|EUROPEAN COMMISSION |

Brussels , 26.1.2011

SG-Greffe (2011) D/1407

C(2011) 529 final

PUBLIC VERSION In the published version of this decision, some information has been omitted pursuant to Article 17(2) of Council Regulation (EC) No 139/2004 concerning non-disclosure of business secrets and other confidential information. The omissions are shown thus […]. Where possible the information omitted has been replaced by ranges of figures or a general description.

MERGER PROCEDURE ARTICLE 6(1)(b) DECISION IN CONJUNCTION WITH ARTICLE 6(2)

To the notifying party:

Dear Sir/Madam,

Subject: Case No COMP/M.5984 – INTEL/MCAFEE Notification of 29.11.2010 pursuant to Article 4 of Council Regulation No 139/2004 [1]

1. On 29 November 2010, the Commission received a notification of a proposed concentration pursuant to Article 4 of the Merger Regulation by which the undertaking Intel Corporation ("Intel", USA) acquires within the meaning of Article 3(1)(b) of the Merger Regulation control of the whole of the undertaking McAfee, Inc. ("McAfee", USA) by way of purchase of shares.

I. THE PARTIES

2. Intel is the leading central processing unit ("CPU") and chipset producer. It develops advanced integrated digital technology products, primarily integrated circuits, for industries such as computing and communications. Intel also develops platforms of digital computing technologies, which combine various types of hardware and software.

3. McAfee is a security technology company active in the design and development of security products and services focused in particular on ensuring that internet connected devices are protected from malicious content. McAfee supplies security solutions for servers, desktops and laptop computers, handheld voice and data phones, and other devices that are connected to corporate systems and networks and home PCs.

II. THE CONCENTRATION

4. On 18 August 2010, Intel and McAfee signed a binding Agreement and Plan of Merger pursuant to which Jefferson Acquisition Corporation, a wholly owned subsidiary of Intel, will merge with and into McAfee [2] . McAfee will be the surviving entity and will become a wholly owned subsidiary of Intel. As a result of the proposed transaction, McAfee will be solely controlled by Intel. The operation therefore constitutes a concentration within the meaning of Article 3(1)(b) of the Merger Regulation.

III. EU DIMENSION

5. The undertakings concerned have a combined aggregate worldwide turnover of more than EUR 5 000 million (Intel: EUR 25 184 million; McAfee: EUR 1 382 million) [3] . Each of them has an EU-wide turnover in excess of EUR 250 million (Intel: EUR […] million; McAfee: EUR […] million), but each does not achieve more than two-thirds of its aggregate EU-wide turnover within one and the same Member State. The notified operation therefore has an EU dimension.

IV. RELEVANT MARKETS

A. Introduction

6. There is no relevant horizontal overlap or vertical relationship between Intel and McAfee. CPUs and/or chipsets and IT security solutions are however largely complementary and at least closely related products.

1. CPUs and chipsets

CPUs

7. The CPU is the device within an electronic device (mostly a computer) that interprets and executes instructions [4] . CPUs generally comprise millions of transistors that process data and control other devices in a computer system. The CPU has the ability to fetch, decode and execute instructions and to transfer information to and from other resources over the computer's main data-transfer path, the bus. The CPU is the computer's 'brain'.

8. CPU performance is a key component in the overall performance of a computer. In terms of cost, a CPU is the component which represents the most significant proportion of a computer’s cost. According to one study quoted by the Commission in its 2009 Intel antitrust decision [5] , it ranges between 13% and 27% of the final cost of a computer (generally speaking, the higher the specification of the computer, that is, the more sophisticated the computer is, the higher the share of the cost accounted for by the CPU).

9. CPU manufacturers compete in particular on two dimensions: the architecture and the physical dimension of the transistors.

10. The architecture is about the way to organise the connections between transistors within the CPU. As regards architecture, there are two main categories of computer CPUs which are based on two different conceptions of the set of instructions: Complex Instruction Set Computer ("CISC") and Reduced Instruction Set Computer ("RISC"). Intel's x86 instructions architecture, which is built on the basis of a CISC architecture, is the most widely used in today's computer industry.

11. The physical dimension is about the size of transistors and circuitry that can be achieved within the CPU: the smaller it is, the faster is the CPU and the less energy it consumes. As regards the physical dimension, Intel is now one of the last vertically-integrated semiconductors manufacturers, as opposed to its two competitors in x86 CPUs, AMD and Via Technologies ("Via"), who are 'fabless' manufacturers [6] .

Chipset business

12. A chipset refers to a designated group of integrated circuits that is designed to perform one or more related functions. Its main task is to connect the CPU to a specified set of other components. The chipset primarily consists of a 'northbridge' and a 'southbridge', which are dedicated to connecting the CPU to the high-speed components, notably the main memory and graphics controllers, and to the lower-speed peripheral devices, respectively.

13. Chipsets are generally designed to work with a specific family or generation of CPUs: a CPU and chipset combination needs to be compatible in order to function.

2. IT security solutions

14. Information technology security has become a growing concern over the past few years, due to the exponential rise in the number of malware [7] present on the internet, as well as its possible consequences, in particular for large enterprises and governments.

15. IT security solutions pursue two main objectives: (1) detection of and defence against incoming threats and (2) control and certification of authorised users and software [8] .

16. Detection of and defence against incoming threats consists in identifying incoming threats and in preventing malware from accessing information and devices by recipients or from destroying or altering that information. Traditionally this objective is often achieved on the basis of a 'black-listing' approach, where incoming elements are compared against a database of known threats. In some environments (e.g. the I-Phone platform) this objective is also achieved through a 'white-listing' approach where only software or applications listed and recognised as safe are allowed to access a given device.

17. Control and certification of authorised users and software consist in allowing access to a device, a mailbox or data only to those users, applications or software that have been previously certified as safe and which can identify themselves through a key or certificate.

3. Relationship between CPU/chipset and security solutions

Technological link

18. First, on the technology side, both for reasons of security and speed, security software interacts perhaps to a greater extent than other software directly with the hardware level. Security software vendors ("SSVs") therefore need access to up-to-date, accurate and complete interface information on new CPUs and chipsets in order to be able to develop new security software. Good interface information is also required to optimise the software with regard to performance and power consumption since the running of security processes may significantly increase the workload on the CPU and affect the available performance of the computer. In that connection it must be borne in mind that software vendors typically write their software at a high level of abstraction and let compilers (which translate the software language into the hardware language) adjust the code for the specificities of a CPU. In many cases, the operating system ("OS") also consolidates multiple hardware features into software functions that are easier to use and allow software to access these functions through application programming interfaces ("APIs").

19. Second, certain features of IT security may be more effectively enabled in hardware (CPU, chipset) than in software. For instance, the user digital signature, required for encryption and authentication, can be stored and generated more securely in hardware. File scanning, required for the detection of viruses, may be more efficiently performed at the level of the CPU. Hardware implemented security may also enable remote attestation which can be used to control accesses to a network. Overall, the partial embedding of security solutions in hardware may lead to more robust and/or faster security solutions.

20. The products of Intel and McAfee are therefore from a technical point of view in closely related markets.

Commercial link

21. On the commercial side, every endpoint [9] working on a Windows/x86 platform needs in principle some form of security software in order to be protected against incoming threats [10] . Moreover the same intermediaries such as Original Equipment Manufacturers ("OEMs") or Value Added Resellers in the enterprise market ("VARs") may be involved in the decisions which CPUs to use and which security solution to install.

22. The products of Intel and McAfee are therefore also from a commercial point of view in closely related markets.

B. CPUs

1. The relevant product markets

23. The notifying party claims that the relevant product market comprises general-purpose CPUs for servers, desktops, notebooks, netbooks, nettops, and tablets.

24. Within this scope of devices, according to the notifying party, the relevant market for CPUs should include non-x86 CPUs because in particular competition between the x86 CPU architecture and the ARM CPU architecture is intensifying. But it indicates that a narrower CPUs market definition according to the type of platform or the type of architecture does not affect market shares in a significant manner and therefore does not change the assessment.

