U.S. National Security Regulation of Information Technology Supply Chains and IT Infrastructure as a Service: (CFIUS-Style National Security Review for Cloud Computing, Software, Hardware, SaaS, IoT and Other Tech-Enabled Devices)

Regulation of IT Supply Chain after January 19, 2021 and after SolarWinds

On January 19, 2021, as a final act of the departing Trump administration, the Department of Commerce published an interim final rule (the “Rule”) and President Trump signed an Executive Order (the “Order”) to regulate U.S. information technology (“IT”) companies in transactions with foreign actors.  Entitled “Securing the Information and Communications Technology and Services Supply Chain,” the Rule is based on delegated authority under the International Emergency Economic Powers Act. The Order expands on an Executive Order issued May 15, 2019.   The Rule coincides with newspaper reports that some U.S. governmental agencies and other tech services companies downloaded malicious software from SolarWinds, a Texas tech services company reportedly with over 18,000 customers, that appears to have been hacked by foreign hackers.

Summary of New ITSC Regulation

As of January 19, 2021, any American business’s purchase of Information and Communications Technology and Services (“ICTS”) from “persons owned, controlled our under the jurisdiction or direction” of a “foreign adversary” is subject to a Commerce Department review for national security and critical dependency risks.  The Rule covers all ICTS Transactions where the tech or services are “designed, developed, manufactured or supplied” by such persons.  The Rule seeks to protect the American IT supply chain (“ITSC”).  No exemptions apply, regardless of your company’s size, industry or activities.  

The 2021 ITSC Rule follows the policies reflected in the 2018 amendments to laws governing virtually all foreign acquisitions of U.S. tech companies, under scrutiny for national security by the Committee on Foreign Investment in the United States (“CFIUS”).  To avoid duplication, the Rule states it does not apply to ICTS Transactions that CFIUS is actively reviewing, unless the ICTS Transaction is distinct from a CFIUS-reviewed transaction.  Like the CFIUS review process, the Commerce Department can identify a mechanism and relevant factors for the negotiation of agreements to mitigate concerns raised in connection with the Order.

The ITSC Rule

Scope of ITSC Transactions

Virtually every digital service and product is covered, regardless whether it handles a single computer, a computer network, cloud service, telecommunications switches or just individual product data.

Definition of ICTS.  The Rule defines “Information and communications technology or services or ICTS” to mean “any hardware, software, or other product or service, including cloud-computing services, primarily intended to fulfill or enable the function of information or data processing, storage, retrieval, or communication by electronic means (including electromagnetic, magnetic, and photonic), including through transmission, storage, or display.”

Definition of ICTS Transaction.  Under the Rule, “ICTS Transaction” means any acquisition, importation, transfer, installation, dealing in, or use of any information and communications technology or service, including ongoing activities, such as managed services, data transmission, software updates, repairs, or the platforming or data hosting of applications for consumer download. An ICTS Transaction includes any other transaction, the structure of which is designed or intended to evade or circumvent the application of the Executive Order.”

Broad Scope.  In its preliminary discussion of ITSC vulnerabilities, the Commerce Department clearly intended to include SaaS (software as a service), Infrastructure as a Service, Cloud data storage and computing, IoT Internet-devices embedded in consumer goods, mobile phones and their Apps, Web browsers, drones and networked surveillance cameras.  

“Foreign Adversaries.”  The list of “foreign adversaries” consists of the following foreign governments and non-government persons: the People's Republic of China, including the Hong Kong Special Administrative Region; the Republic of Cuba; the Islamic Republic of Iran; the Democratic People's Republic of Korea; the Russian Federation; and Venezuelan politician Nicolás Maduro (Maduro Regime).

Effective Date of Rule

The Rule applies to any ICTS Transaction that is initiated, pending, or completed on or after January 19, 2021.  Further, any act or service with respect to an ICTS Transaction, such as execution of any provision of a managed services contract or installation of software updates, is an ICTS Transaction on the date that the service or update is provided.

Future Compliance Impact

The ITSC Rule imposes potentially costly compliance obligations for risk identification, assessment and regulatory licensing.  The Rule serves as a boycott of technologies from “foreign adversaries” unless approved by a Commerce Department license.  There are civil and criminal penalties, but prosecution of millions of small businesses is not practical.  Assuming the Biden Administration pursues the Rule, the scope will change the landscape for everyone, including our foreign trading partners, with potential retaliation by “foreign adversaries.”

If implemented, the ITSC Rule will likely generate a hornet’s nest in the business world and international politics.  But the reported SolarWinds hacking supports the logic of greater transparency in IT supply chains.

