US Departmentof J11stice

NationalSecurity Di_vision

Waihiig1a11 oc 1053J

December 6 2017

F Whitten Peters Esquire Steye_n M Cady Esquire Williams amp Connolly LLP 725 12th Street NW washingtonl DQ-7opos

middot~middotfetcracerfechnology CorporationNon-Pro~cqti1niand Security

Agpemertt -

bearCounsel

The United StatesDepartment ofJli$tice (DOJ) National Secuiicy- Division and th_e United StatesAttorneys Office fodhe Eastern Distiict of Virginia (collective1Yi the bullioffices) hay~ investigate(lNetcqtckerTeqhn9logy C_piporation (themiddot Company) middotOr WfC) a corporation --organizedundet the laws ofMassmiddotachusett1fandmiddotheadquartered inMassach11setts regatdinginatters described in-the Statement ofFacts~atta~hed hereto fS Attachment A The Offices and NTC (the P~efhav~middotreached a niutttal ailreement tomiddot resltgtlve middotthe irtvestigaticm and enhance the middot$eC4ritymiddot0poundus teleeorrununicationsnetwotks by limitfo_g informatiortthat wirI middotbe- sentt6 stored in ~r access~d rrom-ov~is~1ocation~ AmQpg the factors lton$iclerid menterin~ intothis agreement were

-~) NJC is a software engiiIeerjng firnJ that_offers 11etwork soluti9ns that e~able-Jarge corporations t_o optimize network middotcotnmunications and operations NTCs gfobal clientele includes teleqommunfcatiolli-cornpaniesand larg~middoteI)t~rprisesmiddot middot

b) Lrne microiany software companies NTC and its subsfdiaries develop software using foteign)~chn_ical pmiddotetsonnel in th~ U nitedStates and mmiddota numb~ offor~igrrcountties

c) The use ofa global technfoaj wprkforce for themiddotcreatiQQ of_software andmiddotthe provision ufrelated serviceswhilea comnion and valuable businesspractice create concerns for the ~e_curity of sensitivemiddot individual data sensitive network data and critkal umiddots domestic ~mntunicatiqns infras~niot~e For example electronic ~omm1~tifoations to

-middotand from Russia~are subject to the Russian SystemofOperative-Inveslgative Mea~mres SORfylj -SORM authorizes thef ederal middotSecutify S~rvice_ of theRtissJail Fed~ration (FSB1) to coliect analyze and store information transmitted on Russian telecornrrtunicationsnetwotks

middot

d Given th~middotcyber tbieatmiddotposed by tQtegn govermnertt secutity agenci~s aaii_ cyber ctiininalsbull mapy ba$ed-offshore the Offices entered into dis9_ussi0ris Yith NTC about

steps that could be taken to minimize risks to sensitivemiddot individual ltlatcl sensitive network data and critical US domestic cpmmupicationsinfrastructwe whilemiddotrefainiirg _the value-oftisinga glqbal workforccent middot middot

e) Jn resp(mse_to tpe thre~t NTQ agre~d to implement- an Enhance4 -Security Plan middotattached h~reto as-Attachment B whCh the Offices believe )vill middotsubstantiiJ]y iniprove the se~urity of NTCs software a11tl any software that is developed middotusfog fo_leign technical workers 9perating_ 0ve~eas arid inmiddot the UIJited States Themiddot new secwity strtlctuie wHl limit themiddotfoforrnatiomiddotn- that will be sent to stored in cit accessed fromshyoverseas locationsand provi~s-protocols _forremovingor obscuring-sensitire data

f) The Enhanced$ecurity Pl~advances industry best practicesfor protecting sensitive information -aboiit u~stelec0mmW1ictitions networks~ and middotis middota- model that other ~o-inpaniesmiddotsho~(l foUoW In coru~~ction With criticaiinfrastnictitre applicatiotlS - -

In lightofNTCs assistance inmiddotprotectingsensitiVe individual data sensitive network-data and criticaimiddot(JS domestic communic_ations~frastrupture by implementing-the Enhanced Security Planat WTCs eXj_iehse-We Officeshaye decided to Close the investigation and ampssess no penalty_ provided that- NTC complies with this Noh-Prosecution Agreement (Agreemiddotment1ry -ind the Enhanc~ $ecur~ty Plan

NTC ~Q the Offices agree to work t9gether on apress release reflecting these _principles and NTC agtees iliat _if it or middotany of its direct -or indq~ct smicrobsidfarieS o( affilfates iss_ues a 1iress releltSe or hoids_ any press conference in connection with this Agreement the Company shall ftrst ~11$Ult middotthe Olfices tQ determine(a) whether the te~t of the release or propos_ed statementsmiddot at-the _pressmiddot conference are_ ttue and- aCcmicrorat~ with respict tQ rtrajters between ~e Offi_6es and ~he_ Compiny and (b) whether the Offices have_any objection to themiddotpro_posedreleaseor statement In the-eVent-of an obj_ectiQnbymiddotthe Offices to any prophsed-releasemiddot_or statement by N_TC NTC agrees nofto issue the release or statement unless the Offices objectionmiddothas been res0lvedto theDffi_CeS satisfacmicroon

Thi~ Agreem~nt is made middotby theCqmpanyand the-Offices as_middotofthe date of the last signature affixed_heret0 (Effcitive Datcent) middot middot

l Non-PrOsecutio~

In an effort to re_so_lye the investig~tion referencedmiddotabove and to pratect US national securitymiddotfrom ~authorized-acc~ss to US middottelecoffiIluili_~ationS networ~s (a JlTC Olttn~IY Jgrees that it will abi_de by thi= pritviSioM setmiddotforth in this Agreemerltand inmiddotthe Enhanced Security

PJan a~Ched heretomiddotas-Attachmeht_B fo_t the time periods set outbelow and (b) ihebffices agree that they will notl_gttosecutemiddotNTCot ahy of it~ present ormiddot forine~ officers Or employees for any crimhtal wrongdoingmiddot( e~cept as-p_rovidelti herein and except for any tax-matters~ as to which the -Offices cannot as a middotmatter ofpolicy J11ake any agreemetit) relating t9 any alleglti()n investigated by the Offic~ includin_gthe conduct described in Attacfuuent A

the Offices however_ may middotuse any information related to the matters described in Jhis Agre_erl-eot -includillg Attachment A against the Company (a) in a pros~cution fur perjury middotor middotobstruction ofj~tice ~ conhectirip With th~_ inv_estigations_ descdbed ~bove (l) in i prO$eQmicrotiop fqr making a false middotstatement ill middotconnection With-the investigations desctilied aboVe (c) in a prqsecutibn or Other proceeding relating-to aily c_cime of violince or (d) in a prosecUtion orofher proceeding relaHng to a violation of Rn) middotprovisiOn middotof Title 26 of the United States Coije (the

Internal Revenue Code) This Agreement does middotnot provideanymiddotprOteCtion against prosecutiim for any futmicrore concUctby the COmpany odts 9fficers

