Shostack + Friends Blog Archive


Ephemeral port security

By now, most have heard about Dubai Ports World, a foreign entity, assuming control of operations at various U.S. ports. The arguments around this transaction are predictable and uninteresting. One thing that is clear is that the Committee on Foreign Investment in the United States (CFIUS) is legally mandated to consider such deals. In fact, if their consideration extends beyond 30 days, a more comprehensive 45-day investigation is required, and if that elapses, the President must personally make the decision on the matter and report to Congress.
In reading about the operations of the CFIUS in Forbes, I was struck by the following:

Along with clearing up the law’s vagueness, there’s a strong case to be made that CFIUS should have more time to review a complex deal. At present, an investigation automatically kicks in at the end of 30 days. A September 2005 report from the Government Accountability Office found a concern among CFIUS members that the stigma of an investigation could dampen foreigners’ desire to invest in the U.S. In particular, if an investigation isn’t resolved by the end of the 45 days, the president must make a decision and deliver a report to Congress.
The fear of stigma creates a perverse incentive to squeeze perhaps the most complex reviews into a 30-day window. All told, only about 20 of the 1,500 companies reviewed by CFIUS have been given a 45-day investigation. Only twice since 1997 has the president reported to Congress on a CFIUS review.

That second paragraph says alot. People will not voluntarily act to make themselves look bad if they can avoid it inexpensively.
If I were writing a law about, say, security breach disclosure, I’d bear that lesson in mind.

One comment on "Ephemeral port security"

  • “fear of stigma”, eh? In the 56 pages of GAO Report 05-686 ( there are many mentioned of the “percieved negative effect” but only one brief bit explaining it:

    According to
    Treasury officials, being the subject of an investigation may have negative
    connotations for a company. If it becomes public knowledge that the
    acquiring company is the subject of an investigation, it may be perceived
    that the government views the acquisition as problematic and the stock
    price of the company may fall. Thus, avoiding an investigation helps
    maintain the confidence of investors.

    That’s it. No direct, or even anecdotal evidence. And it’s not a question of stigma so much as fearing jitterish market reacting to the headline “investigation” anywhere near the deal.
    The fact that CFIUS responds to this by hustling through reviews is just an instance of regulatory capture.
    BTW, Chris, I disagree with your characterization that the “The arguments around this transaction are predictable and uninteresting.” The issue has been blown out of proportion but is exactly the sort of scare-mongering that the Fox News crowd usually panders with; watching senior GOP leaders have to decide whether to try to act tougher than the president or tow the party line has been fascinating. Ironically, after all the times this Administration has said “trust us”, the first time they may be right might also be the first time there is a mainstream political revolt.

Comments are closed.