TheChek News Flow

Close scrutiny of tech operations can uncover cybersecurity gaps before deals close

ADP, deployed a team of cybersecurity, risk management and financial-crime specialists to WorkMarket before acquiring it in January.

The ADP team combed the software maker’s technology, practices and internal policies. It also interviewed staff about monitoring for intrusions, training employees and performing other security tasks. The payroll processor also hired a cybersecurity firm to do its own evaluation.

Security problems, said ADP’s chief security officer Roland Cloutier, could kill any deal.

“If we found out data was exfiltrated, we may walk away,” he said. “We’ve looked at a lot of companies and only purchased a few. Security always plays a part.”

Companies are intensifying due diligence of acquisition targets to avoid costly cybersecurity surprises, particularly when intellectual property, such as software code or customer data drive the deal.

Scrutiny will continue as merger and acquisition activity heats up on expectations of extra cash from lower corporate tax rates. As of late February, 18 transactions valued at more than $5 billion each have been announced -- up from 10 such big deals during the same period in each of 2017 and 2016, according to Dealogic.

Gaps in data protection, undiscovered breaches, regulatory violations and other holes in a company’s technology operations can threaten transactions. Such problems can also decrease the value of a deal or leave an acquirer liable for problems after a merger.

ADP investigators typically look for troublespots such as signs of an unauthorized presence on the target’s network and scant or no evidence that employees have received security training.

No significant problems surfaced at WorkMarket, but deep study of a target’s cybersecurity helps executives forecast deal costs, Mr. Cloutier said. ADP typically spends two to four months on the process.

Problems can arise even years later. FedEx Corp. FDX -0.98% moved quickly last month to secure a server that exposed data from customer driver’s licenses and passports. FedEx inherited the server when it bought e-commerce service Bongo International in 2014.

Four or five years ago, cybersecurity due diligence consisted of asking a few questions in a short phone call, said Evan Wolff, a partner at Crowell & Moring LLP.

Now data compromises can diminish the value of a transaction, he said. Suspected theft of sensitive data uncovered through due diligence “becomes a business issue,” he said.

Verizon Communications Inc. VZ 0.63% last year renegotiated an acquisition proposal with Yahoo Inc.’s AABA -1.42% board after details emerged about massive hacking incidents. Verizon would ultimately learn all three billion Yahoo accounts were hit.

As a result, Verizon lowered it’s proposed purchase price by $350 million to $4.48 billion.

The company did studies to assess potential reputational harm and future risks, said Craig Silliman, Verizon’s general counsel, speaking at a Wall Street Journal conference in December. “We said, ‘We feel like we have enough clarity that we can put parameters around the risk here and negotiate a deal that effectively compensates us for the risk.’”

Home Depot Inc. HD -0.66% performed cyberrisk due diligence before buying retailer The Company Store and tool-rental firm Compact Power Equipment Inc. in 2017, said finance chief Carol Tomé.

“Our plans are basically to integrate these companies,” Ms. Tomé said. Their operations will be moved to Home Depot’s platforms and networks, she said. “So we’re closing down any little holes that the threat actor could take advantage of.”

The company has assessed cyberrisk on potential deals for the past decade, according to a spokesman. Getting breached in 2014 elevated cybersecurity concerns among senior leaders at Home Depot, Ms. Tomé said. Hackers stole email and payment-card information of up to 56 million customers.

Home Depot’s due diligence playbook includes penetration testing, Ms. Tomé said. “We have a heightened sense of awareness in this area and our due diligence is exhaustive.”

Waste Management Inc. WM 0.20% doesn’t dedicate a team to cyber issues during the diligence phase. The company instead focuses on the later stage of moving data from the target’s systems into its own, said CFO Devina Rankin.

The company spends $100 million to $200 million a year on garbage and recycling haulers. Legal, finance and digital groups move data about employees at acquired companies, usually within a week of closing the transaction. Customer data is absorbed within one month, she said.

Acquirers sometimes find costly cybersecurity issues embedded in contracts that a target signed with its own customers, said Buck De Wolf, general counsel for General Electric Co.’s global research group. GE has purchased at least 14 companies since 2015, including several small software providers, according to its annual reports.

Small companies hungry for sales might make onerous promises about how they will help and what they will pay for in a data breach related to their products, Mr. De Wolf said, speaking at security conference in December. It can be “a Trojan Horse” when taking on a new company, he said. Reviewing contracts helps GE avoid these problems, he said.

Dutch paints company Akzo Nobel is to replace its chairman Antony Burgmans, who last year was at the centre of a row with activist shareholders over his handling of a €26.9bn takeover offer from US rival PPG.