ICT Company Burdens.  ICT providers will need to verify countries of origin and give warranties about their extended ICT supply chains.  Even absent a legal requirement, there will be an increased need to document supply chain risk management analysis in the event an ITSC transaction is investigated by the Commerce Department.  ICT services companies must now identify the nationality, origin, foreign control and sensitivity of data that flow through their digital infrastructures.   

Corporate Governance.  Corporate boards, officers, purchasing and procurement departments and strategic planners will need to identify the risks across a potentially multi-layered IT supply chain.  How much should a board spend on verification?  Is an ICTS supplier’s self-certification sufficient?  Will an independent sourcing audit become the norm?  What should be the policy, the process and the budget?

Information Governance.  New Information Governance ("IG") policies and procedures will be needed for ITSC risk management and regulatory licensing compliance.

Privacy and Cyber-Security Risk Management.  The ITSC Rule will highlight special risk management procedures, and perhaps insurance, that relate to compliance with privacy laws, such as the California Consumer Privacy Act (to be replaced in 2023 by a Consumer Privacy Rights Act) and potentially EU’s GDPR and draft Digital Services Act.

Antitrust and Competition Law.  If Google or other dominant market player were to insist that its European subsidiaries buy only from suppliers complying with the ITSC Rule, that would have the effect of exporting American ITSC risk management compliance.  Foreign local suppliers sourcing from a “foreign adversary” would be barred.  This would be a secondary boycott unless a Commerce Department license were granted.

Best Practices for Vetting: Know Your IT Service Provider.  If they don’t already do so, enterprise customers will include an ITSC Transaction questionnaire in their requests for proposals, requests for quotations and master services agreements.  ICT agreements will include warranties and rights to audit and inspect supply chain information.  Chief Information Security Officers (CISO’s) will push for more certifications by “ethical hackers” -- independent third party testers of malware – and perhaps even direct testing.

Redrawing Supply Chains and Strategic Alliances.  Geographic and national security issues will translate into modifications in supply chains, starting with digital business models and leading into all enterprise strategic alliances, global business services, outsourcing services providers and shared services centers.  Procurement and IT departments will also examine the impact across strategic sourcing, supplier management, assessment of third party risks, artificial intelligence and robotic/intelligent process automation.

M&A and Corporate Finance.  New representations and warranties will appear in die diligence and documentation for business valuation, corporate finance and M&A transactions.

Audits.  Accountants will require ITSC audits before certifying or commenting on financial statements, which could include disclaimers as to an entity’s viability due to “incomplete” ITSC disclosures.

Cyber-risks, Hacking, Cyber-Security and Privacy.  The new Rule concerns national security, digital security, privacy and extortion.  “This [potential] data exfiltration—supported by U.S. web data hosting and storage servers—threatens to allow foreign adversaries to exploit Americans' personal and proprietary information by allowing a foreign adversary to track the locations of Americans, build dossiers of sensitive personal data for blackmail, and conduct corporate espionage from inside the borders of the United States.” Cyber-insurance policies will need to be revised to impose underwriting constraints and higher premiums on non-conforming insured enterprises.

International Trade Agreements.  In light of the reported SolarWinds hacking, President Biden will need to decide how stringently to enforce the Trump administration’s ICTS Rule.  New trade agreements might create group action against the same “foreign adversaries.”  Conflicts with allies may arise as to ICT products designed or manufactured in a trade ally country by a subsidiary from a “foreign adversary.”  For example, the Chinese tech company Huawei is planning to build 5G telecom products in France, potentially for sale to other trade allies.

How to Get a Department of Commerce License.  

Assuming a company plans to update or sign up for any "foreign adversary" technologies, a license will be needed.  To afford parties greater certainty, the Commerce Department intends to publish, within 60 days after January 19, procedures to allow a party or parties to a proposed, pending, or ongoing ICTS Transaction to seek a license.  Implementation is scheduled within 120 days after January 19.  The change from President Trump to President Biden will determine how this Rule plays out in March and May 2021.

This summary is not legal advice.  These matters are subject to change.  If you have any questions or comments, please feel free to contact us. (C) 2021 W.Bierce.

     

Corporate Governance Fiasco at WeWork, Crisis Management Playbook and Lessons Learned: The Expulsion of Adam Neumann from the Garden of Eden

Adam Neumann founded WeWork in 2010 but was expelled from management functions as CEO of the company (newly named The We Company) in September 2019.  He became non-executive Chairman of the Board.¹   These changes were adopted by The We Company Board of Directors (undoubtedly after consulting shareholders).  The changes followed a disastrous aborted IPO that overvalued the company at $47 billion.  The withdrawn IPO will result in cash flow shortages for ordinary operations, unless the bleeding is stopped. 

