2019-04293. United States v. Thales S.A. and Gemalto N.V.; Proposed Final Judgment and Competitive Impact Statement

Notice is hereby given pursuant to the Antitrust Procedures and Penalties Act, 15 U.S.C. 16(b)-(h), that a proposed Final Judgment, Stipulation, and Competitive Impact Statement have been filed with the United States District Court for the District of Columbia in United States of America v. Thales S.A. and Gemalto N.V., Civil Action No. 1:19-cv-00569-BAH. On February 28, 2019, the United States filed a Complaint alleging that Thales S.A.'s proposed acquisition of Gemalto N.V. would violate Section 7 of the Clayton Act, 15 U.S.C. 18. The proposed Final Judgment, filed at the same time as the Complaint, requires Thales S.A. to divest to an acquirer, subject to the United States' approval, its General Purpose HSM Products business.

Copies of the Complaint, proposed Final Judgment, and Competitive Impact Statement are available for inspection on the Antitrust Division's website at http://www.justice.gov/​atr and at the Office of the Clerk of the United States District Court for the District of Columbia. Copies of these materials may be obtained from the Antitrust Division upon request and payment of the copying fee set by Department of Justice regulations.

Public comment is invited within 60 days of the date of this notice. Such comments, including the name of the submitter, and responses thereto, will be posted on the Antitrust Division's website, filed with the Court, and, under certain circumstances, published in the Federal Register. Comments should be directed to Aaron Hoag, Chief, Technology and Financial Services Section, Antitrust Division, Department of Justice, 450 Fifth Street NW, Suite 7100, Washington, DC 20530 (telephone: [phone]).

Patricia A. Brink,

Director of Civil Enforcement.

United States District Court for the District of Columbia

United States of America, United States Department of Justice Antitrust Division, 450 Fifth Street NW, Suite 7100, Washington, DC 20530, Plaintiff, v. Thales S.A. Tour Carpe Diem, 31 Place des Corolles—CS 20001, 92098 Paris La Defense Cedex, France, and Gemalto N.V. Barbara Strozzilaan 382, Amsterdam, The Netherlands, 1083 HN Defendants.

Case No.: 1:19-cv-00569-BAH

Judge: Beryl A. Howell

COMPLAINT

The United States of America, acting under the direction of the Attorney General of the United States, brings this civil action to enjoin the acquisition of Gemalto N.V. (Gemalto) by Thales S.A. (Thales) and to obtain other equitable relief. The United States alleges as follows:

I. NATURE OF THE ACTION

1. Thales intends to acquire all of the outstanding ordinary shares of Gemalto for approximately $5.64 billion. Thales and Gemalto are the world's leading providers of general purpose (GP) hardware security modules (HSMs) and are significant direct competitors in the United States.

2. Organizations, including corporations and governmental agencies, use GP HSMs to protect their most sensitive data. GP HSMs are hardened, tamper-resistant hardware devices that strengthen data security by, among other things, making encryption key generation and management, data encryption and decryption, and digital signature creation and verification more secure. GP HSMs are used to achieve higher levels of data security and to meet or exceed established and emerging industry and regulatory standards for cybersecurity.

3. Together, Thales and Gemalto dominate the U.S. market for GP HSMs and face limited competition from a few, much smaller rivals. Thales and Gemalto are each other's closest competitors. They compete head-to-head in the development, marketing, service, and sale of GP HSMs. Thales' proposed acquisition of Gemalto would eliminate this competition, resulting in higher prices; lower quality products, support, and service; and reduced innovation.

4. Accordingly, the transaction is likely to substantially lessen competition in the provision of GP HSMs in the United States, in violation of Section 7 of the Clayton Act, 15 U.S.C. § 18, and should be enjoined.

II. DEFENDANTS AND THE PROPOSED ACQUISITION

5. Thales is an international company incorporated in France with its principal office in Paris. Thales is active globally in five main industries: (i) aeronautics; (ii) space; (iii) ground transportation; (iv) defense; and (v) security. In 2017, it had global revenue of approximately $19.6 billion, operations in fifty-six countries, and approximately 65,100 employees. Thales eSecurity is a business unit of Thales. Thales eSecurity primarily encompasses three legal entities: (1) Thales eSecurity Inc. (based in the United States with offices in Plantation, Florida; San Jose, California; and Boston, Massachusetts), (2) Thales UK Ltd. (based in the United Kingdom), and (3) Thales Transport & Security HK Ltd. (based in Hong Kong). Thales eSecurity specializes in developing, marketing, and selling data security products including but not limited to GP HSMs, payment HSMs, and encryption and key management software and hardware. Thales sells GP HSMs to customers worldwide, including government and commercial organizations throughout the United States, under the brand name nShield. In 2008, Thales acquired nCipher, a company that specialized in cryptographic security and sold, among other things, GP HSMs under the brand name nCipher. After that acquisition, Thales changed the brand name of those GP HSMs to nShield.

6. Pursuant to its commitments to the European Commission, entered into on November 7, 2018, Thales has agreed to divest its nShield business. As part of these commitments, Thales has separated the nShield business and related assets and personnel from the rest of its businesses and appointed a hold separate manager whose responsibility it is to manage the nShield business as a distinct and separate entity from the businesses retained by Thales until the divestiture is completed. This new business unit is operating under the name nCipher Security.

7. Gemalto is an international digital security company incorporated in the Netherlands with its principal office in Amsterdam. Gemalto is active globally in providing authentication and data protection technology, platforms, and services in five main areas: (i) banking and payment; (ii) enterprise and cybersecurity; (iii) government; (iv) mobile; and (v) machine-to-machine Internet of Things. In 2017, Gemalto had global revenue of approximately $3.7 billion, operations in forty-eight countries, and approximately 15,000 employees. Gemalto develops, markets, and sells GP HSMs, as well as other security solutions and services including but not limited to payment HSMs and encryption and key management software and hardware. In the United States, Gemalto sells its products and services primarily through SafeNet, Inc. (based in Belcamp, Maryland), SafeNet Assured Technologies, LLC (based in Abingdon, Maryland), and Gemalto Inc. (based in Austin, Texas). Gemalto sells GP HSMs to customers worldwide, including government and commercial organizations throughout the United States, under the brand name SafeNet Luna.

8. On December 17, 2017, Thales and Gemalto entered into an agreement on a recommended all-cash offer by Thales to acquire all of the issued and outstanding ordinary shares of Gemalto for approximately $5.64 billion.

III. JURISDICTION, VENUE, AND INTERSTATE COMMERCE

9. The United States brings this action under Section 15 of the Clayton Act, 15 U.S.C. § 25, to prevent and restrain Defendants from violating Section 7 of the Clayton Act, 15 U.S.C. § 18. This Court has subject-matter jurisdiction over this action under Section 15 of the Clayton Act, 15 U.S.C. § 25, and 28 U.S.C. §§ 1331, 1337(a), and 1345.

10. Defendants market, sell, and service their products, including their GP HSMs, throughout the United States and regularly and continuously transact business and transmit data in connection with these activities in the flow of interstate commerce, which has a substantial effect upon interstate commerce.

11. Defendants consent to personal jurisdiction and venue in this district. This Court has personal jurisdiction over each Defendant and venue is proper under Section 12 of the Clayton Act, 15 U.S.C. § 22, and 28 U.S.C. § 1391(b) and (c).

IV. THE RELEVANT MARKET

A. Industry Background

12. Many U.S. organizations, including commercial enterprises and government agencies, use, transmit, and maintain sensitive electronic data. The universe of sensitive electronic data has been expanding rapidly and relates to a wide range of subjects, such as personally identifiable information, classified information, health records, financial information, tax records, trade secrets and other confidential business information, software code, and other nonpublic information. Access to this data is often critical to an organization's ability to operate effectively and efficiently. Inappropriate use, theft, corruption, or disclosure of this data could result in significant harm to an organization's customers or constituents and the organization itself.

13. U.S. organizations increasingly rely on encryption as a crucial component of the security measures implemented to safeguard sensitive data from internal and external threats. Encryption is a process that converts readable data (plain text) into an unreadable format (cipher text) using an algorithm and an encryption key. Decryption is the reverse of encryption, converting cipher text back to plain text. Encryption algorithms are based on highly complex math and are often standardized and open source. Encryption keys consist of a randomly generated series of numbers or pairs of randomly generated prime numbers, expressed in bits. Because encryption algorithms are virtually impossible to decipher using today's technology, attackers who want unauthorized access to sensitive data generally focus their efforts on obtaining private encryption keys instead of trying to break the encryption algorithm directly. With the right key, an attacker can freely access an organization's sensitive data. Moreover, a lost or corrupted key could make encrypted data unrecoverable by the organization. Organizations therefore must implement processes and products that create, maintain, protect, and control their encryption keys in a manner that safeguards against improper access or use while simultaneously ensuring the keys are readily available when required for authorized use.

14. GP HSMs provide the most secure way for organizations to effectively manage and protect their encryption keys, and many U.S. organizations use them to protect their most sensitive data. GP HSMs are tamper-resistant hardware environments for secure encryption processing and key management. GP HSMs provide additional security as compared to software-based key management solutions because they are isolated from the host information technology (IT) environment and segregate encryption keys from encrypted data and encryption applications. GP HSMs also enable organizations to implement strong authentication regimes for key management administrators that prevent unauthorized access.

15. GP HSMs are typically independently validated to confirm they provide a level of security specified by various standards. Certifications of compliance with these standards provides assurance to customers that GP HSMs satisfy certain minimum security performance benchmarks. For example, U.S. GP HSM customers frequently rely on the Federal Information Processing Standard (FIPS) 140-2 to assess the level of security provided by a particular GP HSM. FIPS 140-2 is a standard defined by the U.S. National Institute of Standards, which is part of the U.S. Department of Commerce. The standard is mandatory for U.S. government IT security systems that use cryptographic modules to protect sensitive but unclassified information. Commercial enterprises also rely heavily on the standard to assess the security provided by cryptographic modules. FIPS 140-2 comprises four increasing, qualitative levels of security—Levels 1 through 4—for cryptographic modules used to protect sensitive information. Cryptographic modules go through an expensive and time consuming testing process in order to be validated at a particular FIPS 140-2 level. Although software-only modules can be validated under FIPS 140-2, due to increasingly stringent security requirements, organizations must use an HSM to attain Level 3 security. Thales and Gemalto both provide highly secure GP HSMs that have been validated at FIPS 140-2, Level 3.

16. Thales and Gemalto sell GP HSMs and related services directly to end-user organizations, to resellers who often combine the GP HSMs with additional security products or services, and to cloud service providers (CSPs) who then sell GP HSM services, or HSM-as-a-service (HSMaaS), to their cloud customers. The leading CSPs purchase GP HSMs from third-party suppliers, including Thales and Gemalto.

17. There are, however, many organizations that are reluctant to move their sensitive data to the cloud and use HSMaaS because of security concerns. These organizations continue to rely, to at least some degree, on purchasing and using their own GP HSMs to protect their sensitive data.

18. GP HSMs typically must be integrated into or configured to operate within an organization's existing IT environment. An organization needs assurance that a GP HSM will be an effective component of what may be an already complex data security infrastructure. Because of this, the GP HSM sales process typically includes a comprehensive exchange of information between the potential customer organization and GP HSM supplier.

19. Once an organization has installed a GP HSM into its IT environment and is using it to protect its keys and to provide a secure data encryption environment, any breakdowns or malfunctions in the GP HSM could not only compromise the sensitive data but also jeopardize the organization's ability to perform day-to-day tasks that are necessary for the organization to carry out its business. Post-sales customer support and service are therefore essential conduct carried out by successful GP HSM suppliers. Many customers will not even consider a potential GP HSM supplier who has not established a strong reputation for providing quality GP HSMs and continuous and effective post-sales service and support. Thales and Gemalto both have strong reputations for high-quality post-sales service and support. Thales and Gemalto provide this service and support to their direct customers and indirectly to other customers by assisting their resellers.