Mr Burgmans, who resisted calls to open talks with PPG, is retiring. He will be replaced by Nils Andersen, a former chief executive of the Danish shipping-to-oil conglomerate AP Moller-Maers and Carlsberg, the Dutch brewer. He will formally take up his position in April at the annual shareholder meeting.

Byron Grote, deputy chairman, said Mr Andersen had “a wealth of relevant experience gained during an extensive international career in the consumer goods, energy, and shipping industries”.

Last year the Dutch owner of the Dulux brand rejected three unsolicited buyout offers from PPG, arguing they undervalued its business, and would lead to substantial job cuts.

Akzo Nobel’s stance sparked a chorus of investor dissent, with a number of shareholders, led by the hedge fund Elliott Advisors, publicly urging it to the negotiating table.

Ellilott unsuccessfully sought to oust Mr Burgmans as chairman.

The Dutch paint maker, which is the second largest player in the $130bn global paints and coatings market, said in October it was preliminary talks with US group Axalta Coating Systems over a potential combination that could create a group valued at roughly $30bn.

Axa, France’s largest insurance group, has agreed to buy XL Group, a Bermuda-based property and casualty insurance company for $15.3bn.

“This transaction is a unique strategic opportunity for AXA to shift its business profile from predominantly life and savings business to predominantly property and casualty business,” said Thomas Buberl, AXA chief executive.

The all-cash deal at $57.60 a share represents a premium of 33 per cent to XL Group’s closing share price on March 2, according to Axa.

The French insurer will fund the takeover, which was reported over the weekend, using €3.5bn of cash at hand, €6bn from the planned US IPO and related transactions and €3bn of subordinated debt.

The deal will push Axa into the number one position in the property and casualty commercial lines business measured by gross written premiums, according to the company, with combined 2016 revenues of €30bn and total P&C revenues of €48bn.

Axa recently launched a wide-ranging shake-up of its business, cutting costs and giving more autonomy to its local managers.

The French insurance company is gearing up for the initial public offering of its US life and annuity business. The flotation was announced last May and is likely to take place in the coming months. There had been debate around whether the cash raised would be used to fund acquisitions or for share buybacks.

“We had a very clear strategy to reorient the group and change the profile, to take on less financial risk and more towards the core insurance risk and with this in mind we announced the IPO of our US business in life,” said Mr Buberl.

“The big question was what do we invest in and how do we do the IPO. Everyone thought we would do share buybacks, but for me share buybacks are the last resort . . . they represent a lack of sufficient entrepreneurial ideas,” added Mr Buberl.

The transaction adds to a run of big insurance deals under way. Already this year, US insurance group AIG agreed a $5.6bn deal to buy Validus, a reinsurer launched by Jeff Greenberg in 2005, and Phoenix Holdings reached a deal to buy the insurance unit of Standard Life Aberdeen.

Meanwhile, Japanese conglomerate SoftBank is in talks to take up to a 30 per cent stake in SwissRe, a reinsurer that is also looking to participate in consolidation. Deal activity has been particularly strong in the reinsurance sector as the industry’s long-term profitability is being threatened by capital pushed into the sector by low interest rates.

The acquisition is expected to close in the second half of 2018.

Failure to invest could lead to lack of spare capacity in case of future supply shocks

US dominance of oil production growth over the next two years will keep the market well supplied — but a crunch could loom after 2020 if investment into future global output fails to keep up with rising consumption, the International Energy Agency said.

Crude prices above $60 a barrel, prompted by robust world demand for oil and output cuts from global producers led by Opec and Russia, have spurred a second wave of production growth from US shale companies.

These producers, which are more efficient than before the oil market crash in 2014, will help US output grow by 3.7m barrels a day by 2023 — more than half of the world’s total growth, the Paris-based body said in its five-year oil market outlook published on Monday. Its publication coincides with the start of the annual CERAWeek oil industry gathering in Houston.

The agency revised higher its US output estimates by more than 2m b/d compared to last year’s report.

The US, together with Brazil, Canada and Norway, will ensure supply growth meets rising consumption over the next two years, the IEA said. Total supply outside of the Opec cartel is expected to reach 63.3m b/d in 2023.

But a pullback in spending on future output since the 2014 price crash could be “storing up trouble”.

A recovery in investments into exploration and production has “barely started”, the IEA said, with the world at risk of a lack of extra capacity if the market requires more barrels in the event of a supply shock.

“Upstream investment may be inadequate to avoid a significant squeezing of the global spare capacity cushion by 2023,” the IEA said. “With global demand rising steadily, the response from the supply side is crucial.”

Without sufficient spending, the amount of extra oil on hand could drop to just over 2 per cent of demand — the lowest since 2007.