25. In the 2009 Commission Intel antitrust decision [11] the Commission found that (1) there is a distinct market for x86 CPUs and that (2) CPUs for non-computer devices and CPUs for computers are not demand-side substitutes.

26. The Commission has also envisaged at the time a possible sub-segmentation according to the type of platform (servers, desktops and notebooks):

27. In the 2009 Commission Intel antitrust decision, the Commission has considered that a chain of substitution could exist on the demand-side across the three different types of platform, meaning that all CPUs for computers are in one relevant product market "even though, for example, the cheapest CPUs destined for low-end desktops are not direct substitutes for more expensive CPUs destined for expensive servers" [12] . The Commission has however ultimately left open the exact delimitation of the relevant product markets for x86 CPUs with regards to the type of platform.

28. Almost all respondents to the Commission's phase I market investigation ('the market investigation') confirm a separate market for x86 architecture CPUs as identified in the 2009 Commission Intel antitrust decision [13] .

29. The market investigation suggests that it might possibly be appropriate to further segment x86 CPUs according to the type of platforms. In this regard, x86 CPUs for servers, desktops and notebooks might belong to separate product markets. X86 CPUs for new types of devices, such as netbooks, tablets, handheld devices and consumer electronics might also form different product markets that have not been assessed at the time of the 2009 Commission Intel antitrust decision. The question of further segmentation according to the type of device can however be left open since the conclusions of the assessment remain unchanged.

30. The Commission therefore concludes that the relevant product market encompasses x86 CPUs, potentially segmented according to the type of platform.

2. The relevant geographic market

31. In the 2009 Commission Intel antitrust decision [14] , the Commission concluded that the markets for x86 CPUs are worldwide. This conclusion was supported by the fact that the main suppliers compete globally, CPU architectures are the same around the world, the main customers (in particular the OEMs) operate on a worldwide basis, and the cost of shipping CPUs around the world is low compared to their cost of manufacture.

32. The market investigation confirms the notifying party's point of view that the relevant geographic markets for x86 CPUs are indeed worldwide.

33. The Commission therefore concludes that the relevant x86 CPU market has a worldwide geographic scope.

C. Chipsets

1. The relevant product market

34. Chipsets could constitute a distinct product market from other hardware components, in particular CPUs, since they can be bought and sold independently. Until a few years ago there were a number of independent chipset producers competing to produce chipsets for the x86 CPUs of Intel and AMD.

35. Apparently as a result of a number of more recent changes first in Intel's and then in AMD's interoperability policies industry analysts describe today a situation where x86 chipset markets may have to be further subdivided in the markets for chipsets compatible with Intel CPUs and chipsets compatible with AMD CPUs [15] . Intel and AMD manufacture chipset for their own CPUs only, which would support this further subdivision into two separate 'aftermarkets'. Intel, AMD and Nvidia are the sole remaining significant players on this market or markets (see paragraphs 60 and 61 below).

36. For the purpose of the present assessment, the market definition can however be left open since the conclusions of the assessment remain unchanged.

2. The relevant geographic market

37. Based on industry analyst reports, that have not been contradicted by the market investigation, the Commission considers that the market for chipsets which has very similar characteristics as the CPU market is worldwide.

D. Security software

1. The relevant product market

38. The notifying party claims that within the broad IT security solutions sector, endpoint security products and services ("endpoint security") form a relevant product market where McAfee achieves three quarters of its revenue.

39. According to this IDC taxonomy, within the general category 'Secure Content and Threat Management' ("SCTM") [16] , endpoint security forms a distinct product market from network security, messaging security and web security.

40. Endpoint security encompasses products that are designed to protect endpoints from attack or to directly protect information residing on endpoints. Endpoint security is generally defined as "client antivirus products, file/storage server antivirus, client antispyware products, personal firewall products, host intrusion prevention products, file/disk encryption, and endpoint information protection and control products […]" [17] .

41. The notifying party considers also that it would be conceivable to extend the relevant market to include messaging security [18] and web security [19] because McAfee's endpoint security business unit also applies these products to some end-consumers and enterprise customers. This would illustrate the fact that there is a growing demand for the purchase of multiple security tools as a single solution.

42. The notifying party however indicates that the broadening of the endpoint security market to messaging and web security would not alter the assessment of the transaction given McAfee's limited sales of these types of security products.

43. In a previous decision [20] the Commission used similar IDC break-down general security software categories into sub-categories.

44. In this decision, the Commission also considered two potential sub-segmentations of the product market according to (i) their availability for the various OS platforms and (ii) the category of customer. The market investigation carried out by the Commission at the time did not clearly conclude that these two sub-segmentations were relevant for this type of security product and the Commission left the exact definition of the relevant product markets open.

45. The market investigation in the present case largely confirms that the IDC segmentation of the security solution market is appropriate [21] and that endpoint security can be regarded as a distinct product market.

46. The market investigation also suggests that endpoint security may have to be further segmented according to the type of end-user, i.e. endpoint security for consumers and endpoint security for enterprises [22] . Consumers comprise final-end users as well as small and medium size enterprises ("SMEs") whose demand characteristics and buying patterns are similar. Enterprises comprise large private companies and government bodies.

47. Consumers are often not able or willing to exactly compare the effectiveness of different security solutions. They are also less sensitive to the need to make secure use of their IT devices compared to enterprises. Both points are illustrated by the relatively important use of freemium [23] security solutions by consumers. According to a McAfee internal document, [40-50]% of consumer security users worldwide use free products [24] .

48. Enterprises by contrast require high-level technologies, a broad compatibility of the security software with their potentially very diverse installed base of hardware and software. They also seek suppliers which provide a broad range of products, associated services and support. They are seeking suppliers with recognised brands which are likely to continue for a number of years to provide best of breed and state of the art technology.

49. This segmentation is supported by an IDC market analysis according to which endpoint security market "is segmented into […] products that are purchased by consumers and […] [products] that are acquired by corporations and other organizations" [25] .

50. The Commission considers that endpoint security constitutes a relevant product market which might be further segmented according to the type of end-customers, i.e. in a market for endpoint security for consumers and a market for endpoint security for enterprises.

51. The exact definition of the relevant product markets for endpoint security can be left open, as the conclusions of the assessment would be the same regardless of whether the market for endpoint security is further segmented or extended as suggested above.

2. The relevant geographic market

52. The notifying party claims that the geographic market for endpoint security is worldwide or at least EEA-wide in scope. It refers to a previous decision [26] in which the Commission has noted that suppliers offer their security software products "globally in one standard function version, except for the language". In this decision, the Commission also mentioned the fact that the sales prices for security software products are largely harmonized within the EEA in the sense that "the price is set by the US/English version of the product and a premium is added to recover cost from providing the product in various languages" [27] .

53. The Commission however left open the exact definition of the relevant geographic markets for security software. It noted in particular that although larger organisations have a tendency to prefer global sourcing of security software products, small organisations or consumers could consider sourcing via alternative sales channels, within their country.

54. The market investigation confirms that the relevant geographic markets for endpoint security are at least EEA-wide.

55. In conclusion, the Commission considers that the endpoint security markets have a worldwide or at least EEA-wide geographic scope.

V. ASSESSMENT

A. Competitive landscape

1. Intel's dominant position

X86 CPUs

56. In the 2009 Commission Intel antitrust decision [28] , the Commission concluded that at least between October 2002 and December 2007, Intel held a dominant position in the market(s) for x86 CPUs. The Commission indicated that Intel consistently held very high market shares in excess of or around 80% in an overall x86 CPU market and in excess or around 70% in any of the sub-markets defined according to the type of platform (servers, desktops and notebooks).

57. A vast majority of the respondents to the market investigation consider that Intel is still dominant in the overall x86 CPU market or separate sub-markets for x86 CPUs for servers, for desktops and for laptops and that the factors that led the Commission in its antitrust case to consider Intel dominant in these markets are still valid today [29] . These factors are persistently very high market shares as well as high barriers to entry and expansion in these markets (see paragraphs 91-96 below).

58. Mercury Research estimates Intel's market share in volume for x86 CPUs in 2009 at [80-90]% worldwide. For each type of platform, including netbooks, Intel's market shares in volume for x86 CPUs in 2009 exceed [70-80]% worldwide [30] .