20. Thales and Gemalto both create and maintain confidential price lists for their respective GP HSMs, additional GP HSM components and accessories, and services. Confidential discount rates are then applied to the price list to determine the prices that are applicable to resellers. Thales and Gemalto authorize, customer-by-customer, confidential discounts from the prices on the price list, and in the case of resellers, additional discounts to the discounted prices already available to the reseller. Thales and Gemalto regularly approve significant discounts on GP HSMs when competing against each other.

B. Relevant Market

21. GP HSMs are most frequently included as components of complex encryption solutions used by government and private organizations to safeguard their most sensitive data. Use of GP HSMs is often specified by regulations, industry standards, or an organization's auditors or security policies, or is otherwise deemed necessary to safeguard the organization's most sensitive data or provide the organization's customers or constituents with confidence that their sensitive data will be adequately protected. Organizations that use GP HSMs have determined that less expensive alternatives to GP HSMs, such as software-based key management solutions, provide inadequate security for their most sensitive data. Some organizations will not even use cloud-based GP HSMaaS, and, if they do, will require an on-premises GP HSM to provide an additional layer of encryption security for encryption keys stored in a cloud-based GP HSM. Many customers are unwilling to entrust the protection of their most sensitive data to HSMaaS provided by a CSP. In order to provide HSMaaS to those customers that are willing to outsource at least some their GP HSM needs, CSPs purchase GP HSMs from the Defendants and the Defendants' GP HSM competitors.

22. Defendants market, sell, and service GP HSMs for use by organizations across the United States. Because GP HSMs are used to protect an organization's most sensitive data, U.S. customers require GP HSM suppliers to possess the demonstrated ability to provide both high-quality GP HSMs and high-quality post-sales service and support in the United States.

23. A hypothetical GP HSM monopolist could profitably impose a small but significant and non-transitory increase in price on GP HSM customers in the United States. Accordingly, GP HSMs sold to U.S. customers is a relevant market for purposes of analyzing the likely competitive effects of the proposed acquisition under Section 7 of the Clayton Act, 15 U.S.C. § 18.

V. ANTICOMPETITIVE EFFECTS OF THE PROPOSED ACQUISITION

24. Together, Thales and Gemalto dominate the GP HSM market in the United States. Thales and Gemalto are the two leading providers of GP HSMs in the United States, with individual market shares of approximately 30% and 36%, respectively, and a combined market share of approximately 66%. Thales' proposed acquisition of Gemalto likely would substantially lessen competition and harm customers in the U.S. GP HSM market by eliminating head-to-head competition between the two leading suppliers in the United States. The acquisition likely would result in higher prices, lower quality, reduced choice, and reduced innovation. Thales' proposed acquisition of Gemalto would substantially increase market concentration in an already highly concentrated market. The proposed acquisition violates Section 7 of the Clayton Act.

25. Thales and Gemalto currently compete head-to-head and their respective GP HSMs are each other's closest substitutes. Thales and Gemalto regularly approve significant discounts on GP HSMs when competing against each other. Competition between the two companies has also spurred innovation in the past. Thales' proposed acquisition of Gemalto would eliminate this head-to-head competition and reduce innovation, in addition to significantly increasing concentration in a highly concentrated market. As a result, Thales would emerge as the clearly dominant provider of GP HSMs in the United States with the ability to exercise substantial market power, increasing the likelihood that Thales could unilaterally increase prices or reduce its efforts to improve the quality of its products and services.

VI. ABSENCE OF COUNTERVAILING FACTORS

26. It is unlikely that any firm would enter the relevant product and geographic markets alleged herein in a timely manner sufficient to defeat the likely anticompetitive effects of the proposed acquisition. Successful entry in the development, marketing, sale, and service of GP HSMs is difficult, time-consuming, and costly.

27. Any new entrant would be required to expend significant time and capital to design and develop a series of GP HSMs that are at least comparable to Defendants' GP HSM product lines in terms of functionality and ability to interoperate with a wide range of encryption solutions and IT resources. Moreover, a new entrant, as well as any existing GP HSM provider seeking to expand and become a viable competitor in the supply of GP HSMs for use by individual organizations in the United States in on-premises security solutions, would need to spend significant time and effort to demonstrate its ability to provide quality GP HSMs for such use and continuous, high-quality post-sales service in the United States. It is unlikely that any such entry or expansion effort would produce an economically viable alternative to the merged firm in time to counteract the competitive harm likely to result from the proposed transaction.

28. Defendants cannot demonstrate merger-specific, verifiable efficiencies sufficient to offset the proposed merger's likely anticompetitive effects.

VII. VIOLATION ALLEGED

29. The United States incorporates the allegations of paragraphs 1 through 28 above.

30. The proposed acquisition of Gemalto by Thales is likely to substantially lessen competition for the development and supply of GP HSMs in the United States in violation of Section 7 of the Clayton Act, 15 U.S.C. § 18.

31. Unless enjoined, the proposed acquisition likely will have the following anticompetitive effects, among others:

(a) actual and potential competition between Thales and Gemalto in the development, sale, and service of GP HSMs in the United States will be eliminated;

(b) competition in the development, sale, and service of GP HSMs in the United States in general will be substantially lessened;

(c) prices of GP HSMs will increase;

(d) improvements or upgrades to the quality or functionality of GP HSMs will be less frequent and less substantial;

(e) the quality of service for GP HSMs will decline; and

(f) organizations in the United States that require GP HSMs for use in on-premises security solutions will be especially vulnerable to an exercise of market power by the merged firm.

VIII. REQUEST FOR RELIEF

32. The United States requests that this Court:

(a) adjudge and decree that Thales' proposed acquisition of Gemalto would be unlawful and would violate Section 7 of the Clayton Act, 15 U.S.C. § 18;

(b) permanently enjoin and restrain Defendants and all persons acting on their behalf from carrying out the December 17, 2017, agreement on a recommended all-cash offer by Thales to acquire all of the issued and outstanding ordinary shares of Gemalto, or from entering into or carrying out any other contract, agreement, plan, or understanding, or taking any other action, to combine Thales and Gemalto;

(c) award the United States its costs for this action; and

(d) award the United States such other and further relief as this Court deems just and proper.

Dated: February 28, 2019

Respectfully submitted,

FOR PLAINTIFF UNITED STATES OF AMERICA:

Makan Delrahim (D.C. Bar # 457795),

Assistant Attorney General for Antitrust.

Bernard A. Nigro, Jr. (D.C. Bar # 412357),

Deputy Assistant Attorney General.

Patricia A. Brink,

Director of Civil Enforcement.

Aaron D. Hoag,

Chief, Technology and Financial Services.

Danielle G. Hauck,

Adam T. Severt,

Assistant Chiefs, Technology and Financial Services Section.

Kelly M. Schoolmeester,

(D.C. Bar # 1008354),

Maureen T. Casey,

(D.C. Bar # 415893)

(D.C. Bar # 1019454),

Chinita M. Sinkler,

Bindi R. Bhagat,

Cory Brader Leuchten,

R. Cameron Gower,

Ryan T. Karr,

David J. Shaw, (D.C. Bar # 996525),

Aaron Comenetz, (D.C. Bar # 479572),

Kent Brown,

Attorneys for the United States, United States Department of Justice, Antitrust Division, 450 Fifth Street, NW, Suite 7100, Washington, D.C. 20530, Tel.: [phone], Fax: [phone], Email: [e-mail].

United States District Court for the District of Columbia

United States of America, Plaintiff, v. Thales S.A. and Gemalto N.V., Defendants.

Case No.: 1:19-cv-00569-BAH

Judge: Beryl A. Howell

PROPOSED FINAL JUDGMENT

WHEREAS, Plaintiff, United States of America, filed its Complaint on February 28, 2019, the United States and Defendants, Thales S.A. and Gemalto N.V., by their respective attorneys, have consented to the entry of this Final Judgment without trial or adjudication of any issue of fact or law and without this Final Judgment constituting any evidence against or admission by any party regarding any issue of fact or law;

AND WHEREAS, Defendants agree to be bound by the provisions of this Final Judgment pending its approval by the Court;

AND WHEREAS, the essence of this Final Judgment is the prompt and certain divestiture of certain rights or assets by Defendants to assure that competition is not substantially lessened;

AND WHEREAS, the United States requires Defendants to make certain divestitures for the purpose of remedying the loss of competition alleged in the Complaint;

AND WHEREAS, Defendants have represented to the United States that the divestitures required below can and will be made and that Defendants will later raise no claim of hardship or difficulty as grounds for asking the Court to modify any of the divestiture provisions contained below;

NOW THEREFORE, before any testimony is taken, without trial or adjudication of any issue of fact or law, and upon consent of the parties, it is ORDERED, ADJUDGED, AND DECREED:

I. JURISDICTION

This Court has jurisdiction over the subject matter of and each of the parties to this action. The Complaint states a claim upon which relief may be granted against Defendants under Section 7 of the Clayton Act, as amended (15 U.S.C. § 18).

II. DEFINITIONS

As used in this Final Judgment:

A. “Acquirer” means the entity to whom Defendants divest the Divestiture Assets.

B. “Thales” means Defendant Thales S.A., a French corporation with its principal office in Paris, France; its successors and assigns; and its subsidiaries, divisions, groups, affiliates, partnerships, and joint ventures, and their directors, officers, managers, agents, and employees.

C. “Gemalto” means Defendant Gemalto N.V., a Netherlands corporation with its headquarters in Amsterdam; its successors and assigns; and its subsidiaries, divisions, groups, affiliates, partnerships, and joint ventures, and their directors, officers, managers, agents, and employees.

D. “Defendants” means Thales and Gemalto, acting individually or collectively.

E. “Transaction” means Thales' acquisition of Gemalto through a public offer by Thales for all issued and outstanding ordinary shares of Gemalto pursuant to the Merger Agreement between Thales and Gemalto dated December 17, 2017.

F. “Confidential Information” means non-public information related to the Divestiture Assets.

G. “Divestiture Assets” means Thales' GP HSM Products business, including:

(1) all tangible assets primarily related to the production, operation, research, development, sale, or support of any GP HSM Product, including but not limited to manufacturing equipment, tooling and fixed assets, computers, tapes, disks, other storage devices, other IT hardware, equipment used in research and development, testing equipment, tools used in design or simulation, personal property, inventory, office furniture, materials, supplies, and other tangible property;

(2) all Shared Intangible Assets; and

(3) all other intangible assets primarily related to the production, operation, research, development, sale, or support of any GP HSM Product, including but not limited to (i) licenses, permits, certifications, and authorizations issued by any governmental organization; contracts or portions of contracts, teaming arrangements, agreements, leases, commitments, certifications, and understandings, including supply agreements; customer lists, histories, contracts, accounts, and credit records; repair and performance records; documentation relating to software development and changes; manuals and technical information Defendants provide to their own employees, customers, suppliers, agents, or licensees; data and records relating to historic and current research and development efforts, including but not limited to designs of experiments and the results of successful and unsuccessful experiments; records relating to designs or simulations, safety procedures for the handling of materials and substances, and quality assurance and control procedures; and other records; and (ii) intellectual property rights, including but not limited to patents, licenses and sublicenses, copyrights, trademarks, trade names, service marks, service names, technical information, computer software and related documentation, know-how, trade secrets, drawings, blueprints, designs, design protocols, specifications for materials, and specifications for parts and devices (but not including the name “THALES” in any trademark, domain name, trade name, or service).

The Divestiture Assets include but are not limited to: CodeSafe, nShield Remote Administration, nShield Bring Your Own Key, Key Authority (at the option of Acquirer), and Security World Architecture and monitoring tool nShield Monitor. The Divestiture Assets do not include any assets owned by Gemalto prior to the closing of the Transaction.