In the evep_t the- Offices Qetermine tIat the Company has breached thfa Agreemen the Offices agree to ptovide tlie Goinpany ~th)~iritten notjce ofsuch breach prior to taking any action pursuant iomiddotSection 2A or Section_4B of this Agreement tesultingfOOm such breach Witiiln thirty (30) ltlays ofreceipf of such notice the Collpal)y shall ~ve the opportunity to respond to the Officesin writing to e~plafamiddotthe nature and Circumstances ofsuch purported breacha$ well as the aritiqns the Complllly has taken to address and remediatemiddotthe situatiotli middotmiddotwhich explanation middotihe -Offices-shall cqtisid~[ mmiddotmiddotdetermin~g Whether to plXsUetrQsecution oftmicroe Company under Section 2A ofthis Agreement andot pursue liquidated damages under Section 4B dftbis Agreenient

inthe event that the OffiCel detennin~ th~F the-Company has bre~chtd ~s Agreement (a) middot allstatements made by o_r pnmiddot b~alf of the Company to middotthemiddot Offices intluding-Attachment Abullartd any testimony given by the company before a gtand Jmicrory a court qr ~i-tdbunal or ~t- any legislativemiddot hearings whether prior or subsequent to this Agreement and ruiy 1eadsmiddot derived (rom amp~iili ~tatelllentsof iestinlpnyshajl be admi~sible-in evidencemiddotin any and all criminal proceedings brought by-the Offices-againstthe COinparty(b) the middotcofupany sh~ n9t18Seit any clainnmder the United States-Constitutkm Rule 11(f) ofthe Federal Rulesof Crimhial Procedure Rule 41 Oof the Fedeyal RUks of Evidence oimiddot any othei federal rule that any such-statemtntsmiddotor testimony made bymiddotor o~ behaif of the -Company prformiddotto -this Agreement hi any leads- derived therefrom should be suppr~se4 or imicro-e middot6th~rwise inadmicroiissible and (c) the CoIDpany Shall 11ay liquidated damages fo accordmicewith the processes middotOutlined in Setionmiddot4B qfthiS Agtement

AnYprosecutioh againstthe Company may be pie~iseil on any oon-pri~ileged ll)fonnation providedby the Company The decision whether conduct or Statermicroents Cf any cunent director nffi9er qr _employee or any per-somicro acti~g on behalf of_middotormiddot atthe dir~ction of- the Company wilf middotbe imputed to the Company forheptmicropose 6fde~mlining ~heth~~ trle Comp~ylias violated any proviSioJ1 q(this Agreement shall be in themiddot sdle middotdiscretfonof the middotoffices middot

2 middotThreamp-Year Term Provisionsmiddot

NTC- voluntarily agrees that it will abide bthe provfoiOns setforth in this Sectionmiddot2 of t_hismiddot Ag~Illent for a term oft~ree-years from the E-ffCctiveDate(Three-Year Term) middotmiddot

A Future Prostcution If durillgthe Thremiddote-Yeir Tetm the Company (a) )ro_vides in connection- with thi$ Agreement deliberately false lnc_omplete or misleadingshyihfonnation or (b) faifsmiddot to implement the middotEnlranced Security Plan as set forth in this Agreement and AttachmentB- theCOmpany and its officers ahd eiriploye~ shall theieaftet be sribjectmiddotto proseciltion fof any federal cti_mipal_ v~olation of which the Offices have knowledge Obtained through non-privileged solllces including but not Iimlted Jomiddoti the middotcqnduct d~orjbed in thisI~tfer andAttpchm~ntA whi~h may be pursued by the Offices ih the US DistrictCourtfot the Eastern District ofVirg~_nia ormiddot ~y Othermiddot appropriat~ venue Subject to ihe provisions set oljt in S~ction 7of AttachmentB~ detennihlltion of-whether the CoiiJ_pany Or anfofitsmiddot-offjcers or emp_loyees hlt1s ~reache4 this Agreement an4 whether

middot3

to pursue pmsfcution ofthe-C-omp_anyor apy ofits officers otmiddotempfoycentes $hall be in-the middot bffic~si solemiddotdiscr~tion - -

R~portingIIJ~gal middotGo1duct

(i) Reporting Violations Outing the Three-Ye_arTermshould~heCompany1earn of credible evid~nc_e ofa fofo11y violation j)tUS law invdlving fraud or conipHance with U_S ~xpotf control laws the Company shall promptly-r~po~ such eyi4tnce middotqr allegatdegionsmiddotto the Offices anamiddot tlie Company shall truthfully disdose ali factual irifonuatioh riot protected by a valid claim of attqr_ney--client pvi1ege_or middotwork product middotd_octrine with_ respect to siJch evidence-or allegations This obligation oftruthful disclosure iclud~middotbut is ~at limited to_ the Qbfigation of~h~ Cltrnpany to pro_vicJe to the Offices upon request any-non--privieged document r~cord middotqr othertangible eyi~ence related to -amptJqh evidemicrocemiddot or allegations about which the_ Offices m~ymiddot middotinquiremiddot of the Compa11x

(ii) Provision of IIifoi1iiatioh and Testimonf Upoq req11est of the Offices middotthemiddot Company shalLdesignate knowledgeable employees agents~ or attorneys to pipvide tcrthe Officesmiddot ~on--priviltged information and materials relating tq any reporj _of violation_ under this Section2B~shyIt i$futtherundetstoodmiddotthaHhe Companytnust-a_tall tiqiesprovide comp~~ quthful andaccurate itifo~tiohThe Comp~ysl)al1 use its best-efforts to mak~~vailableforinterviews or testimony as requested middotby the Offices present or- fo_nner officers directprs eQiployees agents and consuJtants of the Company who have knowledgmiddote of the reporte~ yiolatiQn This obligation fuclJdes but is not lirmicroitedto sworn tfstimonymiddotbefqre-a federal grand-jtiry ordn federal trials~ as

middot weH as interviews with domestic or foreign law enforcerr1en( and_ regulatory authorities -Coop~p1tioJ1 shalJ inclmicrode identjfication ofwitnesses who~ to the knowledge middotofthe CoinpanY inay have material informatigp reg~ding the imicroattersmiddot under i1Jvestigation With respe_cL Jo anymiddot infor-mati_on testimony 4ocuments temiddotcords or other tangible evidence provided to th~ Offices during the- Three-Y~arTerrit pmicrorsuant to middotthis AgreemcentIit the- Company Consents to any ancI- all disclosures~ subjectto-applicable law-and regulation~ foo_the_tgovewmental authorities including Vriited $frac14te$ ijuthotj_ties- ltWltl those of a foreign -governmenf ofsuch materials as the Offices in their sofemiddotdiscretio~ shalHleern appropriate middot middot

(iii) Certification No lat~rthan 90 days piiortomiddotthe-e~piratfonoffue-Three-Year Tenrt the Company_ by the ChiefExmiddotecutive Officetofthe Glmicro1pany the C_hieffinancial Officer of the ltompany -and t_lie S~curity Pirect_or wUl certify to~ the tiftkes that tije Compmy ha~ met its disclosure obligati6ns pursuantto this_ Agteem~ntSmicroch c~rtification -will be deemed amaterial st~t~ent andmiddot-1epresentation by themiddot Company to-themiddot Executive Branch of the United Sta_t~s for purposesoflSmiddotusc sect 1001 middot