59. With regard to the other new types of platforms (such as tablets, handheld devices, and consumer electronics), Intel is not yet active or has relatively limited market shares.

Chipsets

60. With regard to the chipsets markets, Intel's worldwide market shares in volume are very high, as illustrated in the table below.

[…] [70-80]% […] [10-20]% […] [10-20]% […] [0-5]% […] [0-5]% […] [0-5]% […] [70-80]% […] [10-20]% […] [10-20]% […] [0-5]% […] [0-5]% […] [0-5]% [100-110] 100% [100-110] 100%

(source: Mercury Research)

61. Intel has also gained an even higher share in the possible 'aftermarket' of chipsets for Intel x86 CPUs. As a consequence of a change of interoperability policies other chipset producers for Intel CPUs have largely exited the market.

[80-90] 100% […] [90-100]% […] [5-10]% […] [0-5]% […] [0-5]% […] [0-5]% […] [0-5]%

(...PICT...)

(source: Mercury Research)

Conclusion

62. Given the persistently very high market shares which are often higher than [70-80]% as well as very high barriers to entry and expansion in these markets (see paragraphs 91-96 below), the Commission concludes that Intel still holds today a dominant position in the market for in x86 CPUs whatever its segmentation, except for new platforms such as tablets, handheld devices and consumer electronics. Prima facie Intel appears also to be dominant in the chipsets market in particular in a possible market for chipsets for Intel x86 CPUs.

2. McAfee's position

63. McAfee is one of the few security technology companies active in practically all areas of the security technology spectrum. It serves a wide scope of customers: end-consumers, SMEs, and large private corporations and governmental organisations.

64. McAfee achieves however around […] of its total software security revenue in endpoint security where it is worldwide the number two player measured by revenue ([10-20]%) behind the leader Symantec ([30-40]%). McAfee's worldwide endpoint security sales represented about USD […] million in 2009.

65. While McAfee's EU revenues in the consumer segment (USD […] million) are considerably lower than in the corporate segment (USD […] million), the opposite is true in the US (USD […] million, compared to USD […] million).

66. In both segments, McAfee remains number two, behind Symantec (see paragraphs 74-82 below).

67. Should an EEA-wide geographic market be assessed, McAfee's positions are not significantly different.

68. On the other markets of security software (network, messaging, web security, identity access and management, security and vulnerability management), McAfee's positions are limited. Based on an Intel internal document based itself on IDC studies [31] , McAfee's worldwide market shares in 2009 on these markets can be estimated as follow:

Network |[0-5]% |

Messaging |[5-10]% |

Web security |[0-5]% |

Identity access and management |Not active |

Security / vulnerability management |[0-5]% |

Other |[0-5]% |

3. The parties' competitors

3.1. CPUs and chipsets markets

CPUs

69. While the x86 architecture with Intel and AMD as the main producers remains pervasive for servers, desktops, laptops and netbooks, this architecture faces some competition in netbooks and very strong competition in handhelds from ARM, a company that has developed a RISC architecture used in most mobile devices such as smartphones.

70. ARM is built on the basis of a RISC architecture developed by ARM Holdings. Whereas ARM CPUs were originally conceived as CPUs for desktop personal computers, their relative simplicity made them particularly suitable for low power applications. ARM architecture is currently the most widely used for mobile and embedded electronics applications. However, it currently does not support Microsoft's operating system ("OS") Windows, which limits its footprint in the desktop and laptop segments [32] .

71. The x86 architecture today also faces a limited degree of competition from graphic cards manufacturers (e.g. Nvidia). A GP-GPU (General Purpose Graphic Processing Unit) can indeed to a certain extent perform the same functions as a standard CPU. In particular, a GP-GPU can handle more computing tasks and, consequently, it may reduce the demand for high-end CPUs.

72. In the competitive landscape in the overall x86 CPU market, Intel takes a prominent position with over [80-90]% of the market share of the volume shipped. AMD holds a much lower share of the market, while Via's position is insignificant in terms of volume shipped. The table below presents Intel competitors' market shares.

[…] [80-90]% […] [10-20]% […] [0-5]% [110-110] 100% […] [80-90]% […] [10-20]% […] [0-5]% [90-10 0] 100%

(...PICT...)

Chipsets

73. According to an industry analyst [33] , the market for chipsets has been highly competitive until recently: a radical shift took place in the 2008-2009 timeframe, as a result of market consolidation and technological developments. Consequently, the number of market participants that is shipping significant volumes of chipsets has decreased from seven in 2005, to three in the current market situation, two of which are also supplying CPUs (Intel and AMD) [34] .

3.2. Endpoint security

74. According to IDC [35] , worldwide revenue for the endpoint security market reached USD [6000-7000] million in 2008 [36] . The consumer market (USD [3500-4000] million) is larger than the corporate market (USD [2500-3000] million) but this latter is foreseen to grow at a faster pace within the coming years.

75. On the overall worldwide market for endpoint security, the market shares of McAfee and its main competitors are the following:

Security Software Vendor |2008 turnover (USD million) |2008 market share |

Symantec |[…] |[30-40]% |

McAfee |[…] |[10-20]% |

Trend Micro |[…] |[5-10]% |

Kaspersky Lab |[…] |[0-5]% |

Sophos |[…] |[0-5]% |

AVG Technologies |[…] |[0-5]% |

F-Secure Corp. |[…] |[0-5]% |

BitDefender |[…] |[0-5]% |

Panda Software |[…] |[0-5]% |

Check Point |[…] |[0-5]% |

Others |[…] |[10-20]% |

Source : IDC. Revenue covers all security products but excludes earnings from professional services such as consulting, implementation, operations, education and training.

76. Symantec is the leader of this overall market, followed by McAfee and Trend Micro. These three companies are the only ones mainly active in both the endpoint security for consumers and in the endpoint security for enterprises, as illustrated in the graphic below.

(...PICT...)

Source: Intel internal document based on IDC studies [37]

Endpoint security for consumers

77. The two main competitors of McAfee in this market are Symantec and Trend Micro. Together these 'three big vendors' have the largest R&D budgets. They account for over [70-80]% of revenues in endpoint security for consumers [38] and play a pivotal role in the broader security software market. They also have the closest technological and commercial relationships with CPU vendors ([…]), OS vendors (in particular Microsoft) and OEMs. Only Symantec, McAfee and Trend Micro are to a commercially significant extent active in the OEM channel, i.e. have agreements with OEMs to preinstall their security software for a free trial and possible later conversion on the computers shipped by the OEMs in question.

78. Besides the three big vendors, there is a large number of smaller often regional endpoint security vendors such as Kaspersky, F-Secure, AVG, Avast, Avira, or Panda Security.

79. In the consumer space many of those smaller players operate on the basis of a freemium business model and offer their basic security software for free. Their deployment shares are thus often much more important than the revenue market shares suggest. According to a McAfee's internal document, [40-50]% of consumer security users worldwide use free product offerings provided by 31 companies [39] . The current 'freemium' leaders are AVG, Avast and Avira that claim, according to this internal document, "more than 100 million users". Microsoft has also free security product offerings for consumers.

Endpoint security for enterprises

80. According to Gartner [40] , this market is "still dominated by the market share of the big-three traditional antivirus vendors – McAfee, Symantec and Trend Micro – which, together, represent roughly 85% of the market share". Gartner notes also that "many nimble vendors are beginning to challenge the status quo with innovative endpoint platforms solutions and a higher level of customer focus". However, "despite the introduction of new players, the displacement of incumbents is still a significant challenge. The biggest impact for the challengers and visionaries is to push the dominant market players into investing in new features and functionally, and to keep pricing rational" [41] .

81. According to an Intel Presentation to DG Competition [42] , from which the above graphic is extracted, McAfee ([10-20]%) competes with Symantec ([20-30]%), Trend Micro ([5-10]%), but also Sophos ([5-10]%), Cisco ([0-5]%), IBM ([0-5]%), CA ([0-5]%), Check Point ([0-5]%) and other competitors that together represent [30-40]% of this market.