H. “Divestiture Closing Date” means the date on which Thales divests the Divestiture Assets to Acquirer.

I. “GP HSM Product” means a hardened, tamper-resistant general purpose hardware security module and includes all add-ons, value-added features, and accessories. “GP HSM Product” does not include the Vormetric Data Security Manager, but does include any GP HSM Product that is incorporated into or otherwise used with the Vormetric Data Security Manager.

J. “Regulatory Approvals” means any approvals or clearances pursuant to filings with the Committee on Foreign Investments in the United States (“CFIUS”), or under antitrust, competition, or other U.S. or international laws in connection with Acquirer's acquisition of the Divestiture Assets.

K. “Relevant Personnel” means all Thales employees who have supported or whose job related to the Divestiture Assets at any time between July 1, 2017 and the Divestiture Closing Date.

L. “Retained Solution” means any solution that is sold by Defendants, including but not limited to Vormetric Data Security Manager, Vormetric Transparent Encryption, CipherTrust Cloud Key Manager, SafeNet KeySecure, SafeNet Virtual KeySecure, SafeNet ProtectApp, and any upgrades, revisions, or new versions of any such solutions, in each case solely to the extent such solution has interfaced or interoperated with any of the Divestiture Assets at any time since January 1, 2017.

M. “Shared Intangible Assets” means intangible assets that are used, or have been under development for use as of January 7, 2019, in relation to (i) Thales' GP HSM Products business and (ii) Thales' business relating to products other than GP HSM Products.

III. APPLICABILITY

A. This Final Judgment applies to Thales and Gemalto, as defined above, and all other persons in active concert or participation with any of them who receive actual notice of this Final Judgment by personal service or otherwise.

B. If, prior to complying with Section IV and Section V of this Final Judgment, Defendants sell or otherwise dispose of all or substantially all of their assets or of lesser business units that include the Divestiture Assets, Defendants shall require the purchaser to be bound by the provisions of this Final Judgment. Defendants need not obtain such an agreement from the acquirer of the assets divested pursuant to this Final Judgment.

IV. DIVESTITURES

A. Defendants are ordered and directed, within thirty-five (35) calendar days following the signing by the parties of the Stipulation and Order in this matter or five (5) calendar days after the notice of entry of this Final Judgment by the Court, whichever is later, to divest the Divestiture Assets to Acquirer in a manner consistent with this Final Judgment. The United States, in its sole discretion, may agree to one or more extensions of this time period and shall notify the Court in such circumstances. If Acquirer, and/or Defendants, as applicable, have initiated contact with any governmental unit to seek any Regulatory Approval within five (5) calendar days after the United States provides written notice pursuant to Paragraph VI(C) that it does not object to the proposed Acquirer, the period shall be extended (if necessary) until fifteen (15) calendar days after such Regulatory Approval is received. The extension allowed for Regulatory Approvals shall be no longer than ninety (90) calendar days, unless further extended by the United States, in its sole discretion. Nothing in this section shall require Defendants to divest the Divestiture Assets earlier than five (5) calendar days after the closing of the Transaction. Defendants agree to use their best efforts to divest the Divestiture Assets as expeditiously as possible.

B. For Divestiture Assets that are Shared Intangible Assets, the divestiture shall be completed in the following manner:

(1) For each Shared Intangible Asset listed on Schedule 1 and any other Shared Intangible Asset that has been used, or has been under development for use, primarily in relation to Thales' GP HSM Products business, Thales shall transfer or otherwise assign to Acquirer all of Thales' ownership interest or other rights in the Shared Intangible Asset, and (a) for any asset listed on Schedule 1, Acquirer shall provide Defendants a non-exclusive, perpetual, worldwide, fully paid-up license to use (or, at the Acquirer's option, a covenant not to sue Defendants for using) the asset in the manner specified on Schedule 1, and (b) for any other Shared Intangible Asset transferred to Acquirer under this paragraph, Acquirer shall provide Defendants a non-exclusive, perpetual, worldwide, fully paid-up license to use (or, at the Acquirer's option, a covenant not to sue Defendants for using) the asset in the manner in which it is currently used, or currently under development for use, in relation to any Thales product other than GP HSM Products.

(2) For each Shared Intangible Asset listed on Schedule 2 and any other Shared Intangible Asset that has been used, or has been under development for use, primarily in relation to Thales' business relating to products other than GP HSM Products, Defendants shall provide Acquirer a, perpetual, worldwide, fully paid-up license to use (or, at the Acquirer's option, a covenant not to sue Acquirer for use of) the asset. At the Acquirer's option, such licenses shall (i) be exclusive in relation to GP HSM Products and/or (ii) include non-exclusive rights in relation to products other than GP HSM products.

C. In accomplishing the divestiture ordered by this Final Judgment, Defendants promptly shall make known, by usual and customary means, the availability of the Divestiture Assets. Defendants shall inform any person making an inquiry regarding a possible purchase of the Divestiture Assets that they are being divested pursuant to this Final Judgment and provide that person with a copy of this Final Judgment. Defendants shall offer to furnish to all prospective Acquirers, subject to customary confidentiality assurances, all information and documents relating to the Divestiture Assets customarily provided in a due diligence process, except information or documents subject to the attorney-client privilege or work-product doctrine. Defendants shall make available such information to the United States at the same time that such information is made available to any other person.

D. Defendants shall permit prospective Acquirers of the Divestiture Assets to have reasonable access to personnel and to make inspections of the physical facilities included in the Divestiture Assets; access to any and all environmental, zoning, and other permit documents and information; and access to any and all financial, operational, or other documents and information customarily provided as part of a due diligence process.

E. Defendants shall not take any action that will impede in any way the permitting, operation, or divestiture of the Divestiture Assets.

F. Employees

(1) Within ten (10) business days following the filing of the Complaint in this matter, Thales shall provide to Acquirer, the United States, and the Monitoring Trustee organization charts including any Relevant Personnel for each year since July 1, 2017. Within ten (10) business days of receiving a request from Acquirer, Thales shall provide, subject to applicable law, to Acquirer, the United States, and the Monitoring Trustee, additional information related to identified Relevant Personnel, including name, job title, reporting relationships, past experience, and responsibilities from July 1, 2017 through the Divestiture Closing Date, training and educational history, relevant certifications, job performance evaluations, and current salary and benefits information to enable Acquirer to make offers of employment.

(2) Upon request by the Acquirer, Thales shall make Relevant Personnel available for interviews with Acquirer during normal business hours at a mutually agreeable location. Defendants will not interfere with any negotiations by Acquirer to employ any Relevant Personnel. Interference includes but is not limited to offering to increase the salary or benefits of Relevant Personnel other than as part of an increase in salary or benefits granted in the ordinary course of business.

(3) For any Relevant Personnel who elect employment with Acquirer as part of the divestiture required by this Final Judgment, or pursuant to Paragraph IV(F)(7) of this Final Judgment, Thales shall waive all non-compete and non-disclosure agreements (except as noted in Paragraph IV(F)(6)), vest all unvested pension and other equity rights, and provide all benefits which those Relevant Personnel would be provided if transferred to a buyer of an ongoing business.

(4) For a period of two (2) years from the Divestiture Closing Date, Thales may not solicit to hire Relevant Personnel who were hired by Acquirer as part of the divestiture required by this Final Judgment, or pursuant to Paragraph IV(F)(7) of this Final Judgment, unless (a) such individual is terminated or laid off by Acquirer or (b) Acquirer agrees in writing that Thales may solicit or hire that individual; provided, however, that nothing in this paragraph shall be construed as prohibiting Defendants from utilizing general solicitations or advertisements.

(5) For a period of one (1) year from the Divestiture Closing Date, Thales may not hire Relevant Personnel who were hired by Acquirer as part of the divestiture pursuant to this Final Judgment or pursuant to Paragraph IV(F)(7) of this Final Judgment, unless (a) such individual is terminated or laid off by Acquirer or (b) Acquirer agrees in writing that Thales may solicit or hire that individual.

(6) Nothing in Paragraph IV(F) shall prohibit Thales from maintaining any reasonable restrictions on the disclosure by any employee who accepts an offer of employment with Acquirer of Thales' proprietary non-public information that is (a) not otherwise required to be disclosed by this Final Judgment, (b) related solely to Thales' retained businesses and clients, and (c) unrelated to the Divestiture Assets.

(7) Acquirer's right to hire Relevant Personnel pursuant to Paragraph IV(F)(2) and Thales' obligations under Paragraph IV(F)(3) shall remain in effect for a period of ninety (90) days after the Divestiture Closing Date.

G. Asset Warranties

In addition to any other warranties in the divestiture-related agreements entered into by Defendants, Thales shall warrant to Acquirer (a) that each asset will be operational and without material defect as of the Divestiture Closing Date; (b) that there are no material defects in the environmental, zoning, or other permits pertaining to the operation of the Divestiture Assets; and (c) that, following the sale of the Divestiture Assets, Defendants will not undertake, directly or indirectly, any challenges to the environmental, zoning, or other permits relating to the operation of the Divestiture Assets.

H. Additional Assets

In addition to any other remedial provisions in the divestiture-related agreements entered into by Defendants, for a period of up to one (1) year following the Divestiture Closing Date, if Acquirer determines that any assets not included in the Divestiture Assets were related to the GP HSM Products business and reasonably necessary for the continued competitiveness of the divested GP HSM Products business, it shall notify the United States, the Monitoring Trustee, and the Defendants in writing that it requires such assets. If, after taking into account Acquirer's assets and business and providing Defendants an opportunity to demonstrate that such assets were not related to, and/or not reasonably necessary for the continued competitiveness of the divested GP HSM Products business, the United States, in its sole discretion, determines that such assets should be transferred or licensed, Defendants and Acquirer will negotiate an agreement within thirty (30) calendar days providing for the transfer or licensing of such assets in a period to be determined by the United States in consultation with the Defendants. The terms of any such transfer or license agreement shall be commercially reasonable and must be acceptable to the United States, in its sole discretion.

I. Transition Services

At the option of Acquirer, on or before the Divestiture Closing Date, Thales shall enter into transition services or reverse transition services agreements to provide any transition services reasonably necessary to allow Acquirer to operate any Divestiture Assets or to facilitate the transfer of Thales facilities to Acquirer. Thales will provide transition services under any such agreement for an initial period of up to one (1) year, on terms and conditions reasonably related to market conditions for the provision of the relevant services, subject to the approval of the United States in its sole discretion. Upon Acquirer's request, the United States, in its sole discretion, may approve one or more extensions of any such agreement for a total of up to an additional one (1) year.

J. Third-Party Agreements

At Acquirer's option, on or before the Divestiture Closing Date, Thales shall use its best efforts to assign or otherwise transfer to Acquirer all transferable or assignable agreements, or any assignable portions thereof, included in the Divestiture Assets, including but not limited to customer contracts, licenses, and collaborations. If Thales is unable to assign or transfer any such agreements, Thales shall use best efforts to ensure that Acquirer is put in the same economic position as if such agreements were assigned or transferred to Acquirer on the Divestiture Closing Date. The terms and conditions of any contractual arrangement intended to satisfy this provision must be reasonably related to market conditions for the provision of such services.

K. Licenses, Registrations, and Permits

Thales will make best efforts to assist Acquirer with acquiring new licenses, registrations, and permits to support the Divestiture Assets and, until Acquirer has the necessary licenses, registrations, and permits, Thales will provide Acquirer with the benefit of Thales' licenses, registrations, and permits in Acquirer's operation of the Divestiture Assets to the extent permissible by law.