C C9ntra_ctilig~ DtJI~g-theThree-Year Term NTCagreesto seek thinon~objection ofthe Offices pri~r to bi4ding for middotany new f~deral s~te or--1ocal government pti~e -conhattor subcontract NtC matcompletemiddot the bidding-_ptdcess while awaiting a (le~is~on fro_tn heOfficesmiddot Thisreqajr~me~t also applies to bidsNTC-suhmits to currentg-ovenunent -dientsfornewwork The9ffices middotshall not objecl t9 any riew NTCbiq withoutcause _and shlllmiddotprovicl~ anexplanation of thereason(s) for-an objection WJless and to ~theextent-an objection is based oli classified or law ~nf6rcement-sensitive information that middotcannot be shared Within thirty 30) da)S middotortheEffective Date NTC shall submit to the Offic~s a list

-

4

to pursue pmsfcution ofthe-C-omp_anyor apy ofits officers otmiddotempfoycentes $hall be in-the middot bffic~si solemiddotdiscr~tion - -

R~portingIIJ~gal middotGo1duct

(i) Reporting Violations Outing the Three-Ye_arTermshould~heCompany1earn of credible evid~nc_e ofa fofo11y violation j)tUS law invdlving fraud or conipHance with U_S ~xpotf control laws the Company shall promptly-r~po~ such eyi4tnce middotqr allegatdegionsmiddotto the Offices anamiddot tlie Company shall truthfully disdose ali factual irifonuatioh riot protected by a valid claim of attqr_ney--client pvi1ege_or middotwork product middotd_octrine with_ respect to siJch evidence-or allegations This obligation oftruthful disclosure iclud~middotbut is ~at limited to_ the Qbfigation of~h~ Cltrnpany to pro_vicJe to the Offices upon request any-non--privieged document r~cord middotqr othertangible eyi~ence related to -amptJqh evidemicrocemiddot or allegations about which the_ Offices m~ymiddot middotinquiremiddot of the Compa11x

(ii) Provision of IIifoi1iiatioh and Testimonf Upoq req11est of the Offices middotthemiddot Company shalLdesignate knowledgeable employees agents~ or attorneys to pipvide tcrthe Officesmiddot ~on--priviltged information and materials relating tq any reporj _of violation_ under this Section2B~shyIt i$futtherundetstoodmiddotthaHhe Companytnust-a_tall tiqiesprovide comp~~ quthful andaccurate itifo~tiohThe Comp~ysl)al1 use its best-efforts to mak~~vailableforinterviews or testimony as requested middotby the Offices present or- fo_nner officers directprs eQiployees agents and consuJtants of the Company who have knowledgmiddote of the reporte~ yiolatiQn This obligation fuclJdes but is not lirmicroitedto sworn tfstimonymiddotbefqre-a federal grand-jtiry ordn federal trials~ as

middot weH as interviews with domestic or foreign law enforcerr1en( and_ regulatory authorities -Coop~p1tioJ1 shalJ inclmicrode identjfication ofwitnesses who~ to the knowledge middotofthe CoinpanY inay have material informatigp reg~ding the imicroattersmiddot under i1Jvestigation With respe_cL Jo anymiddot infor-mati_on testimony 4ocuments temiddotcords or other tangible evidence provided to th~ Offices during the- Three-Y~arTerrit pmicrorsuant to middotthis AgreemcentIit the- Company Consents to any ancI- all disclosures~ subjectto-applicable law-and regulation~ foo_the_tgovewmental authorities including Vriited $frac14te$ ijuthotj_ties- ltWltl those of a foreign -governmenf ofsuch materials as the Offices in their sofemiddotdiscretio~ shalHleern appropriate middot middot

(iii) Certification No lat~rthan 90 days piiortomiddotthe-e~piratfonoffue-Three-Year Tenrt the Company_ by the ChiefExmiddotecutive Officetofthe Glmicro1pany the C_hieffinancial Officer of the ltompany -and t_lie S~curity Pirect_or wUl certify to~ the tiftkes that tije Compmy ha~ met its disclosure obligati6ns pursuantto this_ Agteem~ntSmicroch c~rtification -will be deemed amaterial st~t~ent andmiddot-1epresentation by themiddot Company to-themiddot Executive Branch of the United Sta_t~s for purposesoflSmiddotusc sect 1001 middot

C C9ntra_ctilig~ DtJI~g-theThree-Year Term NTCagreesto seek thinon~objection ofthe Offices pri~r to bi4ding for middotany new f~deral s~te or--1ocal government pti~e -conhattor subcontract NtC matcompletemiddot the bidding-_ptdcess while awaiting a (le~is~on fro_tn heOfficesmiddot Thisreqajr~me~t also applies to bidsNTC-suhmits to currentg-ovenunent -dientsfornewwork The9ffices middotshall not objecl t9 any riew NTCbiq withoutcause _and shlllmiddotprovicl~ anexplanation of thereason(s) for-an objection WJless and to ~theextent-an objection is based oli classified or law ~nf6rcement-sensitive information that middotcannot be shared Within thirty 30) da)S middotortheEffective Date NTC shall submit to the Offic~s a list

-

4

of anrsuch-govertunent contracts th~t pre-dat~ ~e EffecJive Date That list spaU specify the_ nam~ 9fthe client as well _asmiddot the-nature ofthe work perfonned

~l SeVeli--Year Term Provisions middotNTC vohmtarily agreesmiddotthatitwillabllie by the provisions set fortb tnthjs Sectip_n 3 ofthis

Agreewent f9ra tepti ofseven years from middott11e Effictive Date (Sevenyear Tenn)

A Enhance_d Securitymiddot Planmiddot for USBasmiddoted Domesth Cqmmqmicroicatiqmicros Jnfr~tru~ture- The middotCompany s~ijll impJement artd maintam -ap enhanced security-and fisk assessment middotand remediationmiddot proghirmicro base~ upon recognize]_ nati9nal ~dor intematiorutl se~microrlty sUU)datds_ orguidelines-and best practices for US~BasedCustomersmiddot Domestic Communicationsmiddot Infrastructure as_ -set fcrth in_ Attachment B (EtibancedSecurityPlanmiddot) middotmiddot middot middot middot - middot middot middot -middot middot middot middot middot middot middot middot