82. Although, given the differences in the data from Gartner and IDC, it was not possible during the phase I investigation to establish fully reliable market shares for corporate endpoint vendors, the Commission considers that McAfee, Symantec and to a lesser extent Trend Micro are the three main competitors in endpoint security for enterprises, in particular for the largest enterprises. Sophos' market share in large enterprises remains limited compared to Symantec's, McAfee's and Trend Micro's. Thus, according to Gartner, "Sophos is continuously challenged to differentiate itself from the 'big three' players […]" [43] .[…]The same analysis applies to the remaining even smaller competitors.

4. The parties' customers

4.1. Intel's customers

83. OEMs are the main direct customers for CPUs and chipsets. Intel sells directly to the 11 largest OEMs [44] which represent about […] of Intel's sales. These multi-national corporations negotiate with Intel for their worldwide purchases from the site of their corporate headquarters. Intel negotiates price framework agreements that typically last […]. Some negotiations for systems directed at enterprises (both PCs and servers) may however have a […] cycle and additional agreements can be negotiated for shorter periods when they are linked to specific sales events, such as 'back-to-school' or 'holidays season' sales activities, or in the context of bidding events organized by the OEMs for their enterprise clients. OEMs typically refresh their existing product offerings and launch new designs in regular cycles (three or four times per year).

84. Regional OEMs [45] account for about […] of Intel's sales. They buy CPUs and chipsets directly from Intel. According to Intel, the list prices and discounts negotiated with these customers tend to follow the same pattern as those that are negotiated with the large multi-national OEMs.

85. Intel also sells indirectly to more than […] local OEMs that operate in the so-called 'white box channel'. They represent the remaining […] of Intel's sales. These are Intel's indirect customers. Local OEMs buy from independent distributors that have been appointed by Intel as its non-exclusive resellers usually for a period of […]. Intel publishes recommended list prices for its distributors about three to four times a year.

4.2. McAfee's customers

86. McAfee develops products and services for enterprises (including governments) and consumers (including SMEs).

87. In the enterprise segment, about […] of McAfee's sales are generated through value-added resellers ("VARs") and systems integrators ("SIs"), who install and configure the products and may also manage the system. The remainder of McAfee's sales in the enterprise segment ([…]) are made directly by McAfee's sales force.

88. In the consumer segment (including SMEs), about […] of McAfee revenues are generated through the OEM sales channel. OEMs operate as a distribution partner for McAfee and pre-install security products on their PCs for a fee. Consumers have the opportunity to use them for a limited trial period (typically 30, 60 or 90 days) before having to pay a subscription fee to receive updates for protection against new malware. According to Intel, when choosing an SSV partner, OEMs consider the financial terms they offer, their brand and their ability to provide support once products ship. McAfee's OEM partners currently include Acer, Dell, HP, Lenovo, Samsung, and Toshiba.

89. Internet Service Providers ("ISPs") represent about […] of McAfee's revenue in the consumer segment. McAfee's ISP partners currently include ATT, BT, Telefonica, Comcast, Verizon, Telstra, Big Globe, China Unicom and Singtel. The ISP may either charge subscribers for the added security protection service or provide it for free. The ISPs are generally charged either on a per-subscriber or on a flat rate basis. If the end-users pay a fee to the ISP for the use of the security product, McAfee will normally receive a share of this revenue. Where the end-user receives the service for free, the ISP typically pays McAfee.

90. The retail channel [46] represents around […]% of McAfee's revenue in the consumer segment. About […]% of McAfee's revenue in the consumer segment is directly generated through sales made from its website.

5. Markets characteristics

5.1. CPUs and chipsets

Barriers to expansion and entry

91. In the Commission 2009 Intel antitrust decision, the Commission indicated that a potential entrant faces significant intellectual property barriers and has to engage in substantial initial research and development and production investment to be able to start production of x86 CPUs [47] .

92. Moreover, once this investment has been made, it is necessary to achieve a high capacity utilisation to minimise average cost and thus compete most efficiently with the incumbent manufacturers already in the market (essentially, Intel and AMD) [48] .

93. Therefore, in the light of (i) the significant sunk costs in research and development, (ii) the significant sunk costs in plant production and (iii) the resulting significant economies of scale which mean that the minimum efficient scale is high relative to overall market demand, the Commission concluded that there are significant barriers to entry in the CPUs market.

94. Furthermore, once entry has taken place, a manufacturer's production capacity is limited by the size of the existing facilities. Expanding output requires additional investment into new property, plant and equipment as well as several years lead time.

95. Intel however pointed out the entry in the market of CPUs of several companies who obtained licenses from ARM Holdings for its CPU core and then developed and launched derivative designs based on the licensed core.

96. The market investigation confirms the findings made in the Commission 2009 Intel antitrust decision, in particular the Commission analysis of the barriers to expansion and entry which are still high. A respondent to the market investigation explains that this can be explained by the critical mass of products which have to be sold due to previous high development and manufacturing costs [49] .

Innovation

97. In the Commission 2009 Intel antitrust decision, the Commission underlined that innovation is, together with price, one of the main factors that triggers demand in the x86 industry. The very high research and development ("R&D") and production costs can usually only be recovered if new inventions can be sold before the competitor responds with a more innovative product. The pace of innovation is rapid, which means rapid increases in CPU transistor density and rapid improvements in the CPU architecture.

98. According to Intel, it has indeed to improve regularly its product design and production technology. In particular, Intel's R&D efforts focus on increasing the functionality of its CPUs by incorporating additional features.

99. CPU transistor density generally doubles about every eighteen months. For CPU producers, this is mainly relevant when it comes to investment in new and more innovative production facilities which manufacture dies with increasingly smaller circuitry. Transistor density also has an impact on the performance of the CPU.

5.2. Endpoint security

Barriers to expansion and entry

100. According to the market investigation, barriers to entry seem to be relatively low for small players. In the consumer market, it appears not so difficult to become either a specialist niche player or an imitator, employing the freemium model.

101. In contrast, barriers to expansion both in the enterprise and the consumer segment seem to be significant.

102. In the enterprise segment, the key factors mentioned in the market investigation were brand recognition, range of products, services and support, and trust that the company will continue to innovate. Some respondents to the market investigation mention in particular the necessity to have a widespread threat detection system and a threat intelligence database in order to compete effectively. Currently, only a few number of SSVs maintain their own global threat detection.

103. Economies of scale are essential to support the R&D and infrastructure necessary to provide today’s advanced security services. Security software has to be updated continuously with the latest malware alerts to provide effective security. Providing these updates requires an extensive infrastructure. Only the larger security vendors can detect new malware quickly and provide the appropriate level of preventative service demanded by customers.

104. In the consumer segment there is a clear division between the players with access to the OEM channel (Symantec, McAfee and Trend Micro) and the other players, mainly the freemium players, without such access.

105. Symantec, McAfee and Trend Micro have built high brand recognition and have high revenues with relatively low penetration.

106. Moreover, these players benefit from network effects that increase the barriers to expansion. Indeed, the more users an SSV has, the higher its chances to detect new malware, in particular when those users are distributed evenly across different geographic areas.

107. Symantec, McAfee and Trend Micro have high R&D budgets and global threat detection networks.

108. On the contrary, these characteristics are less important for the freemium players that lack access to the OEM channel. These players are generally characterized by high market penetration, a lower R&D budget and relatively low revenues.

Innovation

109. The security market is globally characterized by rapid innovation.

110. SSVs have indeed to invest in innovation given the intense competition in these markets. According to Intel, the R&D budgets associated with finding specific set of malware samples, processing those samples and enhancing the software security products are largely similar among SSVs regardless of their size. But Intel justifies the higher R&D budgets for companies like McAfee and Symantec by the necessity to support larger product portfolios and larger customer bases. According to Intel, SSVs with smaller R&D budgets are able to effectively compete by concentrating their efforts on narrower product portfolios and focusing on specific customer segments and/or security threats.