L. Interoperability

(1) In order for the Divestiture Assets to have the uninterrupted ability to interface and interoperate with any solution that is provided by Defendants, for two (2) years following the date of sale of the Divestiture Assets, Defendants shall continue to enable, at cost and on the same quality and terms, the interface and interoperation between any GP HSM Product offered by Acquirer using the Divested Assets and any Retained Solutions to the extent such interface or interoperation existed at any time since January 1, 2017 in the then-current release of that Retained Solution. Defendants shall, upon receiving a written request from Acquirer at least thirty (30) calendar days before expiration of the second year, continue to provide the capability covered by this Section for another one (1) year, if approved by the United States in its sole discretion.

(2) Defendants may impose, as a condition of enabling any interface and interoperation that is required by Paragraph IV(L)(1), conditions that are reasonably related to maintaining the security, integrity, and confidentiality of customer data or the composition or means of operation of the applicable Retained Solution, except that Defendants may not impose conditions that are materially less favorable than the conditions under which Defendants provide or would provide an interface and interoperation between any of Defendants' GP HSMs and any Retained Solution.

(3) Defendants shall not change, during the period of Defendants' obligations under Paragraph IV(L)(1), except for good cause, the format of any interface and interoperation that is required by Paragraph IV(L)(1). For any such change, Defendants shall provide adequate notice and information for Acquirer to modify its Divested Assets, including any such products that are already installed with customers, to use the new format without disruption.

(4) Defendants shall take all reasonable steps to cooperate with and assist Acquirer in obtaining any third-party license or permission that may be required for Defendants to convey, license, sublicense, assign, or otherwise transfer to Acquirer rights, any interface or interoperability required by Paragraph IV(L)(1), or the use of any data transmitted as a result of any such interface or interoperation.

M. Patents

Thales shall provide a worldwide, non-exclusive, irrevocable, perpetual covenant not to assert against Acquirer or its customers in the field of use of GP HSM Products all U.S. or international patents, patent applications, or rights related to a patent or patent application (e.g., continuation, continuation-in-part, divisional, counterpart foreign application, or related international patent application filed under the Patent Cooperation Treaty), with a priority date or invention date prior to the closing of the Transaction (a) related to the Divestiture Assets and (b) owned, controlled, licensed, or used by Thales prior to the closing of the Transaction.

N. Unless the United States otherwise consents in writing, the divestiture pursuant to Section IV or by the Divestiture Trustee appointed pursuant to Section V of this Final Judgment shall include the entire Divestiture Assets and shall be accomplished in such a way as to satisfy the United States, in its sole discretion, that the Divestiture Assets can and will be used by Acquirer (approval of which is in the United States' sole discretion) as part of a viable, ongoing business of the production, operation, research, development, sale, and support of the GP HSM Products. The divestitures, whether pursuant to Section IV or Section V of this Final Judgment,

(1) shall be made to an Acquirer that, in the United States' sole judgment, has the intent and capability (including the necessary managerial, operational, technical, and financial capability) of competing effectively in the business of producing, operating, researching, developing, selling, and supporting GP HSM Products; and

(2) shall be accomplished so as to satisfy the United States, in its sole discretion, that none of the terms of any agreement between an Acquirer and Defendants give Defendants the ability unreasonably to raise the Acquirer's costs, to lower the Acquirer's efficiency, or otherwise to interfere in the ability of the Acquirer to compete effectively.

V. APPOINTMENT OF DIVESTITURE TRUSTEE

A. If Defendants have not divested the Divestiture Assets to Acquirer within the time period specified in Paragraph IV(A), Defendants shall notify the United States of that fact in writing. Upon application of the United States, the Court shall appoint a Divestiture Trustee selected by the United States and approved by the Court to effect the divestiture of the Divestiture Assets.

B. After the appointment of a Divestiture Trustee becomes effective, only the Divestiture Trustee shall have the right to sell the Divestiture Assets. The Divestiture Trustee shall have the power and authority to accomplish the divestiture to an Acquirer acceptable to the United States, in its sole discretion, at such price and on such terms as are then obtainable upon reasonable effort by the Divestiture Trustee, subject to the provisions of Sections IV and V of this Final Judgment, and shall have such other powers as the Court deems appropriate. Subject to Paragraph V(D) of this Final Judgment, the Divestiture Trustee may hire at the cost and expense of Defendants any agents, investment bankers, attorneys, accountants, or consultants, who shall be solely accountable to the Divestiture Trustee, reasonably necessary in the Divestiture Trustee's judgment to assist in the divestiture. Any such agents or consultants shall serve on such terms and conditions as the United States approves, including confidentiality requirements and conflict of interest certifications.

C. Defendants shall not object to a sale by the Divestiture Trustee on any ground other than the Divestiture Trustee's malfeasance. Any such objections by Defendants must be conveyed in writing to the United States and the Divestiture Trustee within ten (10) calendar days after the Divestiture Trustee has provided the notice required under Section VI.

D. The Divestiture Trustee shall serve at the cost and expense of Defendants pursuant to a written agreement, on such terms and conditions as the United States approves, including confidentiality requirements and conflict of interest certifications. The Divestiture Trustee shall account for all monies derived from the sale of the assets sold by the Divestiture Trustee and all costs and expenses so incurred. After approval by the Court of the Divestiture Trustee's accounting, including fees for any of its services yet unpaid and those of any professionals and agents retained by the Divestiture Trustee, all remaining money shall be paid to Defendants and the trust shall then be terminated. The compensation of the Divestiture Trustee and any professionals and agents retained by the Divestiture Trustee shall be reasonable in light of the value of the Divestiture Assets and based on a fee arrangement that provides the Divestiture Trustee with incentives based on the price and terms of the divestiture and the speed with which it is accomplished, but the timeliness of the divestiture is paramount. If the Divestiture Trustee and Defendants are unable to reach agreement on the Divestiture Trustee's or any agents' or consultants' compensation or other terms and conditions of engagement within fourteen (14) calendar days of the appointment of the Divestiture Trustee, the United States may, in its sole discretion, take appropriate action, including making a recommendation to the Court. The Divestiture Trustee shall, within three (3) business days of hiring any other agents or consultants, provide written notice of such hiring and the rate of compensation to Defendants and the United States.

E. Defendants shall use their best efforts to assist the Divestiture Trustee in accomplishing the required divestiture. The Divestiture Trustee and any agents or consultants retained by the Divestiture Trustee shall have full and complete access to the personnel, books, records, and facilities of the business to be divested, and Defendants shall provide or develop financial and other information relevant to such business as the Divestiture Trustee may reasonably request, subject to reasonable protection for trade secrets; other confidential research, development, or commercial information; or any applicable privileges. Defendants shall take no action to interfere with or to impede the Divestiture Trustee's accomplishment of the divestiture.

F. After its appointment, the Divestiture Trustee shall file monthly reports with the United States and, as appropriate, the Court, setting forth the Divestiture Trustee's efforts to accomplish the divestiture ordered under this Final Judgment. To the extent such reports contain information that the Divestiture Trustee deems confidential, such reports shall not be filed in the public docket of the Court. Such reports shall include the name, address, and telephone number of each person who, during the preceding month, made an offer to acquire, expressed an interest in acquiring, entered into negotiations to acquire, or was contacted or made an inquiry about acquiring any interest in the Divestiture Assets and shall describe in detail each contact with any such person. The Divestiture Trustee shall maintain full records of all efforts made to divest the Divestiture Assets.

G. If the Divestiture Trustee has not accomplished the divestiture ordered under this Final Judgment within six (6) months after its appointment, the Divestiture Trustee shall promptly file with the Court a report setting forth (1) the Divestiture Trustee's efforts to accomplish the required divestiture; (2) the reasons, in the Divestiture Trustee's judgment, why the required divestiture has not been accomplished; and (3) the Divestiture Trustee's recommendations. To the extent such reports contain information that the Divestiture Trustee deems confidential, such reports shall not be filed in the public docket of the Court. The Divestiture Trustee shall at the same time furnish such report to the United States, which shall have the right to make additional recommendations consistent with the purpose of the trust. The Court thereafter shall enter such orders as it shall deem appropriate to carry out the purpose of the Final Judgment, which may, if necessary, include extending the trust and the term of the Divestiture Trustee's appointment by a period requested by the United States.

H. If the United States determines that the Divestiture Trustee has ceased to act or failed to act diligently or in a reasonably cost-effective manner, the United States may recommend the Court appoint a substitute Divestiture Trustee.

VI. NOTICE OF PROPOSED DIVESTITURE

A. Within two (2) business days following execution of a definitive divestiture agreement, Defendants or the Divestiture Trustee, whichever is then responsible for effecting the divestiture required herein, shall notify the United States of any proposed divestiture required by Section IV or Section V of this Final Judgment. If the Divestiture Trustee is responsible, it shall similarly notify Defendants. The notice shall set forth the details of the proposed divestiture and list the name, address, and telephone number of each person not previously identified who offered or expressed an interest in or desire to acquire any ownership interest in the Divestiture Assets, together with full details of the same.

B. Within fifteen (15) calendar days of receipt by the United States of such notice, the United States may request from Defendants, the proposed Acquirer(s), any other third party, or the Divestiture Trustee, if applicable, additional information concerning the proposed divestiture, the proposed Acquirer(s), and any other potential Acquirer. Defendants and the Divestiture Trustee shall furnish any additional information requested within fifteen (15) calendar days of the receipt of the request, unless the parties shall otherwise agree.

C. Within thirty (30) calendar days after receipt of the notice or within twenty (20) calendar days after the United States has been provided the additional information requested from Defendants, the proposed Acquirer(s), any third party, and the Divestiture Trustee, whichever is later, the United States shall provide written notice to Defendants and the Divestiture Trustee, if there is one, stating whether or not, in its sole discretion, it objects to the Acquirer or any other aspect of the proposed divestiture. If the United States provides written notice that it does not object, the divestiture may be consummated, subject only to Defendants' limited right to object to the sale under Paragraph V(C) of this Final Judgment. Absent written notice that the United States does not object to the proposed Acquirer(s) or upon objection by the United States, a divestiture proposed under Section IV or Section V shall not be consummated. Upon objection by Defendants under Paragraph V(C), a divestiture proposed under Section V shall not be consummated unless approved by the Court.

VII. FINANCING

Neither Thales nor Gemalto shall finance all or any part of any purchase made pursuant to this Final Judgment.

VIII. HOLD SEPARATE AND ASSET PRESERVATION

Until the divestiture required by this Final Judgment has been accomplished, Defendants shall take all steps necessary to comply with the Stipulation and Order entered by the Court. Defendants shall take no action that would jeopardize the divestiture ordered by the Court.

IX. AFFIDAVITS

A. Within twenty (20) calendar days of the filing of the Complaint in this matter, and every thirty (30) calendar days thereafter until the divestiture has been completed under Section IV or Section V, Thales and Gemalto shall deliver to the United States an affidavit, signed by each defendant's Chief Financial Officer and General Counsel, which shall describe the fact and manner of Defendants' compliance with Section IV or Section V of this Final Judgment. Each such affidavit shall include the name, address, and telephone number of each person who, during the preceding thirty (30) calendar days, made an offer to acquire, expressed an interest in acquiring, entered into negotiations to acquire, or was contacted or made an inquiry about acquiring, any interest in the Divestiture Assets, and shall describe in detail each contact with any such person during that period. Each such affidavit shall also include a description of the efforts Defendants have taken to solicit buyers for the Divestiture Assets, and to provide required information to prospective Acquirers, including the limitations, if any, on such information. Assuming the information set forth in the affidavit is true and complete, any objection by the United States to information provided by Thales and Gemalto, including limitation on information, shall be made within fourteen (14) calendar days of receipt of such affidavit.

B. Within twenty (20) calendar days of the filing of the Complaint in this matter, Defendants shall deliver to the United States and the Monitoring Trustee an affidavit that describes in reasonable detail all actions Defendants have taken and all steps Defendants have implemented on an ongoing basis to comply with Section VIII of this Final Judgment. Each of the Defendants shall deliver to the United States and the Monitoring Trustee an affidavit describing any changes to the efforts and actions outlined in Defendants' earlier affidavits filed pursuant to this Section within fifteen (15) calendar days after the change is implemented.