-B third--~arty Auditnmiddot The_ Company agrees to retain an independent third_-PaJ1Y auditor (Third-Party AuditorJbullto review andassess inmiddot~ professionr1Uy jndependent and middotobjec_tive fashion NTC-s processes~ policrtis~ and proceduresmiddot reJ~ted to -and NTCs co_inpliance with its Enbahce4 Secutjty IIap_ a~ set forthmiddot 1n Attachment B_ The qtfalifications oftheTlutd~Party Auditor ang procedurcentsmiddotmiddot fot selectigg the- Third-Party Auditor are set omicrot inBecdon 9ofAttacfunenLB middotmiddot

c~ Reports TJie reports tequitedbyth~ ~ectiqn 3 will likely indude _proprietary finandal confidentfa1 and competitive middotbusiness infonnatiort ~fo~over publicdisclosure oft]l~ repQrfs cculdmiddotmiddot aiscourage co9p~tation and middotim_pede pending or potential govemiddotrnment investigations and~ thus lfud~rhlirte ihe obj~ctives ofthe-repprtirtg requir~ment For these ~ps arpon_g others the-reports andthe contents thercofare fot~nded toremaigand shall temain11on-public exceptmiddot~ Qtherw~se agreed to- by-the p_artfosin -mitl~g or except to the eXtentrequired by law middot middotmiddot

i) Annual Reports_ The Company ageesmiddot to tnake annual repotts to the Offices on the status of itriniplementation ope_ratibn anq effectiyeness ofthe controlsmiddotandprocedures setout in Attachment H onemiddot yettr after the middotEffective Date ~d- at one~year inJetvals thereafter in

middot middotaccordanc~ with th~ EnhancedSecurity Plan The middotcompany may extend fu~ time p~rjod for middotsubmission ofany of the amiuaL reports -~ith prior written apprcraf ofthe Offiqesbull The Company shall endeavor tq respondpromptly to any inquiries from the-Offic_esmiddot relating tcf the ~ontent _Qf an_ -anrtu1 report middot

(ii) Final Report The Go~pany agtcentemiddot fo _pnwide a final r~vi~w apq middotreport -to the 0poundfcesmiddot smicroitm1aritingthe ptog~siion nfthe 1mp1ementation operatio~ and effectiveness of themiddot controls and pfoced1-1tes s_et out in ~cbm~nt B CFiu~l RepoitJ The Final Report sbaU be compl~t~d and delivered to the Offices no later than fo1fy~flve (45) daysmiddot before the expiration of tlieSeven--YearTetm

D~ R~p_ortingVi~fat_i_onsmiddot Should the CompanydiscoverCredible evidence of(D ~ actualmiddot or attempted circumyeritiqn of-the sepurity pr6tocols in AttachinentB (2) failure to follow th_esecurity protocolsinAttachment Bor (3) any tinauthotjzed ac~es~ to any system

s

maintainedmiddot by NTC-that would impairmiddotot jrilpede themiddotseii~ityprotoccls inmiddot Attachment B then NTC sh~Il report such events 10 the OfficeS within live (5) days

K F9reign LegalPrcicess The Company shaU not breach the EnhaQcedSeclirity Plall in respondirtg to theIygal prdeess of1 Or a reque~t fro_tti o_r on behaIfmiddotOf a foreig11 goVernm~itt ideptffied repris~ntative middotcompanent or subdiVision thereof withou( the express mitten- torisent of the Dffi~es (t the middotairtlwrizat_fon o_f -a court of competent jurlsdictio_n 4t the United Sta~-- Any such legal _process Or reqmicroe$t ~t yolild ie3~lt ill actual ot ~ttempteqmiddot cir-eurmicrov~ntion of the Inhinced Security Plan shall be reported to the Offices as soon -as-possible and middotin no middotevent more_ than five (5) dayt after l-)TC becomes awaie ofthe-ptocess Qr request NIC s_halltake reasonable nieasuresmiddotto ensuremiddotth_at-it Ill learn ofall stich requeIts-6r-submiSsi9n oflegnl -process further lJC shall notify the Officesi in writing-within 30 days Of-receipt-of legal pto~ss -or requests frqm fo~igtiu9nshy_govenunenthl entities for-actiOils_that wpuld consthute a breach of the Enhanced Security Plan unl~the--disclosure of thelegalproce~isOrrequest$ WoiJld be ip viiilatipn qfan order of a court ofcompeten~jurisdic_tion within the United States

F Other C()niplian_ce Proglamsmiddot The Co~pany- middotshall implement and mainta~n middotan effective compliance aild ethics ptogram ihat-middotfully cmriports with the criteria set forth in Sectioil 8)32 Iof the Upited States Se~tencng GuidiImes Manual (the Ccimpliahoe amp Eth_ics Program) As part oftheCoir)_plianee Bf middotEthics Pro~ NTC sliaU middotmaintaUl a permaile_nt compliance Qfficemiddot _and a permanet1teducation~d training progtarit -relating to the Jaws regulations~ and ethics gOverning t_he woJk apound the Company_ paying particular attention to NTctsmiddotprocurementand subcontracting practicesmiddot As middotpartof the Compliance ~ EUJ_icS Program NTCs_ball (aensurethat-an middoteffective prOgtam be maintained to detict and punishViolators df laws _pQPcies and ~t_filldards ~4 encOuragethose who report such yiOlators (b) ensuremiddot thatno middotemployee or agent of NTC is penaljzed in amicroy way fat provicUhginform~fmnrel-ating to NTCs CQmpliance _or noncomPliance WithIaws~ policies and $taDdards to any NTC middotofficial JdveITijllen_t agency co~pli~ce pffi~er an_d01 the Third-P~rfy Auditqrmiddot fild (p) ensur~middotthat all NTC employeesmiddot have acce~s~ to a hotline Or -other middotmeami to provide information to NTC1s cpffipHance office relating to NTC~s corppliance or noncompliahce with laws policies and stand~4fi On clt11~_smiddott_amicro annual ba~is_ ~q shall ~e steps to asse~ the Compliance amp-Etbios Program to ensmicrore it iS carryllls out the ditties and reSponsibili_ti~s set Qjlt it t4$Ag~eCment middotmiddot

4 SecurhyEnhanc~pient-Inv-estmentand Liquidated Damag~s-

A Necessary Funds NTC will ihveSt thefunds n~cessa0bullto middotenhance-cyberand data security for its~lf and the middotwork it do_e~ for its- d-ients ip accordance with tle Enhanced 3ecurity Plan attached middothereto as AttacJ1111entl3

il Liquidated Dani3ges

(i) Process for Finding Breach The _Offices shall detemiine iri their solediscretion whecenterNTC has rnateriaily breached this Agreement including failure to comply with any-JJmiddot~ ofthe Enhanced ~ecutity Plmi Amaterialbreachmay constitute amiddotsingle iy~nt or a seriesmiddotCifevents middot grouped collectively