111. Intel's argument is however contradicted by one McAfee's competitor, according to which "[…] while it is acknowledged that currently some security software providers succeed in bringing a competitive product to market on the basis of limited R&D programs, these companies tend to be focused on a narrow set of applications. They consequently lack the same breadth of coverage as McAfee, Symantec or others. For this reason and given their less stable position in the market, these start-ups will typically not be considered viable suppliers to enterprise customers" [50] .

112. The market investigation shows generally that significant and continuous innovation is indispensable to effective security [51] .

5.3. Relationships between CPUs/chipsets manufacturers and endpoint security vendors

113. Historically, Intel has regularly briefed SSVs on new and upcoming CPUs and chipset features. It has also provided libraries for common features optimised for new products. It has made available tools and consulting to enable SSVs to optimally use the CPUs/chipsets. It has actively sought feedback from the SSVs community on future features.

114. Intel has several different models of cooperating with software vendors: (1) high-touch; (2) mid-touch; and (3) scale partners.

115. High-touch accounts consist mainly of Microsoft and Symantec for whom Intel typically dedicates account managers and engineers to service these accounts. Intel works with these accounts earlier in the process because of their larger scale and expertise to understand what feature sets will be useful to the software development community.

116. Mid-touch accounts receive, according to Intel, slightly less personalization than high-touch accounts, with managers and engineers dedicated across many different software vendors. These accounts typically represent mid-sized software vendors who have less scale and resources to commit developments efforts. They are also invited to participate in validation efforts prior to launch, though typically closer to the launch date when the product is more developed. The majority of SSVs such as McAfee, Trend Micro and Kaspersky fall into this category.

117. The scale partners are the smaller SSVs who use the Intel Software Partnership Program ("ISPP"). This program distributes materials to the scale partners. Information available through the program contains the same set of final technical specifications available to high and mid-touch accounts and provides any SSVs with the key information it needs to adopt Intel features in its software.

118. Intel has generally open dialogues with many SSVs during development of new products.

119. Although the product roadmaps for hardware and software are not typically aligned to facilitate input into a new roadmap [52] , Intel has carried out a general method of collaboration with software vendors (including SSVs), as described in the following table:

Timeline |Type of collaboration |

Three to five years before product launch |High level discussions with a few selected SSVs – […] |

Twelve to eighteen months before product launch |For those features that may lead to product development, Intel contacts an increasing number of SSVs. […] |

Six to twelve months before product launch |[…]. Early validation of the [Intel hardware] features with some vendors. |

Three months before product launch |Intel expands its validation efforts to include a broader set of vendors. |

Product launch |In most cases, full technical details about a new feature are made available to all software vendors via the ISPP. |

B. Competitive assessment

1. Introduction

120. Although there is no relevant horizontal overlap or vertical relationship between Intel and McAfee, the Commission considers that their respective products are largely complementary and closely related [53] . The transaction may therefore give rise to conglomerate effects.

121. In most circumstances, conglomerate mergers do not give rise to competition problems [54] . In some cases, in particular where as in the present case the merged entity enjoys strong market power in at least one of the markets concerned, a conglomerate merger may however create possibilities for exclusionary bundling or tying practices that could disadvantage or foreclose competitors and ultimately lead to them exiting the market, or otherwise significantly impede competition in the markets concerned.

122. Following the proposed transaction, Intel will have the ability to offer both hardware (in particular CPUs) and security solutions. As a result, the Commission investigated whether there was a serious risk that Intel would bundle or tie Intel CPUs/chipsets and McAfee security solutions.

123. The Commission's following assessment is based on submissions made by several complainants, mainly McAfee competitors, but also submissions made by other market participants (competitors of Intel in hardware markets, competitors of McAfee in security software markets and customers of both Intel and McAfee), submissions made by third party market observers and internal documents of both Intel and McAfee obtained in the course of the investigation.

124. The complainants consider that it is likely that post transaction the parties will engage in three main types of practices, namely degradation of interoperability between Intel's hardware and security solutions on the one hand and the products of competitors on the other (see section 2 below), technical bundling/tying ("technical tying") (section 3) and commercial bundling strategies (section 4). The Commission has also assessed a possible combination of commercial bundling together with technical tying or a degradation of interoperability (section 5).

125. Such business strategies would aim to leverage Intel's dominance in the CPU and chipset markets into the endpoint security markets, leading to the exit or at least significant weakening of McAfee's main competitors within the next two to five years. Complainants are in particular concerned that the ensuing Intel/McAfee security monoculture would reduce competition and innovation in the endpoint security markets with significant consequences for overall security of computing devices in general.

126. For each of these practices (degradation of interoperability, technical tying, commercial bundling, and a combination of such practices), the Commission assessed the three issues identified in the EC non-horizontal merger guidelines: (1) ability to foreclose, (2) incentives to foreclose, and (3) the overall likely impact on competition and consumers [55] .

127. For the sake of clarity, antitrust rules, in particular article 102 TFEU will continue to apply to the merged entity after the closing of the proposed transaction, regardless of the outcome of the present assessment under the Merger Regulation.

2. Assessment of a foreclosure strategy based on degraded interoperability

128. For the purpose of the present decision, interoperability can be defined as the possibility for software and hardware to interact [56] . Degradation can be defined as positive or negative discrimination (1) to the detriment of SSVs competing with McAfee when it comes to achieving interoperability with Intel CPUs or chipsets or (2) to the detriment of CPU or chipset producers competing with Intel when it comes to achieving interoperability with McAfee. It can take several forms, such as non-availability of certain hardware instructions or functions, delayed or incomplete disclosure of support tools and of information on hardware instruction sets and architecture.

129. According to the complainants a degradation of interoperability would affect the ability of SSVs to develop or optimise their products, notably, with regard to the use of power and the performance of the security solutions.

130. In particular, Intel could keep undisclosed certain parameters (such as performance related parameters, side effects of the use of instructions on CPU and memory state) and reserve those for exclusive use by McAfee. This would result in McAfee being able to develop better security solutions within less time than its competitors.

131. Moreover, Intel could optimise the interfaces (application programming interfaces – "APIs") between its chipsets/CPUs and McAfee's security solutions, its compilers [57] or its software development kits [58] ("SDKs") according to McAfee's design preferences, while the integration with the solutions of competing SSVs would be altered. This would result in McAfee's security solutions running better on Intel's CPUs than the endpoint security of the other vendors.

2.1. Ability of Intel to degrade interoperability

The notifying party's view

132. Intel considers it has no ability to foreclose on the basis of a degraded interoperability.

133. First, Intel claims that it cannot technically hamper the interoperability of its products because new instruction sets of a CPU are made accessible to SSVs through a series of interconnected system software layers provided by third parties (such as vendors of BIOS, virtual machine monitors or OS). Once an instruction is visible to any application software, it can be easily seen and used by others.

134. Second, Intel argues that it would be impossible to permanently hide instructions, as it would be easy for third parties to detect and reverse engineer them (via debuggers, compilers, etc.).

135. Third, according to Intel, SSVs do not write software to directly use such instructions. SSVs typically write their software at a high level of abstraction and let compilers adjust the code for the specificities of a CPU. In many cases, the OS also consolidates multiple hardware features into software functions that are easier to use and allow software to access these functions through APIs.

136. Fourth, according to Intel, the delay in revealing new instruction sets until release would not provide McAfee with any sustained advantage. The penetration of any new McAfee software using such instructions would be limited absent an installed base of CPUs containing the new instruction set.

137. Fifth, the current instructions sets are publicly disclosed. There would be no way to disable or affect instruction sets that are already in use since part of the benefit of the x86 architecture is its backward compatibility (new CPUs continue to support old instruction sets).

138. Intel has mandated two IT experts to provide the Commission with reports that support these arguments [59] .

Results of the market investigation

139. The market investigation generally indicates that Intel has the ability to favour McAfee's interoperability with its hardware and thereby to degrade interoperability between its hardware components and the solutions of McAfee's competitors.

140. First, the market investigation indicates that software developers need a range of information (documentation on the CPU instructions, roadmap of developments at the CPU level) and a number of tools (interfaces, compilers, SDKs) from the CPU manufacturers to develop and optimize their software for a given CPU. This appears to be particularly the case for security solutions, which operate closer to the CPU than most software and for which the information would become even more crucial in the future when security solutions are likely to interact more closely with hardware components than today. Such an anticipation is shared by McAfee in publicly disclosed statements [60] .