C. Defendants shall keep all records of all efforts made to preserve and divest the Divestiture Assets until one (1) year after such divestiture has been completed.

X. APPOINTMENT OF MONITORING TRUSTEE

A. Upon application of the United States, the Court shall appoint a Monitoring Trustee selected by the United States and approved by the Court.

B. The Monitoring Trustee shall have the power and authority to monitor Defendants' compliance with the terms of this Final Judgment and the Stipulation and Order entered by the Court and shall have such other powers as the Court deems appropriate. The Monitoring Trustee shall be required to investigate and report on the Defendants' compliance with this Final Judgment and the Stipulation and Order, and Defendants' progress toward effectuating the purposes of this Final Judgment, including but not limited to reviewing (1) the implementation and execution of the compliance plan required by Section XI, and (2) any applications by the Acquirer for additional employees or assets under Paragraphs IV(F) and IV(H) respectively.

C. Subject to Paragraph X(E) of this Final Judgment, the Monitoring Trustee may hire at the cost and expense of Defendants any agents, investment bankers, attorneys, accountants, or consultants, who shall be solely accountable to the Monitoring Trustee, reasonably necessary in the Monitoring Trustee's judgment. Any such agents or consultants shall serve on such terms and conditions as the United States approves, including confidentiality requirements and conflict of interest certifications.

D. Defendants shall not object to actions taken by the Monitoring Trustee in fulfillment of the Monitoring Trustee's responsibilities under any Order of the Court on any ground other than the Monitoring Trustee's malfeasance. Any such objections by Defendants must be conveyed in writing to the United States and the Monitoring Trustee within ten (10) calendar days after the action taken by the Monitoring Trustee giving rise to Defendants' objection.

E. The Monitoring Trustee shall serve at the cost and expense of Defendants, pursuant to a written agreement with Defendants and on such terms and conditions as the United States approves, including confidentiality requirements and conflict of interest certifications. The compensation of the Monitoring Trustee and any agents or consultants retained by the Monitoring Trustee shall be on reasonable and customary terms commensurate with the individuals' experience and responsibilities. If the Monitoring Trustee and Defendants are unable to reach agreement on the Monitoring Trustee's or any agents' or consultants' compensation or other terms and conditions of engagement within fourteen (14) calendar days of the appointment of the Monitoring Trustee, the United States may, in its sole discretion, take appropriate action, including making a recommendation to the Court. The Monitoring Trustee shall, within three (3) business days of hiring any agents or consultants, provide written notice of such hiring and the rate of compensation to Defendants and the United States.

F. The Monitoring Trustee shall have no responsibility or obligation for the operation of Defendants' businesses.

G. Defendants shall use their best efforts to assist the Monitoring Trustee in monitoring Defendants' compliance with their individual obligations under this Final Judgment and under the Stipulation and Order. The Monitoring Trustee and any agents or consultants retained by the Monitoring Trustee shall have full and complete access to the personnel, books, records, and facilities relating to compliance with this Final Judgment, subject to reasonable protection for trade secrets; other confidential research, development, or commercial information; or any applicable privileges. Defendants shall take no action to interfere with or to impede the Monitoring Trustee's accomplishment of its responsibilities.

H. After its appointment, the Monitoring Trustee shall file reports semiannually, or more frequently as needed, with the United States and, as appropriate, the Court setting forth Defendants' efforts to comply with Defendants' obligations under this Final Judgment and under the Stipulation and Order. To the extent such reports contain information that the Monitoring Trustee deems confidential, such reports shall not be filed in the public docket of the Court.

I. The Monitoring Trustee shall serve until the divestiture of all the Divestiture Assets is finalized pursuant to either Section IV or Section V of this Final Judgment, any agreement entered into pursuant to Paragraph IV(I) has expired, and until Thales' obligations pursuant to Paragraphs IV(F) and IV(H) have concluded, unless the United States, in its sole discretion, terminates earlier or extends this period.

J. If the United States determines that the Monitoring Trustee has ceased to act or failed to act diligently or in a reasonably cost-effective manner, it may recommend the Court appoint a substitute Monitoring Trustee.

XI. PROTECTION OF CONFIDENTIAL INFORMATION

A. Thales and Gemalto shall implement and maintain reasonable procedures to prevent the disclosure or use of Confidential Information for any purpose other than:

(1) in connection with complying with this Final Judgment;

(2) in connection with complying with regulatory, financial reporting, audit, legal, compliance, or similar administrative purposes; or

(3) Defendants' use of Shared Intangible Assets as permitted by this Final Judgment.

B. Any representative of Thales who possesses any Confidential Information shall disclose or use such information only to the extent necessary to perform activities authorized in Paragraph XI(A).

C. Defendants shall implement procedures to prevent Confidential Information from being used or accessed by representatives of Defendants other than those with a need for such information in connection with the permitted uses set forth in Paragraph XI(A) (such procedures constituting a “compliance plan”). Defendants' compliance plan shall include identification of an individual with primary responsibility for implementing the compliance plan, monitoring adherence to the compliance plan, taking measures against individuals who fail to adhere to the compliance plan, and developing instruction materials and providing instruction to Defendants' representatives relating to their obligations under this Section.

D. Defendants shall, within twenty (20) business days of the entry of the Stipulation and Order, submit to the United States and the Monitoring Trustee a document setting forth in detail the compliance plan. Upon receipt of the document, the United States shall notify the Defendants within twenty (20) business days whether, in its sole discretion, it approves of or rejects the compliance plan. In the event that the compliance plan is rejected, the United States shall provide the reasons for the rejection. Defendants shall be given the opportunity to submit, within ten (10) business days of receiving a notice of rejection, a revised compliance plan. If Defendants cannot agree with the United States on a compliance plan, the United States shall have the right to request that this Court rule on whether the Defendants' proposed compliance plan fulfills the requirements of Section XI.

E. Defendants shall:

(1) furnish a copy of this Final Judgment and related Competitive Impact Statement within five (5) business days of entry of the Final Judgment to (a) each officer, director, and any other employee who possesses, will possess, or may receive Confidential Information;

(2) furnish a copy of this Final Judgment and related Competitive Impact Statement to any successor to a person designated in Paragraph XI(C) upon assuming that position;

(3) annually brief each person designated in Paragraph XI(C) on the meaning and requirements of this Final Judgment and the antitrust laws; and

(4) obtain from each person designated in Paragraph XI(C), within ten (10) business days of that person's receipt of the Final Judgment and annually thereafter for five (5) years, a certification that he or she (a) has read and, to the best of his or her ability, understands and agrees to abide by the terms of this Final Judgment; (b) is not aware of any violation of the Final Judgment that has not been reported to the company; and (c) understands that any person's failure to comply with this Final Judgment may result in an enforcement action for civil or criminal contempt of court against each Defendant or any person who violates this Final Judgment; and

(5) six (6) months from the Divestiture Closing Date and annually thereafter for five (5) years, furnish an affidavit to the United States and the Monitoring Trustee, certifying compliance with Section XI. For five (5) years following the Divestiture Closing Date, if violations of Section XI are found, affidavits describing such violations will be furnished to the United States and the Monitoring Trustee within five (5) days of the discovery of a violation.

F. The provisions of this Section shall expire five (5) years after the Divestiture Closing Date.

XII. COMPLIANCE INSPECTION

A. For the purposes of determining or securing compliance with this Final Judgment, or of any related orders such as any Stipulation and Order or of determining whether the Final Judgment should be modified or vacated, and subject to any legally-recognized privilege, from time to time authorized representatives of the United States, including the Monitoring Trustee or any other agents and consultants retained by the United States, shall, upon written request of an authorized representative of the Assistant Attorney General in charge of the Antitrust Division and on reasonable notice to Defendants, be permitted:

(1) access during Defendants' office hours to inspect and copy or, at the option of the United States, to require Defendants to provide electronic copies of all books, ledgers, accounts, records, data, and documents in the possession, custody, or control of Defendants relating to any matters contained in this Final Judgment; and

(2) to interview, either informally or on the record, Defendants' officers, employees, or agents, who may have their individual counsel present, regarding such matters. The interviews shall be subject to the reasonable convenience of the interviewee and without restraint or interference by Defendants.

B. Upon the written request of an authorized representative of the Assistant Attorney General in charge of the Antitrust Division, Defendants shall submit written reports or responses to written interrogatories, under oath if requested, relating to any of the matters contained in this Final Judgment as may be requested.

C. No information or documents obtained by the means provided in Section XI shall be divulged by the United States to any person other than an authorized representative of the executive branch of the United States, except in the course of legal proceedings to which the United States is a party (including grand jury proceedings), for the purpose of securing compliance with this Final Judgment, or as otherwise required by law.

D. If at the time that Defendants furnish information or documents to the United States, Defendants represent and identify in writing the material in any such information or documents to which a claim of protection may be asserted under Rule 26(c)(1)(G) of the Federal Rules of Civil Procedure, and Defendants mark each pertinent page of such material, “Subject to claim of protection under Rule 26(c)(1)(G) of the Federal Rules of Civil Procedure,” then the United States shall give Defendants ten (10) calendar days' notice prior to divulging such material in any legal proceeding (other than a grand jury proceeding).

XIII. NOTIFICATION OF FUTURE TRANSACTIONS

A. Unless such transaction has a value less than $10 million or is otherwise subject to the reporting and waiting period requirements of the Hart-Scott-Rodino Antitrust Improvements Act of 1976, as amended, 15 U.S.C. § 18a (the “HSR Act”), Defendants, without providing advance notification to the United States, shall not directly or indirectly acquire any assets of or any interest, including any financial, security, loan, equity, or management interest, in any company that researches, develops, or manufactures GP HSM Products during the term of this Final Judgment.

B. Such notification shall be provided to the United States in the same format as, and per the instructions relating to, the Notification and Report Form set forth in the Appendix to Part 803 of Title 16 of the Code of Federal Regulations as amended, except that the information requested in Items 5 through 8 of the instructions must be provided only about GP HSM Products and related services. Notification shall be provided at least thirty (30) calendar days prior to acquiring any such interest, and shall include, beyond what may be required by the applicable instructions, the names of the principal representatives of the parties to the agreement who negotiated the agreement, and any management or strategic plans discussing the proposed transaction. If within the 30-day period after notification, representatives of the United States make a written request for additional information, Defendants shall not consummate the proposed transaction or agreement until thirty (30) calendar days after submitting all such additional information. Early termination of the waiting periods in this Paragraph may be requested and, where appropriate, granted in the same manner as is applicable under the requirements and provisions of the HSR Act and rules promulgated thereunder. Section XIII shall be broadly construed and any ambiguity or uncertainty regarding the filing of notice under Section XII shall be resolved in favor of filing notice.

XIV. NO REACQUISITION OF DIVESTITURE ASSETS

Defendants may not reacquire any part of the Divestiture Assets during the term of this Final Judgment.

XV. RETENTION OF JURISDICTION

The Court retains jurisdiction to enable any party to this Final Judgment to apply to the Court at any time for further orders and directions as may be necessary or appropriate to carry out or construe this Final Judgment, to modify any of its provisions, to enforce compliance, and to punish violations of its provisions.

XVI. ENFORCEMENT OF FINAL JUDGMENT

A. The United States retains and reserves all rights to enforce the provisions of this Final Judgment, including the right to seek an order of contempt from the Court. Defendants agree that in any civil contempt action, any motion to show cause, or any similar action brought by the United States regarding an alleged violation of this Final Judgment, the United States may establish a violation of the decree and the appropriateness of any remedy therefor by a preponderance of the evidence, and Defendants waive any argument that a different standard of proof should apply.

