National Security Law Firm

The national security system (NSS) requirements establish minimum standards for government contractors’ IT systems and data security protocols. Government contractors must comply with the NSS requirements for any systems that involve: (i) intelligence activities, (ii) cryptologic activities related to national security, (iii) command and control of military forces, (iv) requirement that is an integral part of a weapon(s) system, (v) critical assets for fulfilling military or intelligence missions, or (vi) areas designated as classified in the interest of national defense or foreign policy by an Executive Order or Congressional act.

Exporting products overseas can have a variety of national security implications. The same is true of exporting sensitive data to many foreign countries. Depending on the nature of the product or data a company is seeking to export, it may need to comply with various federal laws and regulations, and its exporting activities may be subject to the oversight of OFAC, DDTC, BIS, CBP, and other federal agencies.

Determining whether an embargo or other trade restriction applies to a particular entity or transaction isn’t necessarily an easy process. Companies must work with their counsel to review OFAC’s SDN list and potentially a variety of other sources as well. But, while determining whether an embargo or other trade restriction applies isn’t easy, it is extremely important, as attempting to do business with a blocked entity or foreign national can lead to asset seizures, federal investigations, and other consequences.

Under amendments to CFIUS’s Rules adopted in 2020, transactions that require CFIUS review generally fall into two broad categories: (i) controlling transactions and (ii) covered investments. In both cases, CFIUS review is only triggered if the transaction or investment involves a “critical technology,” which is determined based on the applicable set of federal export regulations (i.e., EAR or ITAR).

Controlling transactions are those that involve a majority stake or other controlling interest in a U.S. company that designs, produces, or manufactures critical technologies. Covered investments are those that do not involve controlling ownership interests, but that nonetheless afford oversight or decision-making authority to a foreign entity.

The duration of a CFIUS review is determined by various factors, including the nature of the critical technology involved and the complexity of the transaction at issue. While some CFIUS reviews can take as little as 15 days, in many cases companies should expect to wait 90 days or longer. Engaging outside law firms experienced in working with CFIUS can help to expedite the process in many cases.

Yes, companies can face a variety of federal penalties for compromising national security. This includes penalties that are administrative, civil, or criminal in nature. From the Foreign Corrupt Practices Act (FCPA) to the Foreign Investment and National Security Act of 2007, several federal laws establish corporate compliance obligations in the national security realm, and some of these laws (i.e., the FCPA) include provisions for civil and criminal investigations and criminal enforcement.

Yes, in addition to pursuing enforcement actions and criminal investigations and prosecution at the corporate level, federal authorities can (and do) pursue charges against company executives, board members, and other individuals when warranted. In these cases, not only can targeted individuals face substantial fines; but, in criminal cases, federal imprisonment can be on the table as well.

There are no restrictions for foreign ownership or occupation of property. The national security issues come with foreign ownership of US business and investments, especially those involving officials of foreign governments.

One industry that requires special attention and safeguards is defense contractors. One of the safeguards for defense contractors and their procedures is the National Industrial Security Program, which takes precautions to make sure the defense contractor keeps the information they’re privy to through their security clearances confidential. Another safeguard is the Foreign Intelligence Surveillance Act, which allows for the national intelligence community and national security agencies to use electronic surveillance for matters of national security.