6

(ii) Process for-Imposing Liquidated Damages ttftei a Breach The PartieSmiddotagr~e_ that if tQe Arbiter aS described b~low det(lrmines that NTC materially breached this Agteementshy(ihcluding by failing to comply with the EnhancelSecmicrority Plan) then NTC shtllpay an lfllOunt of $3$ nriUion in liquid~ted damages to the United States Treasury middotacoOtd_ing to tlie-folq~_l)g ProcectllfCS

a As provided ~hove in Secti_on 1ofthisAgr~emmiddotent uponwritlen rtotification to NTC by themiddot Offices Of amate~~ai brcentachf the Cmppany shaU have- thirty (30) days middotto respond inmiddot writingmiddotas to the nature of the_ breach artd -anyremediat_ion During thisshytime the Parties shal~ ~ttempt-inmiddotgo0dfaith tQ negotiate a resolution ofthematetiai breach

b Iftb1tPaqies aremiddotmicronable to re11ch-a r~sOlution within thircy (30) days ihe Par~ies shall negotiate in good fiith tomiddot identifymiddota neutritthitd-party arbitet(the Arbitermiddot) to resqlve the disPUte Thea Arbiter shall hQld a security clearance or- bemiddot capable of obtafrllng -a secutitY -clearance Each Party shall provide a I_ist of at l~t three Artiter candidates middotmiddotThe- Parties shall agree on an Arbiter within ten days In the eventmiddotthemiddotPaties-are tiitable to reach agreetnent onanAtbitertheOfftc_es andlITC middotshall _each notninate one individual-from- the-two lists of Atb_her middotcandidatel and those two people shall within t(Ve 5) days ~elect theArbiter from the previously ex~hafig~ci lists of candidates middot

c The sole issues fQr deterQilhati0il_by th~ Arbiter which th~ Offices mmicrost prove byshya preponderance-of evidence_middotare (i) Whether-themiddotOffiCes deteIJllination6f fbjeapl-i was Suppotted_bythe e_vidence and (ii) whether the breach was amaterial breachmiddot of the Agreement For purposes Ofthi~pr_oCeeding N_TC stipulates tmicroat middotliquidated dajnageS of $3-1 rt_1jllion -are reasonable in the event of-a material bteach of the Agreement Within_ten daysmiddotof seleCting an Arbi~er -a prelimilJarymiddot confercnc_e will be heU and the agenda for that-conference- and timeliries for the_middotr_emain4er of the proceeding will be set by theArbit~r WitbitJ 2Q days of thepreiiminary conference the Arbiter will hold an evidentiary nemiddotannmiddotg on themiddot merits aQd tQe Parties will

prese~t ~g~~nl Thishearingshall lastno mbre thanmiddot eight hours with each side -allotted equal ~e for pre~emiddotntation ofdirect eyidemicroce1 whiqh maybe-submittedby way of documents direct examinations written dectimicro-atitms aricl crQss e~aniin~tion ~riefuig _no_t-tlt yxceed 10_pages_per Party may be subrriitted by ~ithermiddot Party on orbefore the day ofth~ -hearing ~-de_t~rmined by th~ Arbiter The Arbiter slu4lissue a ~ri~fmiddotreasoned decision as to (D whether the middotd~erminati(n of bteaCh by the Offjces W~middot suppo~ed bY the eyidyennce anU -(ii) wbether the breach wasshymiddotma~rial The de_cision shall be rendered -in -Vfiting -within J ~ days of the cfoseot th~-hearipg Th~ Parties agreethatihe_ 4ed~ion-ofthe Arbitermiddotshall be -finat With no right to appeal artd Shali not bemiddot subject to_judicial teyiew imicroqlucljngcJailll~ under middotthe Administrafiv~ Pioce4_ure-Act or any provision of the Constitution _The Parties shall maintain the ponfideiltial nature_ of tJi_e prn~eeding All fees owedto the Arbiter willbe paid by NTC

d~ the Offices shall file with the-Arbiter~ admfoistritjve r~cprq wJiich s4iil COn$ist of ~e in(o_rtnation (b_oth c~lsifiedmiddotandmiddotunclassified) that-themiddot Offices ilitend to telY Upon to -support the Office~ action -und_ermiddot ieyiew -All unclassified information ~ntaip_edin themiddotadministra-tiverecord thatjs not otherwise privileg~ or $Ubject to

7

statutorymiddot ptotectionS shall be proyided to NTC No discovery middotShall bemiddot permitte~ NTC rriaj- also submit information to the Arbiter as middotpart of the administrative recbrd and that infonnati9_n sh1-11 be plOvided tomiddot ibe Offic~ The 9ffifes may middotprovide classifiedmiddot foformation -to the Aibiter aild to NTC middot(for ~xampI_e to -sufficieiit1ymiddotclearedcounsel) as prut ofthe administrative record Alt~rnatively the Offices may Submit classified imicroforma_tion that e_annot be _shared withNIC to tlte -Arbiter ~x par_te and in -camera for inclusion in themiddot admlnistrative record For this category bf classified informatiltm~ the Offices shall prqvide an unclassified summary ofthemiddotofassified information t0 NTC-s coutisel middotpuisuant to a protectiit order middotWdp_g ipto ~ccountth~circqipstances oft4e case includlngJJTC1s ahilifyt~ respond to theactiotlat issue~ unlessthemiddotheJi_d qf tbe- depat1m-eilt _or middotagency -whOse cl~sitied informatioP i_s at issue odris or lier designee detennines in his or her dicietion middotthatpt9vid_ing a suininary could damage ~e middotnati9nal security of th~shyUnitecfStates In thisevent_the Arbiteimayconsidetthe i~biJity ofNTG tocentView and teSpond to _cfassifie~ iqfonnationin-the adrriiiristratlve record in making a--final detenniruitioit

e If the Atbi~r dOCidCS in writhtg that the detetmjnation of1Jreack by the- Offiqs was supported-by the evidence and thatthe breach was Jil_ateriaf th~n NTCall pay llieamount of$3_5-million t0theUnited Statsrreasury whhin ten days ofsuch written determination

f Themiddot rights ofthe Parti~s for th~- pmicrorpose pf the Uquidlte4 damages cleterminatlon not already addressed under this-Agreement ShaWbe gqvemed by arid middotconstQied in accordarice with theJaws ofthe District of-Columbia exclusive ofconflictoiohoice oflaw rules

(iii) Consecutiye Breach Findings- Asiilgl_~determifation ofb~aqh by NTC shall nOtpreclude subsequentdetenninations bythe Offices ofanother breampch middotby NTC butthe-as~$$merit Qf the Iiquidated damcigesaward by-the Ar~iterinthe ~vent ofcJ material breach bYNTC-shaU middotoccut only once- middotmiddot

5 Ge_iteral ProV~siOas

A Wlrk for US l~lefltm1municaOons Cpmpanies Bymiddot adhering -to this NonshyProsecution Agteemeht and Uilplemeniingthe EnhanC~d Security Plan which is_ based on tepogrt~d security _standans and middotcutrent tiestptacticesthe OflfoesagreemiddottliatNetctaCker can achievetite necessary secmicrority organization aqd ppe~tional ~9Ptrols the Officesmiddotexpect of a company with sensitive access to critical U~S dbin~tic CQmmuniCatiot1$ infrastructure

B EnforcHbility Th_is Agreeriienf_is binding On th~ Cbrmicropany ~cl the Offices butshysixcifically dpes not bind any other federal agencies or any stale local or foicigriJaw enforcement or- regtil~tofy il_g~ncie_s middotor any othei autporiffes although themiddot_ Offices wiil brlog middotthecooperatfon of the Company- and its comp HapCe with its other obligaticms under this Agre_eme_nt to (he attention ofsuchagflncies _and authorities if~quested todo So b) the Company