B. The Final Judgment should be interpreted to give full effect to the procompetitive purposes of the antitrust laws and to restore all competition the United States alleged was harmed by the challenged conduct. Defendants agree that they may be held in contempt of, and that the Court may enforce, any provision of this Final Judgment that, as interpreted by the Court in light of these procompetitive principles and applying ordinary tools of interpretation, is stated specifically and in reasonable detail, whether or not it is clear and unambiguous on its face. In any such interpretation, the terms of this Final Judgment should not be construed against either party as the drafter.

C. In any enforcement proceeding in which the Court finds that Defendants have violated this Final Judgment, the United States may apply to the Court for a one-time extension of this Final Judgment, together with such other relief as may be appropriate. In connection with any successful effort by the United States to enforce this Final Judgment against a Defendant, whether litigated or resolved prior to litigation, that Defendant agrees to reimburse the United States for the fees and expenses of its attorneys, as well as any other costs including experts' fees, incurred in connection with that enforcement effort, including in the investigation of the potential violation.

XVII. EXPIRATION OF FINAL JUDGMENT

Unless the Court grants an extension, this Final Judgment shall expire ten (10) years from the date of its entry, except that after five (5) years from the date of its entry, this Final Judgment may be terminated upon notice by the United States to the Court and Defendants that the divestitures have been completed and that the continuation of the Final Judgment no longer is necessary or in the public interest.

XVIII. PUBLIC INTEREST DETERMINATION

Entry of this Final Judgment is in the public interest. The parties have complied with the requirements of the Antitrust Procedures and Penalties Act, 15 U.S.C. § 16, including making copies available to the public of this Final Judgment, the Competitive Impact Statement, any comments thereon, and the United States' responses to comments. Based upon the record before the Court, which includes the Competitive Impact Statement and any comments and responses to comments filed with the Court, entry of this Final Judgment is in the public interest.

Date:

[Court approval subject to procedures of Antitrust Procedures and Penalties Act, 15 U.S.C. § 16]

United States District Judge

Schedule 1

Shared Intangible Assets Transferred to Acquirer and Licensed Back to Defendants

In each case the “Field of Use for License-Back to Defendants“ is limited to the manner in which the listed asset is currently used, or currently under development for use.

Patents

Title	Patent/application No.	Jurisdiction	Field of use for license-back to defendants
A method of data transfer, a method of controlling use of data and a cryptographic device	BR11201801525-44	Brazil	(1) Payment HSMs and their derived applications and (2) encryption software products (not including key management).
A method of data transfer, a method of controlling use of data and a cryptographic device	3013687	Canada	(1) Payment HSMs and their derived applications and (2) encryption software products (not including key management).
A method of data transfer, a method of controlling use of data and a cryptographic device	20178000986.41	China	(1) Payment HSMs and their derived applications and (2) encryption software products (not including key management).
A method of data transfer, a method of controlling use of data and a cryptographic device	17704057.3	European Patent Office	(1) Payment HSMs and their derived applications and (2) encryption software products (not including key management).
A method of data transfer, a method of controlling use of data and a cryptographic device	2018-540867	Japan	(1) Payment HSMs and their derived applications and (2) encryption software products (not including key management).
A method of data transfer, a method of controlling use of data and a cryptographic device	PCT/GB2017/050264	Patent Cooperation Treaty	(1) Payment HSMs and their derived applications and (2) encryption software products (not including key management).
A method of data transfer, a method of controlling use of data and a cryptographic device	10-2018-7025706	Republic of Korea	(1) Payment HSMs and their derived applications and (2) encryption software products (not including key management).
A method of data transfer, a method of controlling use of data and a cryptographic device	1602088.5	United Kingdom	(1) Payment HSMs and their derived applications and (2) encryption software products (not including key management).
A method of data transfer, a method of controlling use of data and a cryptographic device	16/075575	United States	(1) Payment HSMs and their derived applications and (2) encryption software products (not including key management).
A method and system of securely enforcing a computer policy	GB2413880	United Kingdom	Payment HSMs and their derived applications.
Cryptographic security module method and apparatus	GB2409387	United Kingdom	Payment HSMs and their derived applications.
Secure transmission of data within a distributed computer system	GB2404535	United Kingdom	Encryption software products.
Secure transmission of data within a distributed computer system	US7266705	United States of America	Encryption software products.
Controlling access to a resource by a program using a digital signature	CA2400940	Canada	Payment HSMs and their derived applications.
Controlling access to a resource by a program using a digital signature	EP1257892	Switzerland	Payment HSMs and their derived applications.
Controlling access to a resource by a program using a digital signature	EP1257892	Germany	Payment HSMs and their derived applications.
Controlling access to a resource by a program using a digital signature	EP1257892	France	Payment HSMs and their derived applications.
Controlling access to a resource by a program using a digital signature	EP1257892	United Kingdom	Payment HSMs and their derived applications.
Controlling access to a resource by a program using a digital signature	EP1257892	Ireland	Payment HSMs and their derived applications.
Controlling access to a resource by a program using a digital signature	US7900239	United States of America	Payment HSMs and their derived applications.

Software

Category	Software	Field of use for license-back to defendants
External API	SmartCards	Payment HSMs and their derived applications.
	TVD (Remote Admin)	Payment HSMs and their derived applications.
CodeSafe	CodeSafe v2	Payment HSMs and their derived applications.
Remote Administration	JavaCard Applet	Payment HSMs and their derived applications.
Solo XC Source	security-processor	Payment HSMs and their derived applications.
	signing_infra	Payment HSMs and their derived applications.

Schedule 2

Shared Intangible Assets Retained by Thales and Licensed to Acquirer

Software

Category	Software
Cipher Trust Monitor	Cipher Trust Monitor common code.
	Agate.
	Augite.
	Bauxite.
	Cordierite.
	Fabric core / Authorizer.
	Fabric core / building-block-template.
	Fabric core / crypto.
TD & Fabric Activities	Fabric core / protector.
	FIDO U2F.
	Granite.
	OpenID Connect Study.
	Phenakite.
	Pyrite.
	TLS Token Binding Study.

United States District Court for the District of Columbia

United States of America, Plaintiff, v. Thales S.A. and Gemalto N.V., Defendants.

Case No.: 1:19-cv-00569-BAH

Judge: Beryl A. Howell

COMPETITIVE IMPACT STATEMENT

Plaintiff United States of America (United States), pursuant to Section 2(b) of the Antitrust Procedures and Penalties Act (APPA or Tunney Act), 15 U.S.C. § 16(b)-(h), files this Competitive Impact Statement relating to the proposed Final Judgment submitted for entry in this civil antitrust proceeding.

I. NATURE AND PURPOSE OF THE PROCEEDING

Defendant Thales S.A. (Thales) and Defendant Gemalto N.V. (Gemalto) entered into an agreement, dated December 17, 2017, pursuant to which Thales would acquire, by means of an all-cash tender offer, all of the outstanding ordinary shares of Gemalto for approximately $5.64 billion. The United States filed a civil antitrust Complaint on February 28, 2019, seeking to enjoin the proposed acquisition. The Complaint alleges that the likely effect of this acquisition would be to substantially lessen competition in the provision of General Purpose (GP) Hardware Security Modules (HSMs) in the United States in violation of Section 7 of the Clayton Act, 15 U.S.C. § 18. This loss of competition likely would result in higher prices for GP HSMs as well as a reduction in quality, product support, and innovation.

At the same time the Complaint was filed, the United States filed a Stipulation and Order and proposed Final Judgment, which are designed to eliminate the anticompetitive effects of the acquisition. Under the proposed Final Judgment, which is explained more fully below, Defendants are required to make certain divestures for the purpose of remedying the loss of competition in the U.S. market for GP HSMs that would have resulted from the merger. Under the terms of the Stipulation and Order, Defendants will take certain steps to ensure that the divested GP HSM Products business is operated as a competitively independent, economically viable and ongoing business concern, that will remain independent and uninfluenced by the consummation of the acquisition, and that competition is maintained during the pendency of the ordered divestiture. The United States and Defendants have stipulated that the proposed Final Judgment may be entered after compliance with the APPA. Entry of the proposed Final Judgment would terminate this action, except that the Court would retain jurisdiction to construe, modify, or enforce the provisions of the proposed Final Judgment and to punish violations thereof.

II. DESCRIPTION OF THE EVENTS GIVING RISE TO THE ALLEGED VIOLATION

A. The Defendants and the Proposed Transaction

Thales is an international company incorporated in France with its principal office in Paris. Thales is active globally in five main industries: (i) aeronautics; (ii) space; (iii) ground transportation; (iv) defense; and (v) security. In 2017, it had global revenue of approximately $19.6 billion, operations in fifty-six countries, and approximately 65,100 employees. Thales eSecurity is a business unit of Thales that primarily encompasses three legal entities: (1) Thales eSecurity Inc. (based in the United States with offices in Plantation, Florida; San Jose, California; and Boston, Massachusetts); (2) Thales UK Ltd. (based in the United Kingdom); and (3) Thales Transport & Security HK Ltd. (based in Hong Kong). Thales eSecurity specializes in developing, marketing, and selling data security products, including but not limited to GP HSMs, payment HSMs, and encryption and key management software and hardware.

Thales sells GP HSMs to customers worldwide, including government and commercial organizations throughout the United States. In 2008, Thales acquired nCipher, a company that specialized in cryptographic security and sold, among other things, GP HSMs under the brand name nCipher. After that acquisition, Thales changed the brand name of those GP HSMs to nShield. To resolve the United States' concerns in this matter, and pursuant to commitments made to the European Commission on November 7, 2018, Thales has agreed to divest its nShield business. As part of the commitments to the European Commission, Thales has already separated the nShield business and related assets and personnel from the rest of its businesses and appointed a hold separate manager whose responsibility it is to manage the nShield business as a distinct and separate entity from the businesses retained by Thales until the divestiture is completed. This new business unit is operating under the name nCipher Security.

Gemalto is an international digital security company incorporated in the Netherlands with its principal office in Amsterdam. Gemalto is active globally in providing authentication and data protection technology, platforms, and services in five main areas: (i) banking and payment; (ii) enterprise and cybersecurity; (iii) government; (iv) mobile; and (v) machine-to-machine Internet of Things. In 2017, Gemalto had global revenue of approximately $3.7 billion, operations in forty-eight countries, and approximately 15,000 employees. Gemalto develops, markets, and sells GP HSMs, as well as other security solutions and services, including but not limited to payment HSMs and encryption and key management software and hardware. In the United States, Gemalto sells its products and services primarily through SafeNet, Inc. (based in Belcamp, Maryland), SafeNet Assured Technologies, LLC (based in Abingdon, Maryland), and Gemalto Inc. (based in Austin, Texas). Gemalto sells GP HSMs to customers worldwide, including government and commercial organizations throughout the United States, under the brand name SafeNet Luna.

The proposed acquisition of Gemalto by Thales, as initially agreed to by Defendants on December 17, 2017, would lessen competition substantially in the U.S. market for GP HSMs. This acquisition is the subject of the Complaint and proposed Final Judgment filed by the United States on February 28, 2019.

B. The Competitive Effects of the Transaction on the Market for GP HSMs

GP HSMs are tamper-resistant hardware environments for secure encryption processing and key management. They are most frequently included as components of complex encryption solutions used by government and private organizations to safeguard their most sensitive data. The universe of sensitive electronic data has been expanding rapidly and relates to a wide range of subjects, such as personally identifiable information, health records, financial information, tax records, trade secrets, software code, and other confidential information. Inappropriate use, theft, corruption, or disclosure of this data could result in significant harm to an organization's customers or constituents and the organization itself.

Organizations increasingly rely on encryption as a crucial component of the security measures implemented to safeguard sensitive data from internal and external threats. Encryption is a process that converts readable data (plain text) into an unreadable format (cipher text) using an algorithm and an encryption key. Decryption is the reverse of encryption, converting cipher text back to plain text. Encryption algorithms are based on highly complex math and are often standardized and open source.