141. Second, while the market investigation generally confirms that Intel currently generally discloses and documents the CPU instructions, and cooperates with software developers in an open manner, they indicate that post merger Intel, by hiding certain instructions in the CPU, limiting or delaying the information available to software developers, could favour McAfee's interoperability by documenting certain features of the CPU only for McAfee. In particular, one Intel competitor indicates that: "certain parameters could remain undisclosed. It is quite difficult to measure the behaviour of an isolated instruction in a modern CPU. Intel might accelerate a certain code sequence that performs an important function in the McAfee code. Others would be unlikely to stumble upon that particular code sequence for implementing their version of the function. Since similar code can have widely different performance on a modern CPU, even just giving McAfee programmers very good access to Intel performance engineers could greatly increase the performance of McAfee code that McAfee competitors would not have." [61]

142. This form of 'positive discrimination' is believed to be more realistic than a degradation or exclusion of interoperability for McAfee competitors. According to one of them, "rather than degrading the performance of certain applications, Intel would make McAfee use better performing APIs or procedures of the CPUs. It would be a form of positive discrimination. McAfee could use the CPU to its fullest potential while the rest would not do it because they could be prevented from accessing the same level of interoperability information." [62] Moreover, as indicated by the same respondent to the market investigation, "It is perfectly possible for a CPU vendor to reserve access to certain functions in the CPU to only one security vendor. It is a design choice. Hardware can be made as software agnostic or software fanatic as desired. […] The same instructions used by different software will be processed in the same way by the CPUs. They are software agnostic in this way. However […], it is perfectly possible that hardware functions are unlocked only by one application or code known to only one company." [63]

143. While the market investigation indicates that selective degrading of interoperability only for SSVs would be difficult to implement, since they generally use the same instructions as other vendors, this would be feasible in a limited number of occurrences only, for instructions more directly designed for security purposes. According to one McAfee's competitor, "such degradation would not necessarily affect non-security solutions. There are some functions that only security products typically need, such as the ability to inspect, intercept and kill[,] threads and processes. Anything that advantages McAfee in this respect would create an important advantage. Or, Intel could provide McAfee a reserved portion of cache or other parts of the CPU and not enable access to these in the SDKs and compilers. Such lack of access would have no effect on any software, but would disadvantage security ISVs trying to compete with McAfee." [64]

144. Although the market investigation indicates also that a degradation strategy targeted at specific competitors would probably be rapidly detected, it shows that it would be more difficult to detect a strategy favouring interoperability of McAfee with certain features of the CPU.

145. Third, contrary to what Intel claims, only a limited number of respondents to the market investigation believe that the ecosystem of security software vendors could efficiently react to discrimination as regards interoperability by reverse engineering Intel's hardware components. Most of them consider that such reverse engineering would be partial, time consuming (possibly several months if not years) and prohibitive in terms of costs. In addition, according to one OEM, "undocumented instructions may or may not be able to be “reverse engineered“. While a persistent investigator could probably discover such instructions, it would likely be difficult to determine the specific function and syntax required to effectively use them. Undocumented instructions would not be officially supported by Intel and would be subject to change in future CPU iterations. As a result, it would be risky for a third party to rely upon such undocumented instructions, even if the syntax and function were correctly determined. In addition, to the extent that elements of computer architecture are protected by patents or other IP, it may not be possible for a third party to duplicate or use such architectural elements without infringing the CPU manufacturer’s patent or other IP rights." [65]

146. This possibility is confirmed by an internal document of McAfee [66] which describes an undisclosed project for a future new product […]. Respondents to the investigation (one competitor and one expert) have also mentioned that a part of AMT can be reserved for McAfee to the exclusion of others [67] . There are thus no technical obstacles to a strategy of denying interoperability to others.

147. Finally, some competitors have indicated that Intel could degrade McAfee's interoperability with chipsets or CPUs other than Intel.

Results of Commission assessment

148. In view of the above, the Commission considers it likely that Intel has the ability to favour McAfee's security software interoperability with its hardware (Chipset/CPU).

2.2. Incentives of Intel to degrade interoperability

The notifying party's view

149. According to Intel, its technologies and instructions sets are generic, which means that they are used by any software vendor, not only SSVs. Because these instructions are generic, Intel would not be in a position to hide these without altering the interoperability of its CPUs with other software than security solutions, which would not be in Intel's interest.

150. Intel indeed considers that as a CPU manufacturer it has always every incentive to maintain an open software platform with a multitude of software available to consumers. Similarly, it would be in Intel’s best interest to have all software, including security software, run as efficiently as possible on its CPUs. By limiting interoperability information, Intel would make its CPUs less attractive, giving end-users and OEMs an incentive to shift away from Intel hardware.

151. This would be the reason why Intel publicly documents all the information necessary for interoperability between the CPU hardware and software (including existing security software). As a matter of practice, Intel has disclosed all necessary information to allow interoperability between software and its CPUs about a year prior to when an Intel CPU is shipped.

152. In addition to publishing the instructions, Intel would work directly with software vendors who are interested in optimizing their software specifically for the disclosed Intel features, although many are able to optimize based on their own expertise or with the help of tools such as those Intel sells on its website.

153. Finally, as mentioned in paragraphs 113-119, Intel also collaborates with various software vendors and discloses information prior to making such information publicly available under non-disclosure agreements. Disclosure of information under these agreements depends on the specific project requirements.

Results of the market investigation

154. First, several respondents to the market investigation point to the following recent statement of the CEO of Intel Paul Otellini: "While we'll still work with the Symantecs and Microsofts and Nortons of the world, we're also going to make sure that the best possible solution is Intel on Intel or Intel on McAfee in this case and that it's architected to run best together" [68] . Such a declaration has been interpreted as Intel's explicit intention to favour McAfee by granting it better access to Intel features or technologies than its competitors.

155. Second, the market investigation refers to […] the FTC […] subsequent order of 2 November 2010 where the FTC has required Intel [not to design] […] interfaces in a manner that restricts the ability of a GPU to interface with its CPU ("the FTC settlement case") [69] . Moreover, FTC has required Intel to disclose that Intel computer compilers discriminate between Intel CPUs and non-Intel CPUs to software developers.

156. One may argue that, contrary to the FTC settlement case, […], security software is not a potential challenge to Intel's CPU dominance. However, it is possible that the acquisition of an SSV at a significant price and subsequent ability for Intel to monetise a computer over the entire life cycle of the security software will negatively affect Intel's pre-merger incentives to partner in a neutral way with all relevant SSVs. According to one of McAfee's competitors, "prior to the merger Intel shared information in order to encourage security vendors to innovate products supporting its hardware. Now, McAfee’s competitors are directly competing with Intel through McAfee. The fact that McAfee’s performance is now directly linked to Intel’s performance means that it no longer makes commercial sense for Intel to continue supporting all security products equally. Such a practice would clearly be to its commercial detriment." [70]

157. Furthermore, Intel could have an incentive to protect its dominance on the CPU market with certain McAfee features running (in an optimal way) only on Intel platforms, which could result in creating artificially the perception that competing platforms are insecure in comparison to Intel/McAfee's offering.

