Article

Presence of classified information imposes constraints on defense deal execution

Presence of classified information imposes constraints on defense deal execution
Investing in targets that hold sensitive government information can introduce layers of complexity when executing deals. Here we explore the issues investors need to look for, and how potential risks can be mitigated.
Summary

Investments involving classified data face strict national security regulations, with risks including contract cancellation, loss of clearances, and potential criminal liability if mishandled.

Security clearance requirements exist at multiple levels, including facility, personnel, and site clearances, and a change in ownership may require structural safeguards to be implemented.

Many jurisdictions have specialized screening regimes for defense investments, often requiring governance changes, firewalls, and commitments to protect sensitive information from foreign influence.

The due diligence process is complicated by information gaps, as deal teams may need clearances to access sensitive contracts, and the scope of possible regulatory conditions is broader than in other investment contexts.

For private capital firms investing in the defense sector, dealing with classified information and security clearances presents distinct challenges that can fundamentally shape deal execution.

Defense investments are often subject to strict national security restrictions that govern the disclosure, handling, exchange, and dissemination of sensitive information, and which operate independently of, and in addition to, foreign direct investment (FDI) screening regimes. Here the consequences of missteps can range from the loss of government contracts and security clearances to criminal liability.

Security clearances operate at multiple levels: facility clearances (formal certifications verifying that an organization can securely handle, store, and process classified government information on their own premises and that physical, IT, and personnel security procedures meet government standards); personnel clearances for key individuals and board members; and in some jurisdictions, clearances specific to physical sites.

Change of control can result in government contracts and security clearances being lost

A change in ownership can trigger two distinct consequences. First, contractual change of control clauses may cause the cancellation or non-renewal of sensitive government contracts held by the target. Second, security clearances themselves may be lost if a new owner does not meet national security requirements. To mitigate these risks, investors may need to implement structural measures such as voting trusts or proxy agreements to address potential foreign ownership, control, or influence (FOCI) concerns.

In the United States, investors targeting businesses with access to classified government information must navigate a process outside of the CFIUS FDI screening regime administered by the Defense Counterintelligence and Security Agency (DCSA).

The DCSA process addresses concerns surrounding foreign ownership, control, or influence (FOCI) over companies in the defense supply chain. Mitigating identified FOCI risks may require structural governance changes such as carving out the U.S. business; restricting board access; or entering into national security agreements that limit interaction between the U.S. operations and the non-U.S. acquirer. Parties must scope out what the DCSA (if it applies) and the CFIUS process will entail and potentially propose governance or structural changes in advance to secure the necessary approvals. Importantly, ensuring that the right individuals are in the room to help negotiate these measures is essential.

These issues are not unique to the U.S. Some EU member states are eyeing America’s FOCI model as a way to protect national security and industrial secrets. France for example is looking to place restrictions on foreign-controlled businesses to limit access to confidential information, including via governance mechanisms such as proxy boards.

In Spain, a specific screening regime for defense investments exists which sits outside the country’s general FDI screening framework. Here, investments in which a foreign buyer purchases 5% of a target’s share capital, or which allow a foreign investor to directly or indirectly form part of the company’s management body, are subject to scrutiny, with the regime giving authorities broad discretion to request remedies or negotiate commitments on inbound investors. 

Measures may entail establishing firewalls to protect sensitive information or assets; remedies to protect the “Spanish-hood” of the company’s management (potentially with mandates that directors be Spanish nationals); commitments regarding the provision of services to the Spanish market or clients; and the inclusion of domestic co-investors to enable local board-level oversight of how sensitive information is handled.

Deal teams may require security clearances to conduct due diligence

The mere presence of classified information in defense transactions presents additional complexities. Deal teams involved in M&A processes may be required to obtain security clearances to review certain contracts, and in some situations, it may not be possible for all sensitive agreements to be diligenced. This creates a fundamental information gap: when a buyer submits an application for investment approvals, the process may trigger concerns that it could not have known about in advance.

The sheer scope of potential conditions is also materially different from other types of investment reviews. In an antitrust context, for example, investors can generally anticipate regulatory challenges and propose “fix it first” solutions such as carve-outs or disposals to address overlapping product markets.

In defense transactions, not only could a government’s potential concerns be invisible due to the relevant information being restricted, but the range of conditions that could be imposed is also unpredictable. As a result, the degree of uncertainty in defense transactions is structurally greater than in other regulated sectors.

Given these dynamics, purchasers should avoid accepting “hell or high water” clauses in deals that involve conditions precedent relating to government approvals. Standard representations and warranties regarding completeness of disclosures may need to be adjusted to account for classified information controls.

Case study: classified information and data center deals

Classified information can also present challenges for private capital investors targeting assets that sit adjacent to the defense sector itself.

 

In Australia, any entity seeking to host or process government data must obtain government credentials, while data center operators in the government and defense space face a further layer of regulation under Australia's hosting certification framework. 

 

Data centers must be individually certified by the government before they can host classified material, through an application process that is both extensive and costly. Applicants are required to provide detailed information not only about the physical assets proposed for hosting, but about their entire ownership structure (traced up the chain) to ensure there is no foreign government or sovereignty risk. This can present issues to potential investors who cannot have certainty prior to the closing of a transaction that the Australian government will approve their hosting certification framework application.

 

In response, some operators maintain dedicated sites for government or defense purposes, though not all do; in either case, the operator must be structured to satisfy Australia’s regulatory requirements before it can host both government and non-government data.

Related capabilities