Encryption keys consist of a randomly generated series of numbers. Because encrypted data is virtually impossible to decipher using today's technology without the encryption key, attackers who want unauthorized access to sensitive data generally focus their efforts on obtaining those encryption keys. With the right key, an attacker can freely access an organization's sensitive data. Conversely, a lost or corrupted key could make encrypted data unrecoverable by the organization. Organizations therefore must implement processes that safeguard against improper use of the encryption keys while simultaneously ensuring they are readily available when required for authorized use.

GP HSMs provide the most secure way for organizations to effectively manage and protect their encryption keys, and many organizations use them to protect their most sensitive data. Key management functionality is also available from software-based solutions. While these software solutions are generally less expensive than GP HSMs, GP HSMs are more secure. GP HSMs provide additional security, in part, because they are isolated from the rest of the organization's IT system. Use of GP HSMs is often required by regulations, industry standards, or an organization's auditors or security policies.

GP HSMs are typically validated by independent testing organizations to confirm they meet certain specified levels of security; software-based key systems, by contrast, are not able to meet the most stringent levels of security.

Thales and Gemalto sell GP HSMs and related services directly to end-user organizations and through resellers who often combine the GP HSMs with additional security products or services. Thales and Gemalto also sell GP HSMs to cloud service providers (CSPs) such as Amazon Web Services and Microsoft Azure, who then sell GP HSM services, or HSM-as-a-service (HSMaaS), to their cloud customers. There are, however, many organizations that are reluctant to use HSMaaS because they want more control over the security of their data. Even if an organization chooses to use HSMaaS, it may also require an on-premises GP HSM to provide an additional layer of encryption security.

GP HSMs typically must be integrated into or configured to operate within an organization's existing IT environment. An organization needs assurance that a GP HSM will be an effective component of what may be an already complex data security infrastructure. Because of this, the GP HSM sales process typically includes a comprehensive exchange of information between the potential customer organization and GP HSM supplier.

Once an organization has installed a GP HSM into its IT infrastructure and is using it to protect its keys and to provide a secure data encryption environment, any breakdowns or malfunctions in the GP HSM could not only compromise the sensitive data but also jeopardize the organization's ability to perform day-to-day tasks that are necessary for the organization to carry out its business. Post-sales customer support and service are therefore essential. Many customers will not even consider a potential GP HSM supplier who has not established a strong reputation for providing quality GP HSMs and continuous and effective post-sales service and support.

Thales and Gemalto are the two leading providers of GP HSMs in the United States, with market shares of approximately 30% and 36%, respectively, and a combined market share of approximately 66%. Together, Thales and Gemalto dominate the GP HSM market in the United States. As originally proposed, Thales' acquisition of Gemalto would substantially increase market concentration in an already highly concentrated market. Acquisitions that reduce the number of competitors in already concentrated markets tend to to substantially lessen competition.

Thales' proposed acquisition of Gemalto likely would substantially lessen competition and harm customers in the U.S. GP HSM market by eliminating head-to-head competition between the two leading suppliers in the United States. Thales and Gemalto are each other's closest competitors for GP HSMs. Thales and Gemalto regularly approve significant discounts on GP HSMs when competing against each other. Thales and Gemalto both have strong reputations for high-quality post-sales service and support. Competition between the two companies has also spurred innovation in the past. Thales' proposed acquisition of Gemalto would eliminate this head-to-head competition and reduce innovation, in addition to significantly increasing concentration in a highly concentrated market. The acquisition likely would result in higher prices, lower quality, and reduced supplier choices for customers.

It is unlikely that any firm would enter the market for GP HSM sales to customers in the United States in a manner sufficient to defeat the likely anticompetitive effects of the proposed acquisition. Successful entry in the development, marketing, sale, and service of GP HSMs would be difficult, time-consuming, and costly.

Any new entrant would be required to expend significant time and capital to design and develop a series of GP HSMs that are at least comparable to Thales' and Gemalto's GP HSM product lines in terms of functionality and the ability to interoperate with a wide range of encryption solutions and IT resources. Moreover, a new entrant, as well as any existing foreign-based GP HSM provider seeking to expand and become a viable competitor in the supply of GP HSMs for use by individual organizations in the United States, would need to spend significant time and effort to demonstrate its ability to provide high-quality GP HSMs and continuous, high-quality post-sales service in the United States. It is unlikely that any such entry or expansion effort would produce an economically viable alternative to the merged firm in time to counteract the competitive harm likely to result from the proposed transaction.

As a result of its acquisition of Gemalto, as originally proposed, Thales would have emerged as the clearly dominant provider of GP HSMs in the United States with the ability to exercise substantial market power, increasing the likelihood that Thales could unilaterally increase prices or reduce its efforts to improve the quality of its products and services.

III. EXPLANATION OF THE PROPOSED FINAL JUDGMENT

The divestiture requirement of the proposed Final Judgment will eliminate the anticompetitive effects of the acquisition in the market for GP HSMs by establishing a new, independent, and economically viable competitor. The proposed Final Judgment requires Thales, within thirty-five (35) calendar days after the filing of the Complaint, or five (5) days after notice of the entry of the Final Judgment by the Court, whichever is later, to divest, as a viable ongoing business, Thales' GP HSM Products business. This includes all tangible and intangible assets primarily related to the production, operation, research, development, sale, or support of any Thales GP HSM Product.

Further, the proposed Final Judgment specifies the manner in which shared intangible assets shall be divested. These are assets that are used or have been under development for use as of January 7, 2019, which was the date Thales' GP HSM Products business was formally separated from the rest of Thales, in relation to both (i) Thales' GP HSM Products business and (ii) Thales' business relating to products other than GP HSM Products.

The proposed Final Judgment provides that, in the event that government approvals needed to complete the divestiture have been timely filed but remain outstanding at the end of the permitted divesture period, additional, limited extensions may be granted to allow Defendants and the acquirer time to obtain those approvals.

The proposed Final Judgment also provides that Thales must provide the Acquirer relevant information to allow the Acquirer to evaluate whether to make offers of employment to Thales employees, and provides that Thales must not interfere in any hiring process. Under the terms of the proposed Final Judgment, the Acquirer may seek to hire additional employees up to 90 days after they acquire the divested assets. Thales may not re-hire employees hired by the Acquirer for one year after the divestiture is complete, and may not specifically solicit any of those individuals for two years.

The assets must be divested in such a way as to satisfy the United States in its sole discretion that the operations can and will be operated by the purchaser as a viable, ongoing business that can compete effectively to develop, service, and sell GP HSMs to customers in the United States. Defendants must take all reasonable steps necessary to accomplish the divestiture quickly and shall cooperate with prospective purchasers. The proposed Final Judgment also includes procedures pursuant to which the Acquirer may apply to the United States for the right to acquire additional assets that would be materially useful to the divested business, or hire specific additional personnel, for a limited time after the divesture date.

The proposed Final Judgment provides that Defendants must ensure that their products continue to interface and interoperate with the divested GP HSM Products for at least two years. This interoperability must be provided at cost, and on the same quality (which may be measured, for example, by reference to speed and frequency of content transmission, lag time, uptime, database or API synchronization, or data fields transmitted, exposed, or used) and terms that were provided at any time since January 1, 2017. Should the Acquirer determine that a third year of interoperability is necessary, it may request that this provision be extended an additional year.

The proposed Final Judgment also provides that Thales must provide certain transition services to Acquirer, at the Acquirer's request for a period of one year. The acquirer may request that the United States allow the period of these transition services to be extended for another year if necessary.

The proposed Final Judgment provides that Thales must use its best efforts to ensure that all contracts involving GP HSM Products be transferred to the Acquirer. When contracts involve both GP HSM Products and other products, the portions of the contracts relating to GP HSM Products will be conveyed. If Thales is unable to convey any of these contractual rights, the proposed Final Judgment provides that it will use its best efforts to make the Acquirer whole.

The proposed Final Judgment also provides that Thales will grant the Acquirer a covenant not to sue for breach, in the field of GP HSMs, of any patent held by Thales.

The proposed Final Judgment provides that the United States may apply to the Court for appointment of a Monitoring Trustee with the power and authority to investigate and report on the parties' compliance with the terms of the Final Judgment and Stipulation and Order filed with the Court for entry during the pendency of the divestiture. The Monitoring Trustee's duties would include reviewing: (1) the implementation and execution of a compliance plan to prevent any misuse of confidential information relating to the divested business; and (2) any application by the Acquirer for additional employees or assets.

The Monitoring Trustee will not have any responsibility or obligation for the operation of the parties' businesses. The Monitoring Trustee will serve at Defendants' expense, on such terms and conditions as the United States approves, and Defendants must assist the trustee in fulfilling its obligations. The Monitoring Trustee will file semiannual reports and shall serve until the provisions regarding employees, additional assets, and transition services have expired.

In the event that Defendants do not accomplish the divestiture within the periods prescribed in the proposed Final Judgment, the proposed Final Judgment provides that the Court will appoint a Divestiture Trustee selected by the United States to effect the divestiture. Defendants will pay all costs and expenses of any such trustee. After his or her appointment becomes effective, the Divestiture Trustee will file monthly reports with the Court and the United States setting forth his or her efforts to accomplish the divestiture. At the end of six months, if the divestiture has not been accomplished, the Divestiture Trustee and the United States will make recommendations to the Court, which shall enter such orders as appropriate, in order to carry out the purpose of the trust, including extending the trust or the term of the Divestiture Trustee's appointment.

The proposed Final Judgment contains provisions to require, for five years, that Defendants refrain from using any Confidential Information that they possess about the GP HSM Products business, except for certain permitted uses. Defendants must prepare a compliance plan to promote the success of these provisions and regularly report to the Division whether there has been a breach.

The proposed Final Judgment also contains provisions that require Defendants to report to the Division subsequent transactions that are related to GP HSMs, if those transactions otherwise would not be reportable under the Hart-Scott-Rodino Antitrust Improvements Act of 1976, as amended, 15 U.S.C. § 18a.

The proposed Final Judgment also contains provisions designed to promote compliance and make the enforcement of Division consent decrees as effective as possible. Paragraph XVI(A) provides that the United States retains and reserves all rights to enforce the provisions of the proposed Final Judgment, including its rights to seek an order of contempt from the Court. Under the terms of this paragraph, Defendants have agreed that in any civil contempt action, any motion to show cause, or any similar action brought by the United States regarding an alleged violation of the Final Judgment, the United States may establish the violation and the appropriateness of any remedy by a preponderance of the evidence and that Defendants have waived any argument that a different standard of proof should apply. This provision aligns the standard for compliance obligations with the standard of proof that applies to the underlying offense that the compliance commitments address.

Paragraph XVI(B) provides additional clarification regarding the interpretation of the provisions of the proposed Final Judgment. The proposed Final Judgment was drafted to restore all competition that would otherwise be harmed by the merger. Defendants agree that they will abide by the proposed Final Judgment, and that they may be held in contempt of this Court for failing to comply with any provision of the proposed Final Judgment that is stated specifically and in reasonable detail, as interpreted in light of this procompetitive purpose.

Paragraph XVI(C) of the proposed Final Judgment provides that should the Court find in an enforcement proceeding that Defendants have violated the Final Judgment, the United States may apply to the Court for a one-time extension of the Final Judgment, together with such other relief as may be appropriate. In addition, in order to compensate American taxpayers for any costs associated with the investigation and enforcement of violations of the proposed Final Judgment, Paragraph XIV(C) provides that in any successful effort by the United States to enforce the Final Judgment against a Defendant, whether litigated or resolved prior to litigation, that Defendant agrees to reimburse the United States for attorneys' fees, experts' fees, or costs incurred in connection with any enforcement effort, including the investigation of the potential violation.