158. Third, the market investigation suggests that hampering interoperability would result into gains for Intel/McAfee on the endpoint security markets. According to one of McAfee's competitor's, "if Intel chose not to give ISVs [71] complete information and/or technically degraded the interoperability of its chips with third party products – bearing in mind that this could be achieved in a number of ways (many of which would be difficult to detect) - this would simply result in ISVs' products performing less well with Intel CPUs than McAfee security software. As noted above, robust security software is critical to any computing environment and any degradation in performance will undermine consumer confidence in (and demand for) non-Intel/McAfee products. As above, this strategy would result in increased demand for McAfee security software, and would not result in any decrease of OEMs' Intel CPU requirements." [72]

159. Fourth, according to most respondents to the market investigation, it is very unlikely that such a strategy backfires and results in Intel losing CPU revenues. The only way CPU revenues would decrease would be if end-users show such a loyalty to an SSV other than McAfee that they would switch their demand to an alternative CPU supplier. Given the must-stock status of Intel's hardware, as acknowledged by its high market share and its brand penetration, such a scenario does not appear plausible. According to one respondent to the market investigation, "the only way CPU revenues would decrease in this scenario would be if end-users show such a loyalty to a security vendor (other than McAfee) that they would switch their demand to an alternative CPU supplier. In practice, this would mean that a significant part of the market decides to purchase AMD CPU’s, so that they can use their preferred security vendor in good conditions. [We] can safely rule out this possibility outside exceptional cases. Even where such an end-user loyalty would exist, resellers (including OEMs, VARs, retailers, etc) would act as an additional barrier since they often leave little choice for the end-user. Independent security vendors would be unlikely to be in a position to bend the arm of these resellers to choose against Intel." [73]

160. The market investigation shows that customers would not be in a position to exert pressure on Intel to restore interoperability. Moreover, they seem to consider that there is limited scope for successful counter-strategies from Intel and McAfee competitors, given in particular the limited market share of Intel's competitors. As noted by one McAfee's competitor, "if Intel chose to completely deny any interoperability with ISVs' security software, this would ultimately be equivalent to technical tying. […] OEMs (customers of both Intel and McAfee) would only be in a position to switch very marginal amounts of their CPU requirements, which would not impact Intel's incentives to pursue such a strategy (and which Intel could easily offer inducements to avoid). If, alternatively, Intel chose to make information available to ISVs later than to McAfee, and/or to provide less complete information or to degrade (rather than deny) interoperability, this would result in consumers perceiving McAfee software as being more effective than other security software. As noted above, it would not be commercially viable or technically feasible for ISVs to 'reverse engineer' the McAfee software to discover the undisclosed CPU instructions or identify the reason for the degradation of their software performance." [74]

161. The Commission's assessment is also supported by some internal documents of the parties that indicate that Intel may have some incentives to stop its open disclosure policy with regard to security features. In particular, […] [75] .

Results of Commission assessment

162. In view of the above, the Commission considers it likely that Intel has incentives to degrade interoperability of its hardware with other security solutions than McAfee's products.

2.3. Effects on markets

The notifying party's view

163. First, according to Intel, even if it had the ability and the incentive to degrade interoperability, taking such action would have a very limited effect on competition. Any hypothetical advantage Intel could give McAfee would need to be premised on a new Intel CPU, so such an action would very likely be futile given the rate of adoption of new hardware by the market. By the time a sufficient installed base of Intel hardware with the new feature existed for McAfee’s product to gain any traction, every McAfee's competitor would have had more than sufficient time to come to market with a competing product.

164. Second, Intel considers that there are no features on its CPU instruction set roadmap that seem likely to be a source of sustained competitive advantage to an SSV. In addition, Intel outlines that the commercial success of security software depends not only on technical features, but on a multitude of factors, including price, and marketing.

165. Moreover, Intel submits that performance is not a source of differentiation for endpoint security. According to Intel, there is no clear correlation between performance of security software, as measured by testing organisations [76] , and market share.

Results of the market investigation

166. First, according to a substantiated reply of one of McAfee's competitors, the degradation of interoperability would have similar effects as a technical tying of McAfee security software leading to the exclusion of McAfee's competitors from Intel's platform. In essence, these effects would be similar because McAfee security solutions would be the only ones that fully and optimally function with Intel platform's features. It also indicates that such degradation in conjunction with a strong marketing campaign for the new Intel/McAfee combination would result in security software from other vendors being perceived as less effective: "If Intel denied interoperability with ISVs' software post-transaction, this would in effect amount to technical tying of McAfee security software (and the exclusion of ISVs from the Intel environment). […] If Intel were to delay provision of information to ISVs, and/or degrade interoperability with their products (likely in conjunction with a strong marketing campaign), ISVs' security software would ultimately be perceived as less effective, in particular when operating on Intel hardware. Since customers would not accept lower performing security software (given the increase in cyber crime), McAfee's products and solutions would be chosen over those of other ISVs, resulting in significant revenue losses for [us]." [77]

167. Second, according to some of McAfee's competitors, their entire revenue stemming from endpoint security could be impacted, leading to the exit of some SSVs. While the consequences in terms of price remain unclear at this stage, McAfee competitors foresee reduced innovation and choice. According to one of them, "competitors of McAfee will be forced to drastically reduce price to try to limit the loss in volume, or downsize and refocus on niche markets. In both cases, the revenues that can be invested for R&D will be heavily impacted. McAfee will be shielded from any competition on innovation due to interoperability and will therefore have no incentive to continue investing in innovative products. […] If McAfee is the only security vendor with full access to Intel interoperability, it will become the preferred security solution of any Intel customer. As mentioned, competitors would need to consolidate, flee to niche markets or disappear. In any of these scenarios, consumer choice will be heavily impacted." [78] According to another McAfee competitor, "innovation would be hampered, as only McAfee would be allowed to interoperate fully with those resources. […] McAfee could become the sole provider of enhanced security via hardware. Intel could let other vendors to interoperate at a baseline of performance, but they would not be able to compete in equal technological terms. […] We believe it would be very significant, given Intel’s dominance of the CPU market. Security vendors obtain their revenues mostly from their Intel-compatible solutions, so the overlap of customers being potentially affected would be very high. Besides, the impact on the risk of monoculture would also be very high." [79]

168. Third, two of Intel's competitors indicate that there would also be a negative impact on chipsets and CPU markets. A degradation of McAfee's interoperability with other chipsets or CPUs suppliers would be likely to further increase barriers to entry on markets where Intel is active by locking out other CPU manufacturers.

169. Fourth, the market investigation suggests that Intel's installed base could be impacted through a microcode update. Moreover, according to one McAfee's competitor, "it is possible to extend capability and add new options to existing and publicly documented instruction sets without breaking backward compatibility." [80] In addition, it cannot be excluded that Intel CPUs contain some dormant instructions that could be activated to work with McAfee in a certain manner. The market investigation is however unclear with regard to the time horizon of such changes in interoperability.

170. Fifth, the market investigation confirmed the importance of performance for market success. According to certain respondents, hardware enabled software could run much faster, which, if reserved to McAfee, could have 'earthquake effects' on the market [81] .

171. Sixth, several internal documents from McAfee envisage the hardwiring of security as a game changer that no other competitor would have the possibility to replicate. For instance, in a document of 13 June 2009, the deal is presented as a "true game changer" […].

Results of Commission assessment

172. The Commission considers it likely that the effects of an interoperability hampering by Intel will be significant on the endpoint security and CPUs / chipsets markets, in particular with regard to innovation and choice.

2.4. Conclusion

173. The Commission considers it likely that Intel has the ability and incentives to hamper interoperability and that the negative effects of such a practice on the relevant markets would be significant. On the basis of the replies received, the market investigation also provided evidence that such a strategy will give rise to serious doubts as to the compatibility of the transaction with the internal market.

174. The Commission concludes, also in the light of the results of the market investigation, that it is likely that the conglomerate effects resulting from a degradation of the interoperability between the parties' products and those of the parties' competitors would lead to foreclosure of McAfee's competitors in the endpoint security markets and thereby possibly strengthen the current dominant position of Intel in the chipset and CPU markets.

3. Assessment of a foreclosure strategy based on technical tying

175. Technical tying consists in the technical combination of products of both parties in a persistent form, i.e. in the embedding of security solutions in Intel's CPU and chipsets platforms.

176. In order to prevent any foreclosure on the security solutions market stemming from embedding security software in to Intel's hardware, ensuring interoperability between the solutions developed by McAfee competitors and Intel's hardware would not necessarily be sufficient. Indeed, the persistence of embedded software solutions from McAfee's into Intel hardware could interfere with the functioning of alternative security solutions.

3.1. Ability of Intel to technically tie

The notifying party's view

177. First, Intel submits that CPUs are 'software agnostic' (i.e. they cannot discriminate according to the origin of the instructions they receive) and their instructions can be exploited by all software. Therefore, according to Intel, it is not possible to provide instructions that can be used by some software vendors, but not by others.

