2009) (noting that the
court's review of a consent judgment is limited and only inquires
``into whether the government's determination that the proposed
remedies will cure the antitrust violations alleged in the complaint
was reasonable, and whether the mechanism to enforce the final judgment
are clear and manageable'').
As the United States Court of Appeals for the District of Columbia
Circuit has held, under the APPA a court considers, among other things,
the relationship between the remedy secured and the specific
allegations in the government's complaint, whether the decree is
sufficiently clear, whether its enforcement mechanisms are sufficient,
and whether the decree may positively harm third parties. See
Microsoft, 56 F.3d at 1458-62. With respect to the adequacy of the
relief secured by the decree, a court may not ``engage in an
unrestricted evaluation of what relief would best serve the public.''
United States v. BNS, Inc., 858 F.2d 456, 462 (9th Cir. 1988) (quoting
United States v. Bechtel Corp., 648 F.2d 660, 666 (9th Cir. 1981)); see
also Microsoft, 56 F.3d at 1460-62; United States v. Alcoa, Inc., 152
F. Supp. 2d 37, 40 (D.D.C. 2001); InBev, 2009 U.S. Dist. LEXIS 84787,
at *3. Instead:
[t]he balancing of competing social and political interests affected
by a proposed antitrust consent decree must be left, in the first
instance, to the discretion of the Attorney General. The court's
role in protecting the public interest is one of insuring that the
government has not breached its duty to the public in consenting to
the decree. The court is required to determine not whether a
particular decree is the one that will best serve society, but
whether the settlement is ``within the reaches of the public
interest.'' More elaborate requirements might undermine the
effectiveness of antitrust enforcement by consent decree.
Bechtel, 648 F.2d at 666 (emphasis added) (citations omitted).\1\
---------------------------------------------------------------------------
\1\ See also BNS, 858 F.2d at 464 (holding that the court's
``ultimate authority under the [APPA] is limited to approving or
disapproving the consent decree''); United States v. Gillette Co.,
406 F. Supp. 713, 716 (D. Mass. 1975) (noting that, in this way, the
court is constrained to ``look at the overall picture not
hypercritically, nor with a microscope, but with an artist's
reducing glass'').
---------------------------------------------------------------------------
In determining whether a proposed settlement is in the public
interest, a district court ``must accord deference to the government's
predictions about the efficacy of its remedies, and may not require
that the remedies perfectly match the alleged violations.'' SBC
Commc'ns, 489 F. Supp. 2d at 17; see also U.S. Airways, 38 F. Supp. 3d
at 74-75 (noting that a court should not reject the proposed remedies
because it believes others are preferable and that room must be made
for the government to grant concessions in the negotiation process for
settlements); Microsoft, 56 F.3d at 1461 (noting the need for courts to
be ``deferential to the government's predictions as to the effect of
the proposed remedies''); United States v. Archer-Daniels-Midland Co.,
272 F. Supp. 2d 1, 6 (D.D.C. 2003) (noting that the court should grant
``due respect to the government's prediction as to the effect of
proposed remedies, its perception of the market structure, and its
views of the nature of the case''). The ultimate question is whether
``the remedies [obtained in the decree are] so inconsonant with the
allegations charged as to fall outside of the `reaches of the public
interest.' '' Microsoft, 56 F.3d at 1461 (quoting United States v.
Western Elec. Co., 900 F.2d 283, 309 (D.C. Cir. 1990)). To meet this
standard, the United States ``need only provide a
[[Page 8762]]
factual basis for concluding that the settlements are reasonably
adequate remedies for the alleged harms.'' SBC Commc'ns, 489 F. Supp.
2d at 17.
Moreover, the court's role under the APPA is limited to reviewing
the remedy in relationship to the violations that the United States has
alleged in its complaint, and does not authorize the court to
``construct [its] own hypothetical case and then evaluate the decree
against that case.'' Microsoft, 56 F.3d at 1459; see also U.S. Airways,
38 F. Supp. 3d at 75 (noting that the court must simply determine
whether there is a factual foundation for the government's decisions
such that its conclusions regarding the proposed settlements are
reasonable); InBev, 2009 U.S. Dist. LEXIS 84787, at *20 (``the `public
interest' is not to be measured by comparing the violations alleged in
the complaint against those the court believes could have, or even
should have, been alleged''). Because the ``court's authority to review
the decree depends entirely on the government's exercising its
prosecutorial discretion by bringing a case in the first place,'' it
follows that ``the court is only authorized to review the decree
itself,'' and not to ``effectively redraft the complaint'' to inquire
into other matters that the United States did not pursue. Microsoft, 56
F.3d at 1459-60.
In its 2004 amendments,\2\ Congress made clear its intent to
preserve the practical benefits of utilizing consent decrees in
antitrust enforcement, adding the unambiguous instruction that
``[n]othing in this section shall be construed to require the court to
conduct an evidentiary hearing or to require the court to permit anyone
to intervene.'' 15 U.S.C. Sec. 16(e)(2); see also U.S. Airways, 38 F.
Supp. 3d at 76 (indicating that a court is not required to hold an
evidentiary hearing or to permit intervenors as part of its review
under the Tunney Act). This language explicitly wrote into the statute
what Congress intended when it first enacted the Tunney Act in 1974. As
Senator Tunney explained: ``[t]he court is nowhere compelled to go to
trial or to engage in extended proceedings which might have the effect
of vitiating the benefits of prompt and less costly settlement through
the consent decree process.'' 119 Cong. Rec. 24,598 (1973) (statement
of Sen. Tunney). Rather, the procedure for the public interest
determination is left to the discretion of the court, with the
recognition that the court's ``scope of review remains sharply
proscribed by precedent and the nature of Tunney Act proceedings.'' SBC
Commc'ns, 489 F. Supp. 2d at 11. A court can make its public interest
determination based on the competitive impact statement and response to
public comments alone. U.S. Airways, 38 F. Supp. 3d at 76. See also
United States v. Enova Corp., 107 F. Supp. 2d 10, 17 (D.D.C. 2000)
(noting that the ``Tunney Act expressly allows the court to make its
public interest determination on the basis of the competitive impact
statement and response to comments alone''); S. Rep. No. 93-298 93d
Cong., 1st Sess., at 6 (1973) (``Where the public interest can be
meaningfully evaluated simply on the basis of briefs and oral
arguments, that is the approach that should be utilized.'').
---------------------------------------------------------------------------
\2\ The 2004 amendments substituted ``shall'' for ``may'' in
directing relevant factors for a court to consider and amended the
list of factors to focus on competitive considerations and to
address potentially ambiguous judgment terms. Compare 15 U.S.C.
Sec. 16(e) (2004), with 15 U.S.C. Sec. 16(e)(1) (2006); see also
SBC Commc'ns, 489 F. Supp. 2d at 11 (concluding that the 2004
amendments ``effected minimal changes'' to Tunney Act review).
---------------------------------------------------------------------------
VIII. DETERMINATIVE DOCUMENTS
There are no determinative materials or documents within the
meaning of the APPA that were considered by the United States in
formulating the proposed Final Judgment.
Dated: February 28, 2019
Respectfully submitted,
Kelly M. Schoolmeester
(D.C. Bar 1008354)
United States Department of Justice, Antitrust Division, Technology
and Financial Services Section, 450 Fifth Street, N.W., Washington,
DC 20530, Phone: (202) 598-2693, Facsimile: (202) 616-8544, Email:
[email protected].
[FR Doc. 2019-04293 Filed 3-8-19; 8:45 am]
BILLING CODE 4410-11-P