C COQJpany Snccessors This_middot Agreement Shall be middotbiriding Uprin any sucqesmiddotsor (WJethe dii~Ct middotmiddotox indirect and whether middotby pw-Chase leas~ 1l~rger middotconsolidation

8

liquidatipn_oro_therwise)middottoall orsubstantiaUy alloftlieCornpanys-businessandor assets Th~ provisions of this paragraph shall apply to NTC-s parentconipimy to the extent that NTcs_ parentcompany ahsotbs-middotanyNtC asmiddotsets or-corporate dep_artmetitS_assumes NTC functions~ or otherwise acts ijS a stic9essor of NT( riotWithsfandirig the ecemptioh described in Sectionlh ofthe Enhanced SecurilyPfan- Any smicrochsucccssorwillwithirt a teascmabfoperio~ ofbecorriing the Successor ~smicrorrie in writing artd be bound by all of tile Cmnpltlllys-obligatkms lllicler this Agreernent For all purposes under this Agreement the terni bullbullCompany1 shall include any successor to the Companys business or assets that becomes bound by this -Agreement

I) Disclosure Itisfurther understood thatthe Company and theOfficfsmay disclose this Agreement to the pulilic including_ Attachments A and B

E ComIDllnic~tions AUmiddotreports and notices requiredunderthis Agreemcntslmll be Seiitto Deputy Chief- Cybet Counterintelligence and Export Control Section National Security Divisiqll US_ Department of lll~tice 950 Pennsylvtnia Avenuf NW1

Washington DC 20530 Chief Foreigt1 Investment Review St~ National Securily Divisfon lLS Department ofJustice 600 E Street NWmiddot~ 10th Floor Wachi11gton DC 2()004 apd to Chief- Cybercrimes Unit~ United States Attorneys Office fo+the Eastern District ofVirginia2100JamieSonAvenue Alexandria VA22314 -

l 1IQdification_ TllisAgreementsetsJqrth all theterms ofthe Agreement between the Company and the Offices No amendments~ modificatiorts or additfons to this Agreementshall beyaiid unless they are iii writing 11nd signed by-the Offices the attorneys for the Company and a duly middotauthorized representative ofthe Company

Sincerely

OANAiBtfENTE~ Actin8Assistant Attorney General

DavidH LaufinanChicf Counleri ntclligence andmiddot Export C9ntrol Section

Heather M SchmidtSenior Trial Attorney Counteriritelligenceand ExporLCoritrol Section

Richard C SofieldPrineipal Deputy Chief ForcignJnves_tmenLReview Sfaff middot

DANA J BOENTE United States Attorney Eastern DiStrict ofVitginia

9

middot

10

-~-

-~

ATTACHMENT A

STATEMENT ()FFACTsect

The followingmiddot Statement of Faqts i~ ipcorporated by reference as part ofthe NonshyPtoseoution andSecurityAgreement (the Agreement) between the Utiiti middotStates J)epartcentent o_f Justict NationalmiddotSecurity Division tlicentUpited States Attom~ys Office for the Eastern DJstrict ofmiddot middotvfrgiriia collectively the Offices) and Netctacke~ Te_hn~fogy Corporation (NTC1)- The Offices 4ivestigate4aJlegatio1lcsmiddot relating to ~ Defense middotrnrormation Systems Agency (PISA) middotcontract NTC~s compliance ith ttwmiddot Iriterrtatiqnal Traffic in- Arms Regub1tfons (ITARP) ~dmirilstered by the Stare Department and with middotExpdrt Adil1inistta~ion Regulations (EAR) administered by tmicroe Department_ o(Comicrotlilerce amf NTCs comQliartce withlnimigration laws Aithough-NTCdeniesmiddotthat it engag~d in -ru1y-eritnill~ wro11gdoing in t~e-interest ofreaching a mutual agieementt0- resolye the investigation and enhance US nationalmiddot securityNTC_ -apd the officeamp agreed among othermiddot things middott9 the following Statem~ot of Facts wid to ~nter into art EnhamedSecurity PI~ which is Attachment Bto middott11e Agreement

CORPORATE BACKGROUNDmiddot

NT(isa software eng_ine~ring fitm-offfaingrietwo ~oluti9ns to ~nabl~1argemiddotc0rpotationsmiddot to optimize11~twotk cpmicroununications and operations NTC-s flagship soplusmntware ptodQctstrearnli11~s busihes~ middot-s11pport sy$te~ and operationsmiddot suppocent systems in asingle platform approach to enable large corporations to middotoptimize network connnunicatiotis and operatfo~ NTCs global clienteleshyincludes elecommunicati9ns providers andlarge enterprises

NTCmiddotsells licenses to its _Commercial Off the Shelf (COTS or qote) proqu_cts ~d enterS into services cQnfraGts to p~oiie _custQmizatlon coilfiguration and hnplementatiort seyviceswhich NTCrefers to- interna1ly asmiddotcustomer $P~cillc ~proJ~cnNTCand its_ subsicfi_aries employ techniqal personnefin the Uni~d middot~ates and in a m1rribet orforeign countries iiiclwling Belartts Brazil lrtdia Latvia Russia Uloaine and middotthe United JltiQgdom Persont1e1 from NTC s foteign officesfrequently travel to the_UnitedStates inconnection with customer projects in the United Sta~$ - -middot

THKDISA CONTRACT

DI~_A ove~ees and manage_s the Defertse Information -~ystemmiddotNetwork (DISf which provides a consolidatecl worldwliemiddot t~l~conmicronunic4tions ipji-astrttcture tomiddot the United States Dep~entQf D~fense(DoD) The DISN runs aata~ voice optica_l ~~telliteand phone services oii both classjfi~d md upclassifie~ networks~ induding SIPRNetmiddot ihe US Goven1merits SeeretshyIeel neuvork Giveh the defens_e-related da_ssified and sensitive iimicroorm~tion flowingoverthese networksDISA)~ middotmicroetwodc architecture rdiesmiddoton a varietymiddot of classified contrplied ~nd sensitive technologies Some technicaJ requirtjments _and specifiQatfonsofthe DISNaresensitlvif andQr classified middot