Mr. Neumann’s fall from grace last week comes right out of the biblical Garden of Eden (eating forbidden fruit), Greek tragedy (blind hubris) and Dante’s Inferno Ninth Circle (betrayal of trust of family, community and country).   There must be a better way to run a closely held company.

The loss of cash anticipated from the failed IPO created a dramatic need for cash to sustain operations.  Let’s look at changes in corporate governance and new strategies for crisis management strategies.

Corporate Governance. 

Board Duties.  In this case, Delaware law governs The We Company’s governance. Decision-making is done by the Board of Directors, appointed and removable by the voting stockholders.   The directors have a fiduciary duty to act prudently, a duty of loyalty to avoid self-dealing and a duty of care to justify the reasonableness of exercising their business judgment.

Board Actions.  Here, the Board and voting stockholders appear to have been captured and mesmerized by a flamboyant and extravagant founder engaged in self-dealing.  The Board approved, or did not discipline, apparent self-dealing of hiring Mr. Neumann’s many friends and family as employees.  The Board appears to have allowed but then rescinded a deal for Mr. Neumann’s sale to the company of a trademark registration for $1.6 million or so; however, the timing of discovery and rescission are apparently not public. The Board allowed the purchase of a $60 million private Gulfstream jet for Mr. Neumann’s use.  The Board approved dealings where Mr. Neumann, his family and even other members of the Board are the landlord and the company is the tenant.  In their risk analysis on SEC Form S-1 filed with the SEC August 14, 2019, the company admitted:

“We have engaged in transactions with related parties, and such transactions present possible conflicts of interest that could have an adverse effect on our business and results of operations.  We have entered into a number of transactions with related parties, including our significant stockholders, directors and executive officers and other employees. … we may have achieved more favorable terms if such transactions had not been entered into with related parties and these transactions, individually or in the aggregate, may have an adverse effect on our business and results of operations or may result in government enforcement actions or other litigation.”

This looks like an invitation for a class action by future stockholders after an IPO.

The Board approved spending of over $500 million for acquisitions (arguably, for “diversification” and “synergies”).   Such investments generated revenues but arguably were different lines of business that would not build the core business.  The investments include WeGrow (pre-school and elementary education), Rise by We (fitness club), WeLive (rentals of dorm-like apartments), Meetup.com (event planning) and Conductor (search engine optimization).

The Board’s actions appear responsible for precipitating a crisis of trust.  The Board authorized the IPO documentation that did not provide segmented accounting by line of business.  The SEC Form S-1 omitted other information that one might consider “material.”  Investors rejected the IPO valuation of $47 billion and complained.  The Board has now withdrawn the public offering.

Crisis Management Playbook.

Board Action.   Having backed itself into a crisis, the Board took steps to rectify all of its apparent past neglect.  It terminated the founder’s employment.

Stockholder Action.  The stockholders appointed Mr. Neumann as non-executive chairman of the Board.  This action solved a lot of conflicts. It satisfied Mr. Neumann’s need to continue in some form of management.  It satisfied the stockholders’ need to remove him from operations while preserving whatever goodwill is associated with his inspirational reputation.

More significantly, the stockholders kept Mr. Neumann’s feet to the “fiduciary fire” so that he would be held responsible for future decisions that he approved.  Thus, Mr. Neumann’s personal rights (as stockholder) to complain about future Board decisions would be coopted and any bad decisions he approves henceforth will be subject to his responsibility for participating in and approving them. And he signed a voting agreement that substantially dilutes his super majority voting control.

Action Steps in Crisis Management.  The Board’s cleanup crew focused on reform of leadership and cash management.

Nepotism and Cronyism.  The Board fired Mr. Neumann’s wife and about 20 members of his family and friends, who held senior positions.  A crisis transition will occur, where pending projects will need to be identified, prioritized and terminated or re-adopted under increased Board supervision.  A new leader, free of prior association with Mr. Neumann’s entrancement, will guide as CEO.

Board Structure.  The Board may be increased to include more directors, who will be assigned to committees.  There will be significant changes in the role of directors including independent directors.