For decades the world has relied on Opec countries, particularly the cartel’s de facto leader Saudi Arabia, to provide this security. The kingdom hold’s the largest share of the world’s spare capacity at more than 2m b/d.

“This emphasises the crucial role Opec’s largest producer continues to play in providing stability to global oil markets,” the IEA said.

Britain will need to make significant investments in its defense capabilities and foreign network

Theresa May last week set out her vision for Britain’s future trading relationship with the European Union. It was an overdue moment of clarity that may go some way toward unblocking stalled Brexit negotiations. But the U.K. Prime Minister has yet to provide any answer to a more fundamental question at the heart of Brexit: how does she see Britain’s future place in the world?

Brexiters insist that the decision to quit the EU was no act of isolationism or protectionism. They claim it was instead a vote for “global Britain” with “the freedom to make its own way in the world”. But what does global Britain mean in practice? And what will it do with this new-found freedom?

Of course, the U.K. is already a significant player on the global stage—and the British government wants it to stay that way. The U.K. is one of only two European countries with an independent nuclear deterrent and a permanent seat on the United Nations Security Council; it has one of Europe’s largest diplomatic networks; it is a leading NATO member; and it is the only major Western economy that spends both 2% of national output on defense and 0.7% of gross national income on foreign aid.

Even so, doubts about the U.K.’s commitment to its global role were emerging even before the Brexit referendum. The U.K. has played little role in efforts to resolve the Ukraine crisis, leaving the task to France and Germany. It has also been a bystander in the Syrian crisis since 2013, when Parliament refused to back airstrikes against the Assad regime. The U.K.’s only major foreign-policy initiative in recent years was its ill-fated 2011 attack on Libya, a strategic disaster that left the country a failed state, allowing it to become a major transit route for migrants entering the EU.

Recent British inaction has been matched by a reluctance to invest. The Foreign Office budget has been slashed by half since 2010, with many embassies closed or downsized. The British army already has fewer than 78,000 full-time soldiers, the lowest in modern peacetime history. The Royal Navy surface fleet comprises just 19 ships, compared with 50 in 1990, none of which at one point in December were deployed outside British waters; the first of two new aircraft carriers won’t deploy until 2020 and even then won’t carry a full complement of aircraft until the mid-2020s. Now further military cuts are needed to fill a £20 billion ($27 billion) shortfall in the defense budget.

Meanwhile, the U.K. may already be paying a price for Brexit in terms of lost influence. As of last week, there is no longer a British judge at the International Court of Justice for the first time since the U.N. judicial body was established in 1946, after the British candidate lost out to an Indian judge in a vote at the U.N. General Assembly.

The U.K. was also defeated on another vote at the General Assembly last year in a longstanding dispute over the status of the Chagos Islands, which were detached from Mauritius three years before it became independent in 1968 to allow for the creation of a British military base. Worryingly for the U.K., several EU countries abstained rather than back Britain.

British officials believe that shortsighted political decisions contributed to these defeats. They note that 14 of the 17 African countries in which the U.K. no longer has any diplomatic representation voted against the British candidate at the ICJ. They also note that the latest escalation of the dispute with Mauritius came months after the U.K. scrapped its development program in the country. They fear that Brexit may deepen these strains: the Foreign Office is redeploying around 100 staff to Europe to meet the need for more intense bilateral contacts with EU governments, potentially further weakening British influence elsewhere.

How can the U.K. avoid further damage to its global standing? Its most urgent task is to find a new model for its relationship with the EU. In the aftermath of the referendum, Brexiters argued that the U.K. had a “security surplus” with the EU which could be used as a bargaining chip in trade negotiations.

But today, there is wider acknowledgment that the EU has been a “multiplier” for British foreign policy. Prime Minister Theresa May made clear in a speech last month that she wants a new security partnership that will preserve as much as possible existing EU foreign- and security-policy cooperation—though finding new mechanisms to achieve this won’t be easy.

The U.K. has even signaled it may be open to participating in future EU defense-integration initiatives and a European defense fund, policies it had previously opposed.

But if “global Britain” is to be anything more than a slogan, the U.K. will face some tough decisions. Significant investment will be needed in its defense capabilities and foreign network to maintain global influence. Outside the EU, the U.K. will want to beef up its presence in other multilateral institutions such as the International Monetary Fund, World Bank and the U.N. It will also need to consider more strategic use its aid budget, which is currently spent in fewer than 40 out of 140 eligible countries. One way to boost its global profile would be to take on the leadership of international peacekeeping missions.

Brexiters may claim that Brexit wasn’t a retreat from the world—but can they persuade voters to stump up the cash to make their dream of global Britain a reality?