In fate 2001 NTC ehtcentRdinto ne_gpti~~ions to prDide-middotboth softwareijnd ~ervi~es toDISA NTC offered its cqre conmercial software product fo_ DISA for use on both DISA s Secr~(Jevel hetwork and DISAs W1Classified netwprk T0enable NTC s ptoductto interface with the netwo~ks run_ by DJSA the core pr0duct hadmiddotio he customized DSA ultimately eriter~d into l licensing contract fofmiddotNTC s cbre-commercial product middotFrom the beginning otits negotiations With NTC DISA was aware theetote prbd~ct-had bee~ devel~ped by NTC i_lsing prograrrirnersin Russia and UkrainemiddotFotthlltreason the US governmentevaluatedwhethertliis core product would hitroduce

middot

10

-~-

-~

ATTACHMENT A

STATEMENT ()FFACTsect

The followingmiddot Statement of Faqts i~ ipcorporated by reference as part ofthe NonshyPtoseoution andSecurityAgreement (the Agreement) between the Utiiti middotStates J)epartcentent o_f Justict NationalmiddotSecurity Division tlicentUpited States Attom~ys Office for the Eastern DJstrict ofmiddot middotvfrgiriia collectively the Offices) and Netctacke~ Te_hn~fogy Corporation (NTC1)- The Offices 4ivestigate4aJlegatio1lcsmiddot relating to ~ Defense middotrnrormation Systems Agency (PISA) middotcontract NTC~s compliance ith ttwmiddot Iriterrtatiqnal Traffic in- Arms Regub1tfons (ITARP) ~dmirilstered by the Stare Department and with middotExpdrt Adil1inistta~ion Regulations (EAR) administered by tmicroe Department_ o(Comicrotlilerce amf NTCs comQliartce withlnimigration laws Aithough-NTCdeniesmiddotthat it engag~d in -ru1y-eritnill~ wro11gdoing in t~e-interest ofreaching a mutual agieementt0- resolye the investigation and enhance US nationalmiddot securityNTC_ -apd the officeamp agreed among othermiddot things middott9 the following Statem~ot of Facts wid to ~nter into art EnhamedSecurity PI~ which is Attachment Bto middott11e Agreement

CORPORATE BACKGROUNDmiddot

NT(isa software eng_ine~ring fitm-offfaingrietwo ~oluti9ns to ~nabl~1argemiddotc0rpotationsmiddot to optimize11~twotk cpmicroununications and operations NTC-s flagship soplusmntware ptodQctstrearnli11~s busihes~ middot-s11pport sy$te~ and operationsmiddot suppocent systems in asingle platform approach to enable large corporations to middotoptimize network connnunicatiotis and operatfo~ NTCs global clienteleshyincludes elecommunicati9ns providers andlarge enterprises

NTCmiddotsells licenses to its _Commercial Off the Shelf (COTS or qote) proqu_cts ~d enterS into services cQnfraGts to p~oiie _custQmizatlon coilfiguration and hnplementatiort seyviceswhich NTCrefers to- interna1ly asmiddotcustomer $P~cillc ~proJ~cnNTCand its_ subsicfi_aries employ techniqal personnefin the Uni~d middot~ates and in a m1rribet orforeign countries iiiclwling Belartts Brazil lrtdia Latvia Russia Uloaine and middotthe United JltiQgdom Persont1e1 from NTC s foteign officesfrequently travel to the_UnitedStates inconnection with customer projects in the United Sta~$ - -middot

THKDISA CONTRACT

DI~_A ove~ees and manage_s the Defertse Information -~ystemmiddotNetwork (DISf which provides a consolidatecl worldwliemiddot t~l~conmicronunic4tions ipji-astrttcture tomiddot the United States Dep~entQf D~fense(DoD) The DISN runs aata~ voice optica_l ~~telliteand phone services oii both classjfi~d md upclassifie~ networks~ induding SIPRNetmiddot ihe US Goven1merits SeeretshyIeel neuvork Giveh the defens_e-related da_ssified and sensitive iimicroorm~tion flowingoverthese networksDISA)~ middotmicroetwodc architecture rdiesmiddoton a varietymiddot of classified contrplied ~nd sensitive technologies Some technicaJ requirtjments _and specifiQatfonsofthe DISNaresensitlvif andQr classified middot

In fate 2001 NTC ehtcentRdinto ne_gpti~~ions to prDide-middotboth softwareijnd ~ervi~es toDISA NTC offered its cqre conmercial software product fo_ DISA for use on both DISA s Secr~(Jevel hetwork and DISAs W1Classified netwprk T0enable NTC s ptoductto interface with the netwo~ks run_ by DJSA the core pr0duct hadmiddotio he customized DSA ultimately eriter~d into l licensing contract fofmiddotNTC s cbre-commercial product middotFrom the beginning otits negotiations With NTC DISA was aware theetote prbd~ct-had bee~ devel~ped by NTC i_lsing prograrrirnersin Russia and UkrainemiddotFotthlltreason the US governmentevaluatedwhethertliis core product would hitroduce

-~-

-~

ATTACHMENT A

STATEMENT ()FFACTsect

The followingmiddot Statement of Faqts i~ ipcorporated by reference as part ofthe NonshyPtoseoution andSecurityAgreement (the Agreement) between the Utiiti middotStates J)epartcentent o_f Justict NationalmiddotSecurity Division tlicentUpited States Attom~ys Office for the Eastern DJstrict ofmiddot middotvfrgiriia collectively the Offices) and Netctacke~ Te_hn~fogy Corporation (NTC1)- The Offices 4ivestigate4aJlegatio1lcsmiddot relating to ~ Defense middotrnrormation Systems Agency (PISA) middotcontract NTC~s compliance ith ttwmiddot Iriterrtatiqnal Traffic in- Arms Regub1tfons (ITARP) ~dmirilstered by the Stare Department and with middotExpdrt Adil1inistta~ion Regulations (EAR) administered by tmicroe Department_ o(Comicrotlilerce amf NTCs comQliartce withlnimigration laws Aithough-NTCdeniesmiddotthat it engag~d in -ru1y-eritnill~ wro11gdoing in t~e-interest ofreaching a mutual agieementt0- resolye the investigation and enhance US nationalmiddot securityNTC_ -apd the officeamp agreed among othermiddot things middott9 the following Statem~ot of Facts wid to ~nter into art EnhamedSecurity PI~ which is Attachment Bto middott11e Agreement

CORPORATE BACKGROUNDmiddot

NT(isa software eng_ine~ring fitm-offfaingrietwo ~oluti9ns to ~nabl~1argemiddotc0rpotationsmiddot to optimize11~twotk cpmicroununications and operations NTC-s flagship soplusmntware ptodQctstrearnli11~s busihes~ middot-s11pport sy$te~ and operationsmiddot suppocent systems in asingle platform approach to enable large corporations to middotoptimize network connnunicatiotis and operatfo~ NTCs global clienteleshyincludes elecommunicati9ns providers andlarge enterprises

NTCmiddotsells licenses to its _Commercial Off the Shelf (COTS or qote) proqu_cts ~d enterS into services cQnfraGts to p~oiie _custQmizatlon coilfiguration and hnplementatiort seyviceswhich NTCrefers to- interna1ly asmiddotcustomer $P~cillc ~proJ~cnNTCand its_ subsicfi_aries employ techniqal personnefin the Uni~d middot~ates and in a m1rribet orforeign countries iiiclwling Belartts Brazil lrtdia Latvia Russia Uloaine and middotthe United JltiQgdom Persont1e1 from NTC s foteign officesfrequently travel to the_UnitedStates inconnection with customer projects in the United Sta~$ - -middot