Cash Management.   Since the IPO documents revealed that expenses were growing as fast as revenues, cash management becomes a priority for survival.  SoftBank was reportedly ready to contribute another $10 billion when it was valued at $47 billion, but the valuation is now more in the range of $15 billion according to estimates.  Further, SoftBank’s own leadership has undoubtedly been questioned by its investors for having acquiesced in Mr. Neumann’s management “mistakes.”  So cash management can be expected to result in significant emergency restructuring.  This could involve:

• New scrutiny of all elements of the company’s business to revise:

• its value proposition
• its core business (which incidentally can be reviewed by looking at recent trademark applications)
• its risk management and resiliency plan
• cash flow requirements
• operational reporting for greater transparency

• Mass layoffs of persons not closely tied to the core real estate leasing operations
• Sales of ancillary companies that, while profitable, are not “core” businesses
• Termination of “non-core” projects
• Demands for recovery of expenses incurred by Mr. Neumann and his “oval office” coterie of family and friends that had “no relation” to the company’s business
• Possible renegotiation of lease terms or requiring Mr. Neumann to assign his rights as landlord to a third party where he controls WeWork’s landlord
• Tax audits and amended income tax returns to reflect higher income and reduced deductible expenses from personal projects that a tax auditor might assert was a personal expense
• Slower expansion
• Termination of certain low-performance real estate projects that generate losses
• An increase in the coverage limits for the company’s directors’ and officers’ liability insurance coverages
• A new formulation and new solicitation of private equity, with a “down round” that values the company at less than the valuation agreed when SoftBank had invested.

Liability Management.  A crisis plan can help reduce the risk of shareholder litigation against the Board and officers as well as against SoftBank.  The “good governance” bullet that killed Mr. Neumann’s CEO role ricocheted towards SoftBank and its leader Masayoshi Son, whose own investors apparently revolted in Japan.  This crisis plan will help SoftBank justify additional capital contributions at a lower valuation, assuming SoftBank’s investors will approve it.

For other closely held businesses, the lessons are clear.  It might be time to restructure your corporate governance with new policies, procedures, practices and internal controls.

¹ For history, The We Company, SEC Form S-1 (Aug. 14, 2019) and Elliot Brown, Anupreeta Das and Maureen Farrell, “WeWork to Push Out Staff Close to Ex-CEO,” Wall St. J. Sept. 27, 2019, pp. A1, cols. 4-5, p. A8, cols 3-6; Eliot Brown, “WeWork’s Adam Neumann Runs on Excess,” Wall St. J. Sept. 19, 2019, pp. 1, cols. 5-6; p. A8, cols. 1-6.

Board of Directors’ Governance Duties on Privacy, Compliance and Sexual Harassment: How to avoid “Falling Flat on your Facebook”

Corporate Directors must manage the company for the best in interests of stockholders and, in general, to ensure the company complies with its regulatory and contractual obligations.  Today, every company undertakes some digital transformation, using Cloud, social media, mobile devices, Big Data, analytics and potentially virtual reality, augmented reality, robotic process automation and sensor-driven “Internet of Things” like self-driving vehicles and remote controls using mobile devices. But the benefits of digital transformation come with many disruptive risks such as cyber security breaches, privacy violations that will cost serious money under the EU’s General Data Protection Regulation effective May 25, 2018, etc.  The scalability of tech “solutions” invites hackers and thieves.  At best, the company’s reputation is tarnished.

In a new threatening world, the “business judgment” rule protecting corporate directors and officers from personal liability requires greater vigilance and broader risk management.  A corporate director’s personal liability for the misdeeds of the corporation and its employees depends on how well the director planned for and responds to the “inevitable” corporate governance disaster such as:

• Neglect of safety of its workers or consumers using a useful but potential dangerous product;
• Abuses of consumer trust, such as setting up fictitious bank accounts to reward employees, without customer knowledge;
• A claim of persistent sexual harassment by the CEO (à la Steve Wynn) or;
• A business model based on unrestrained data aggregation and the “unforeseen” problem of unauthorized access or use by an authorized third parties data broker to the personal data of millions of online subscribers worldwide (à la Facebook and Cambridge Analytica).

Here are my suggestions for good corporate governance, risk management and compliance in response to digital transformation.  Just as lawyers have a duties of confidentiality and competency in technology, corporate directors have a duty of risk identification and threat management.