Finally, Section XVII of the proposed Final Judgment provides that the Final Judgment shall expire ten (10) years from the date of its entry, except that after five (5) years from the date of its entry, the Final Judgment may be terminated upon notice by the United States to the Court and Defendants that the divestitures have been completed and that the continuation of the Final Judgment is no longer necessary or in the public interest.

The divestiture provisions of the proposed Final Judgment will eliminate the anticompetitive effects of the acquisition in the provision of GP HSMs.

IV. REMEDIES AVAILABLE TO POTENTIAL PRIVATE LITIGANTS

Section 4 of the Clayton Act, 15 U.S.C. § 15, provides that any person who has been injured as a result of conduct prohibited by the antitrust laws may bring suit in federal court to recover three times the damages the person has suffered, as well as costs and reasonable attorneys' fees. Entry of the proposed Final Judgment will neither impair nor assist the bringing of any private antitrust damage action. Under the provisions of Section 5(a) of the Clayton Act, 15 U.S.C. § 16(a), the proposed Final Judgment has no prima facie effect in any subsequent private lawsuit that may be brought against Defendants.

V. PROCEDURES AVAILABLE FOR MODIFICATION OF THE PROPOSED FINAL JUDGMENT

The United States and Defendants have stipulated that the proposed Final Judgment may be entered by the Court after compliance with the provisions of the APPA, provided that the United States has not withdrawn its consent. The APPA conditions entry upon the Court's determination that the proposed Final Judgment is in the public interest.

The APPA provides a period of at least sixty (60) days preceding the effective date of the proposed Final Judgment within which any person may submit to the United States written comments regarding the proposed Final Judgment. Any person who wishes to comment should do so within sixty (60) days of the date of publication of this Competitive Impact Statement in the Federal Register, or the last date of publication in a newspaper of the summary of this Competitive Impact Statement, whichever is later. All comments received during this period will be considered by the United States Department of Justice, which remains free to withdraw its consent to the proposed Final Judgment at any time prior to the Court's entry of judgment. The comments and the response of the United States will be filed with the Court. In addition, comments will be posted on the United States Department of Justice, Antitrust Division's internet website and, under certain circumstances, published in the Federal Register.

Written comments should be submitted to:

Aaron Hoag

Chief, Technology and Financial Services Section

Antitrust Division

United States Department of Justice

450 Fifth Street, N.W., Room 7100

Washington, DC 20530

The proposed Final Judgment provides that the Court retains jurisdiction over this action, and the parties may apply to the Court for any order necessary or appropriate for the modification, interpretation, or enforcement of the Final Judgment.

VI. ALTERNATIVES TO THE PROPOSED FINAL JUDGMENT

The United States considered, as an alternative to the proposed Final Judgment, a full trial on the merits against Defendants. The United States could have continued the litigation and sought preliminary and permanent injunctions against Thales' acquisition of Gemalto. The United States is satisfied, however, that the divestiture of assets described in the proposed Final Judgment will preserve competition for the provision of GP HSMs in the United States. Thus, the proposed Final Judgment would achieve all or substantially all of the relief the United States would have obtained through litigation, but avoids the time, expense, and uncertainty of a full trial on the merits of the Complaint.

VII. STANDARD OF REVIEW UNDER THE APPA FOR THE PROPOSED FINAL JUDGMENT

The Clayton Act, as amended by the APPA, requires that proposed consent judgments in antitrust cases brought by the United States be subject to a 60-day comment period, after which the court shall determine whether entry of the proposed Final Judgment “is in the public interest.” 15 U.S.C. § 16(e)(1). In making that determination, the court, in accordance with the statute as amended in 2004, is required to consider:

(A) the competitive impact of such judgment, including termination of alleged violations, provisions for enforcement and modification, duration of relief sought, anticipated effects of alternative remedies actually considered, whether its terms are ambiguous, and any other competitive considerations bearing upon the adequacy of such judgment that the court deems necessary to a determination of whether the consent judgment is in the public interest; and

(B) the impact of entry of such judgment upon competition in the relevant market or markets, upon the public generally and individuals alleging specific injury from the violations set forth in the complaint including consideration of the public benefit, if any, to be derived from a determination of the issues at trial.

15 U.S.C. § 16(e)(1)(A) & (B). In considering these statutory factors, the court's inquiry is necessarily a limited one as the government is entitled to “broad discretion to settle with the defendant within the reaches of the public interest.” United States v. Microsoft Corp., 56 F.3d 1448, 1461 (D.C. Cir. 1995); see generally United States v. SBC Commc'ns, Inc., 489 F. Supp. 2d 1 (D.D.C. 2007) (assessing public interest standard under the Tunney Act); United States v. U.S. Airways Group, Inc., 38 F. Supp. 3d 69, 75 (D.D.C. 2014) (explaining that the “court's inquiry is limited” in Tunney Act settlements); United States v. InBev N.V./S.A., No. 08-1965 (JR), 2009 U.S. Dist. LEXIS 84787, at *3 (D.D.C. Aug. 11, 2009) (noting that the court's review of a consent judgment is limited and only inquires “into whether the government's determination that the proposed remedies will cure the antitrust violations alleged in the complaint was reasonable, and whether the mechanism to enforce the final judgment are clear and manageable”).

As the United States Court of Appeals for the District of Columbia Circuit has held, under the APPA a court considers, among other things, the relationship between the remedy secured and the specific allegations in the government's complaint, whether the decree is sufficiently clear, whether its enforcement mechanisms are sufficient, and whether the decree may positively harm third parties. See Microsoft, 56 F.3d at 1458-62. With respect to the adequacy of the relief secured by the decree, a court may not “engage in an unrestricted evaluation of what relief would best serve the public.” United States v. BNS, Inc., 858 F.2d 456, 462 (9th Cir. 1988) (quoting United States v. Bechtel Corp., 648 F.2d 660, 666 (9th Cir. 1981)); see also Microsoft, 56 F.3d at 1460-62; United States v. Alcoa, Inc., 152 F. Supp. 2d 37, 40 (D.D.C. 2001); InBev, 2009 U.S. Dist. LEXIS 84787, at *3. Instead:

[t]he balancing of competing social and political interests affected by a proposed antitrust consent decree must be left, in the first instance, to the discretion of the Attorney General. The court's role in protecting the public interest is one of insuring that the government has not breached its duty to the public in consenting to the decree. The court is required to determine not whether a particular decree is the one that will best serve society, but whether the settlement is “within the reaches of the public interest.” More elaborate requirements might undermine the effectiveness of antitrust enforcement by consent decree.

Bechtel, 648 F.2d at 666 (emphasis added) (citations omitted).^[1]

In determining whether a proposed settlement is in the public interest, a district court “must accord deference to the government's predictions about the efficacy of its remedies, and may not require that the remedies perfectly match the alleged violations.” SBC Commc'ns, 489 F. Supp. 2d at 17; see also U.S. Airways, 38 F. Supp. 3d at 74-75 (noting that a court should not reject the proposed remedies because it believes others are preferable and that room must be made for the government to grant concessions in the negotiation process for settlements); Microsoft, 56 F.3d at 1461 (noting the need for courts to be “deferential to the government's predictions as to the effect of the proposed remedies”); United States v. Archer-Daniels-Midland Co., 272 F. Supp. 2d 1, 6 (D.D.C. 2003) (noting that the court should grant “due respect to the government's prediction as to the effect of proposed remedies, its perception of the market structure, and its views of the nature of the case”). The ultimate question is whether “the remedies [obtained in the decree are] so inconsonant with the allegations charged as to fall outside of the `reaches of the public interest.' ” Microsoft, 56 F.3d at 1461 (quoting United States v. Western Elec. Co., 900 F.2d 283, 309 (D.C. Cir. 1990)). To meet this standard, the United States “need only provide a factual basis for concluding that the settlements are reasonably adequate remedies for the alleged harms.” SBC Commc'ns, 489 F. Supp. 2d at 17.

Moreover, the court's role under the APPA is limited to reviewing the remedy in relationship to the violations that the United States has alleged in its complaint, and does not authorize the court to “construct [its] own hypothetical case and then evaluate the decree against that case.” Microsoft, 56 F.3d at 1459; see also U.S. Airways, 38 F. Supp. 3d at 75 (noting that the court must simply determine whether there is a factual foundation for the government's decisions such that its conclusions regarding the proposed settlements are reasonable); InBev, 2009 U.S. Dist. LEXIS 84787, at *20 (“the `public interest' is not to be measured by comparing the violations alleged in the complaint against those the court believes could have, or even should have, been alleged”). Because the “court's authority to review the decree depends entirely on the government's exercising its prosecutorial discretion by bringing a case in the first place,” it follows that “the court is only authorized to review the decree itself,” and not to “effectively redraft the complaint” to inquire into other matters that the United States did not pursue. Microsoft, 56 F.3d at 1459-60.

In its 2004 amendments,^[2] Congress made clear its intent to preserve the practical benefits of utilizing consent decrees in antitrust enforcement, adding the unambiguous instruction that “[n]othing in this section shall be construed to require the court to conduct an evidentiary hearing or to require the court to permit anyone to intervene.” 15 U.S.C. § 16(e)(2); see also U.S. Airways, 38 F. Supp. 3d at 76 (indicating that a court is not required to hold an evidentiary hearing or to permit intervenors as part of its review under the Tunney Act). This language explicitly wrote into the statute what Congress intended when it first enacted the Tunney Act in 1974. As Senator Tunney explained: “[t]he court is nowhere compelled to go to trial or to engage in extended proceedings which might have the effect of vitiating the benefits of prompt and less costly settlement through the consent decree process.” 119 Cong. Rec. 24,598 (1973) (statement of Sen. Tunney). Rather, the procedure for the public interest determination is left to the discretion of the court, with the recognition that the court's “scope of review remains sharply proscribed by precedent and the nature of Tunney Act proceedings.” SBC Commc'ns, 489 F. Supp. 2d at 11. A court can make its public interest determination based on the competitive impact statement and response to public comments alone. U.S. Airways, 38 F. Supp. 3d at 76. See also United States v. Enova Corp., 107 F. Supp. 2d 10, 17 (D.D.C. 2000) (noting that the “Tunney Act expressly allows the court to make its public interest determination on the basis of the competitive impact statement and response to comments alone”); S. Rep. No. 93-298 93d Cong., 1st Sess., at 6 (1973) (“Where the public interest can be meaningfully evaluated simply on the basis of briefs and oral arguments, that is the approach that should be utilized.”).

VIII. DETERMINATIVE DOCUMENTS

There are no determinative materials or documents within the meaning of the APPA that were considered by the United States in formulating the proposed Final Judgment.

Dated: February 28, 2019

Respectfully submitted,

Kelly M. Schoolmeester

(D.C. Bar # 1008354)

United States Department of Justice, Antitrust Division, Technology and Financial Services Section, 450 Fifth Street, N.W., Washington, DC 20530, Phone: [phone], Facsimile: [phone], Email: [e-mail].

Footnotes

1.  See also BNS, 858 F.2d at 464 (holding that the court's “ultimate authority under the [APPA] is limited to approving or disapproving the consent decree”); United States v. Gillette Co., 406 F. Supp. 713, 716 (D. Mass. 1975) (noting that, in this way, the court is constrained to “look at the overall picture not hypercritically, nor with a microscope, but with an artist's reducing glass”).

2.  The 2004 amendments substituted “shall” for “may” in directing relevant factors for a court to consider and amended the list of factors to focus on competitive considerations and to address potentially ambiguous judgment terms. Compare 15 U.S.C. § 16(e) (2004), with 15 U.S.C. § 16(e)(1) (2006); see also SBC Commc'ns, 489 F. Supp. 2d at 11 (concluding that the 2004 amendments “effected minimal changes” to Tunney Act review).