THKDISA CONTRACT

DI~_A ove~ees and manage_s the Defertse Information -~ystemmiddotNetwork (DISf which provides a consolidatecl worldwliemiddot t~l~conmicronunic4tions ipji-astrttcture tomiddot the United States Dep~entQf D~fense(DoD) The DISN runs aata~ voice optica_l ~~telliteand phone services oii both classjfi~d md upclassifie~ networks~ induding SIPRNetmiddot ihe US Goven1merits SeeretshyIeel neuvork Giveh the defens_e-related da_ssified and sensitive iimicroorm~tion flowingoverthese networksDISA)~ middotmicroetwodc architecture rdiesmiddoton a varietymiddot of classified contrplied ~nd sensitive technologies Some technicaJ requirtjments _and specifiQatfonsofthe DISNaresensitlvif andQr classified middot

In fate 2001 NTC ehtcentRdinto ne_gpti~~ions to prDide-middotboth softwareijnd ~ervi~es toDISA NTC offered its cqre conmercial software product fo_ DISA for use on both DISA s Secr~(Jevel hetwork and DISAs W1Classified netwprk T0enable NTC s ptoductto interface with the netwo~ks run_ by DJSA the core pr0duct hadmiddotio he customized DSA ultimately eriter~d into l licensing contract fofmiddotNTC s cbre-commercial product middotFrom the beginning otits negotiations With NTC DISA was aware theetote prbd~ct-had bee~ devel~ped by NTC i_lsing prograrrirnersin Russia and UkrainemiddotFotthlltreason the US governmentevaluatedwhethertliis core product would hitroduce

-vulnerabflities into-government net30tks In June 200amp middotbaseil cm represent~tionsmade by_NTC middotand the U$ goyernmep_t1s evaluatio_n~ tiISA detennined that uSCmiddot -of tbe core pro_Qu_ct on _gOvetnment middotnefyo~ks was acp_epf3~le and approved th~ core middot product for purchase-middot -and 9ustomizati0n as describedpelow The licensing-agreement befyleen PJSAlindNTC providedmiddotthat all-cu~tqrrtization wO_rk thttNTC did for-DISAwould be thi properiy-_ofNTC middotand-could bemiddotused fofuture versions ofNTCs-Core-prodUct

Themiddotsecon4 contract between JISA and NTC was a multi year services project (the DISA Proj_ect1) to customize and configurethe core c0de_including ~11bseq13-ent ch~ges to_ the_core_cq9e for lniplCinentation ii) iIie PISN-middots middotunique-systen1$ Durfug The negotiation petiod from )3-te-2007 through September 2008~ DISA sought and received middotc_ertificationsmiddot frollJ trfC that among other thingS all [NTC] ~mployeesassigried to the project will be US citizens-81)9 that onl) [NTCl employeeswith f security ileap~bCe ofS~cret or ~bove will work on the pnject__or have acoessshytq_DISAinformation Neither DISAnorNTC defmeit thetentli pfoj~d ot 1middotD1SAinformation and ft later-appeared that DIS illd NTC understood these terms differently

The DISA Project wort wasmiddotdislinc_tfroro- the middot-continued development atid ~upport Of th~ cotecomraercial prbdmicroct under-the licenten~ing-contraCt With respect to thcent latter DoD middotunderstood thatthe -ltore product was supported through tegulat (fat~ and ~ec_utjty patches _by un9leared_ forei_gn naticiiials as it mis hY definition a COTS Solution utilized by many different NTC customers-

cin Septen~ber Igt~ 2008 NJC was engaged lS a directed subcontractor under a prime co_ntrac_tbetw~n D[SA and a Pdme Colltractor (the Prime qoptractor)

NTC~s- contract with the Ptirne Contractor rquired that sulcontractor personnei perforoiil]g-sei-vic~1 is part of(h~ DISAProJeci must be US Citizens middotwith SECRET(including interim SECRET in accordance With tlie Agreemfi1t) or TOP SECRET security cfoararicesmiddotThe terms Project and Services- were-not definmiddoted

In January 2011 the President of the NT( subsidiary performing the DISA contract iilfornied a DISA offiC_ial and middotthe PfimeConttactor that uncleatedforeign hatio11ars locate4middotin Russia were perfonning womiddot- onmiddot themiddot PI$A ProJect NTC ampgreed- that this was- themiddot casemiddot but represented to DISA and the Prime _Conttactormiddotthat NT~ middothad Qeert oper~ng agcprding to itsmiddot undetstanding of themiddot cont_i_act NTC understood the contract to allow NTC to use uncleared _per~pnnel induding foreign nationals perforn1]ng wqrk omicrotside -the United States to perfomi otfsitewOrlc On theDJSAProject provided ihatNTCs onsite persortnel with middots~curity clearanee_s_ did not provideits Offsite per-s_onhel With Olassified or sensitive customer-specific fofotmation

In Jul) 201r t_he Ptjmicroie C9Qq8ctor andmiddot NTG agreed -upon Softwar~ Development Guidelims (the middotGuidelines)~ whfoh were inci11porated i~tO fhe oztlrapt hetween the Prime Colittactdr-citid DISA The Guidelines we~ consistent with NTCsmiddot understanding of the contract and -pedilitted -undeate_d persorine1 including foreign personnel ~rfonilini wOrk Outside tlie Uriited States to middotsupport the DISA Project -ptovideq that _thoSe foteign __p_ersotu1el were nbt_ provided cl_assified middotor sehsitive customer-sp_CCifle

1

inforination Under the Guidelines work continuecl tp_ be performed iliRussia middot middot

After-the NTC software wruHmplemented11t DISA_ ~e Offi~s and DISA determined that ambiguitie~ fn Jhe -co_ntract middotdocuments and different W1derstandings between OISA__and its contractors -ainohg othet things 4~d resulted tn an unacceptable -deg~dation opound the i~-vel of

2

security DISA had intendedmiddot to aChieve The Offi~s inve$tigation determined that the DISA Projecf code cilong with other information was middotstoredonmiddotanNTCServer in Mos1fow lUld there-was evidencemiddotthat in some instance$ micrortcle_ared N1C emp1Qy~s-focatcentd in Russia and Ukraine knew they Were-customizing and Polfiguring software code for the DISA Project and knew the miliWfY and sensitive natureoftheDISN Atthe time there waspublic noticethat-corfin1unkaticni$ to alld from Russia were stlbject tothemiddot-Russian SSte~ of OperativeRinvesfigative MeaswesSOR~--f) Under SORM 1he FederalSecurity $ervi~middot -otthe Russiati Federation (FSBi) is_ authorjzed tq eollect MaJyze andmiddot store both metadata ari9 contentthat-are traosmitted or-received On Russian 11etworks and_ servers Any DISA data artd information serit to RussJa andor-transferred over Russian networks-via NTC-sef-V~r$ were subject to these practices-and therefore theie was a t~k that the FSB -could gathednforriiatioq abOUt fuemiddot DI~N Accordingly tbe Unit~ States removed NTCs produ9t~ frQm the DISN The middotcontract betweeh- NTC and the Prime Contractormiddot was tenninatedinJurie 20n

3