1. Maintaining Independent Judgment despite Lack of Control Anticipating

It may be impossible to fulfill the directors’ duty of loyalty and to maintain one’s independent judgment if the CEO owns a majority of voting control of the company’s voting shares.  That’s the case for Facebook, where Mark Zuckerberg, founder and CEO, owns about 10% of the shares but controls a majority of voting rights.  If you displease the CEO, you could get fired from the board of a valuable and prestigious company.  If you don’t displease the CEO, you might not have exercised independent judgment.   So you need to identify and implement measures that will be best for the company, which could include mandating certain actions by the CEO who is in control of your position as director.  And your D&O insurance carrier expects nothing less so as to mitigate any payouts on the inevitable derivative claims by shareholders.

2. Identify Worst Scenarios for Your Particular Business and Your Value Chain

From an insurer’s perspective, risk management requires identification and assessment of risks for probability and adverse impact. The digital economy increases the number and nature of risks.

Public companies must identify their risk profile in their quarterly and annual SEC reports.  Private companies must likewise disclose key risks on private placement memoranda, loan applications, and prospective acquirers in shareholder meetings under the principle of shareholder democracy.  For Wynn Resorts, an empire built on gambling casinos and flashy entertainment, the risks of sexual predation by the founder, who has access to private suites and private transportation, was predictable to directors who focus on high-probability risk analysis.   For Facebook, a director who understands the business model of vacuuming personal data from subscribers and their network of “friends” for resale to “data consolidators” like Cambridge Analytica could predict a failure of accountability in the value chain.  At a minimum, all supply chain contracts should guarantee that the corporation’s trusted data and business secrets will be protected and that any governmental mandates (such as privacy protections) applicable to the supplier’s services should flow down to the supplier.

Since worst case scenarios change over time, anticipating how changes in laws, politics and public opinion becomes part of the director’s job too.  No one asked, but it’s your duty to worry and plan.

3. Insulate and Compartmentalize Processes; Identify Failure Switches

The Titanic sank because it hit an iceberg at high speed at night.  Appropriately, the captain went down with the ship, but so did many hundreds more.  The ship was designed to withstand four breached compartments, but not five.  The lessons today are, don’t accelerate in risky waters and insulate and compartmentalize to insulate the business operation from cumulative, cascading risks.

For international companies, a private cloud might effectively limit risk.  Minimization of cross-border transfers of sensitive personal data can be done by using multiple servers, two in each country (the second is for failover).   Insulation can also be achieved by pseudonymization, a new concept advocated by the EU’s GDPR that stops short of full encryption but achieves compliance … until the code is broken.

4. Incentivize Prudent Behaviors by Employees

Wells Fargo made the mistake of incentivizing its bank branch officers to create new accounts not requested by the customers.  The IT department and compliance departments were asleep and could have stopped this fraud.  While few customers were adversely affected, some suffered.  So, prudent employees should be rewarded for not taking excessive risks and, in a complex organization, be encouraged to question the validity and prudence of decisions in other departments, especially where teamwork is needed for global integration.  And maybe consider small penalties for thoughtless behaviors, like opening spam attachments.

5. Monitor Compliance by Internal and External Audits

An airtight outsourcing service agreement does not guarantee compliance.   In the world of “Tech As A Service,” SaaS agreements should still require service providers to hire trusted independent external auditors for cybersecurity and business process management.   Audits under SSAE 16 type 2 and ISO compliance principles are no guarantee, but they help demonstrate prudent business judgment.

6. Appointing Compliance Officer Reporting to the Board

While compliance should be built into the company’s DNA through leadership at the top and company policy manuals, appointing an internal auditor and compliance office can give the directors access to someone who worries for them.

7. Run Away at Your Own Risk

Normally, a director has the remedy of resigning as director in case of policy differences that cannot be reconciled.  But running away might not be possible.   In tort law, the doctrine of “last clear chance” imposes liability on the actor who fails to use all reasonable efforts, at the last minute before a disaster, to protect the imminent victim from a third-party’s foreseeable misdeeds.  In corporate law, the fiduciary duty of loyalty may include a duty to not leave the corporation stranded when it falls into difficulties, since a new director might not be able to rectify the problems as quickly as the knowledgeable director seeking to walk away.   So the director’s job is never done, especially if there is no easy alternative but to persevere in the exercise of prudent business judgment.  No one hired you to quit when the risks are high and no one else can do a quick turn-around.

8. Identify Your Goals as Director and Apply Early Warning Systems

In the 1960’s, the NORAD “distant early warning” system deployed advanced radar to identify incoming hostile missiles.  Today’s corporate director needs a system for identifying goals personally and for the corporation, with metrics, triggers and analytics for situations hostile to the corporation.  If you don’t have the time or courage to set up your own warning systems, you might consider letting someone else do the job.  Or characterize your role as “just an advisor” to the board.