178. Second, according to Intel, a number of third-parties play an important role in how Intel hardware interacts with software applications. In particular, OEMs or vendors of OS or BIOS would be able to prevent Intel from controlling the (de-) activation of certain CPU features.

179. Third, Intel argues that there are a number of technical constraints that would prevent Intel from embedding software into hardware, notably the limited space available within a CPU and the necessary updating of software.

180. In order to support these arguments, Intel has submitted two reports from IT experts [82] .

Results of the market investigation

181. Respondents to the market investigation generally consider that Intel has the ability to technically bundle its hardware components with certain features of the security solutions developed by McAfee. They refer in particular to the feasibility of the following strategies.

182. First, embedding of at least basic McAfee antivirus protection in all mainstream Intel CPU and chipsets platforms would be feasible. This would make some of the equivalent features of competing security solutions redundant and possibly also less efficient if the embedded McAfee solution interferes with the effective running of competing security solutions. Many refer to Intel's existing vPro suite of technologies [83] , which already today contains some security functions at the chipset level, and which could be significantly further enhanced with McAfee's security solutions. Elements of vPro (including the virtualization technology at the CPU level) could therefore be a starting point for this strategy.

183. Second, certain security tools (notably encryption) which are currently performed in software could be embedded in hardware at the CPU level. In addition to embedding these security solutions into Intel's hardware, Intel could reserve instructions and interfaces that are needed for the embedded solution to McAfee by keeping them secret.

184. Third, Intel could use the vPro components (notably AMT and TXT) - and the remote manageability which these components allow - to embed a McAfee antimalware agent in Intel hardware which could then be activated, operated and monetised through a McAfee cloud infrastructure with updated malware databases in the cloud.

185. Fourth, Intel could insert a non-wipeable hidden sleeper agent within the CPU/Chipset/peripheral which can be activated and monetised after the purchase of computing device to allow remote controlled operations in favour of McAfee software. One McAfee's competitor indicates that by doing so Intel could replicate in the security field what it has recently implemented for its Pentium CPU [84] , i.e. deliver embedded McAfee software as a hidden upfront bundle and "unlock" the solution only at a later stage.

186. Fifth, soft bundling tactics through promotional pop ups on the screen are also considered as technically feasible. However the market investigation shows that for commercial reasons this could be difficult to implement since such popups would require the support of the OS.

187. Sixth, the market investigation suggests that the implementation of soft bundling tactics to make preinstalled McAfee software more persistent and second sales difficult or impossible is technologically feasible.

188. The majority of respondents also considers that given Intel's dominant position and today's commercial reality, if Intel wanted to implement such strategies, other players such as OEMs and BIOS vendors would not be able or have the incentives to prevent Intel from doing so.

189. In order to demonstrate that the scenarios above are likely and not just speculative, one respondent to the market investigation refers to the fact that Intel has filed extensive patent applications in the US, including an application relating to a method, apparatus and system to enable a secure location-aware platform: "Specifically, embodiments of the present invention may utilize a secure processing partition on the platform to determine a location of the platform and dynamically apply and/or change security controls accordingly. […] The application states that "…the ability to apply more stringent and better security controls based on the trustworthiness of the network is typically left to security vendors. Most vendors do not, however, provide configurable controls based on system location." [85] While the access to interoperability information would be a condition to enable SSVs to provide configurable controls based on system location, it would not be sufficient because SSVs would also need to be in a position to disable such features if they are not compatible with the security solutions elaborated by them.

190. Intel's claim according to which CPUs are software agnostic is confirmed only as regards the CPU in a narrow sense and only as regards the situation today. However, the market investigation suggests that this situation could evolve under different incentives and that there are no technical constraints that would hamper such an evolution. According to an independent respondent to the market investigation, "modern processors have many performance features that can only be exploited by software that is aware of a given feature, and in that sense all modern processors are not software agnostic. Modern processors can already indirectly determine the software that is issuing (originating) a given set of instructions. […] It is possible for a complex CPU to incorporate an explicit registration mechanism for one software application to uniquely identify and unlock special/hidden capabilities for that given software application that would not be available to other competing, equally capable software applications. However, [we have] no knowledge of this specific situation involving Intel and McAfee." [86] It is worth noting that even if such an explicit registration mechanism was designed so as to run non exclusively with a McAfee solution, the persistence of the McAfee solution embedded into Intel's hardware might preclude or interfere with the effective running of competing security solutions.

191. Moreover, the claim that Intel's products are software agnostic is largely dismissed for peripheral hardware components such as the vPro technologies. In particular, several respondents to the market investigation point to Intel's existing AMT technology that would enable the locking down of certain functions to specific software. A third party IT expert indicates that "Intel AMT is a great example of how Intel can reserve/lock down some functionality only for its own software. Intel AMT software is being kept on a flash chip on the motherboard (might not be produced by Intel), but the Intel chipset (which has recently been integrated onto the processor die, in Intel Core i5/i7 processors) verifies if the AMT code is signed with Intel digital certificate, and only then allows execution of this code on the chipset's internal processor (the "AMT processor"). The "AMT processor" is a small processor located in the chipset (more specifically in the north bridge), that has privileged access (i.e. beyond OS control) to certain system resources, such as memory and network cards. Intel AMT allows for creating powerful system management solutions that can be used even in case the OS on the target computer is malfunctioning, and thus allow for powerful remote recovery." [87]

192. Similarly, Intel's argument on the limited memory available at the CPU level is infirmed by the market investigation, and some respondents to the market investigation also indicate that in any event other technology components at the chipset level could be used with comparable effects. According to one McAfee's competitor, "recent developments in Intel's products, including the introduction of its vPro technologies and the broader use of virtualisation technologies, mean that memory constraints impose no material restrictions on Intel embedding security software in the silicon." [88]

193. According to another McAfee competitor, "the memory required to implement hardware acceleration is small. It is not a matter of actually processing or scanning directly in the hardware (which would require a lot of memory), it is more about encryption support. This was confirmed by Dave De Walt (CEO McAfee), who spoke at the ISMS Forum in Barcelona, Spain on 30th November 2010 about the merger and what it brings to McAfee. He clearly stated that the focus will be on hardware acceleration for encryption. He also stated that the performance will be 50 – 100 times better than a software-only solution." [89]

194. Finally, as mentioned above and contrary to what Intel claims, the market investigation suggests that the BIOS vendors, OS developers, OEMs and users have in today's commercial reality no real ability to intercept and unbundle such solutions. According to one OEM, "OEMs and users will be restricted in their free selection of security SW; Bios and OS vendors have no incentives to defeat." [90]

195. Moreover, according to one Intel competitor: "[We] believe […] this depends on what Intel's design permits. Locked hardware structures may be impossible for BIOS vendors, OEMs or OS vendors to unlock and are probably impossible for most users to unlock." [91]

196. The conclusion that Intel can embed endpoint security solutions in its CPU and chipset platforms is also supported by […][documents from the parties]. [92]

197. Finally, a number of statements of Intel's executives tend to confirm Intel's ability to embed endpoint security solutions in its hardware. Intel CEO Paul Otellini noted in various articles and on 19 August 2010 at a press conference, that "[Intel] believe[s] security is most effective when enabled in hardware." [93] During the same press conference, he added that "Joining the assets of McAfee with Intel will accelerate and enhance the combination of hardware and software solutions." [94] He added also that " we began to understand […] that having a deeper collaboration, where we could look long term and try to look at the combination, the deeply-integrated combination of hardware and software capabilities, would add substantial value to our platforms and differentiation to our platforms, number one." [95] Intel Senior Vice President Renée James said the same day that "the proposed acquisition of McAfee executes against Intel’s software strategy to grow our business by using software to enhance hardware. We’ve done this successfully with over a dozen software acquisitions, including Wind River and Havok, which represents a fundamental belief that the most pressing problems in computing will require both hardware and software solutions. […] We also recently launched the Intel anti-theft technology, which will disable a computer if it’s lost or stolen. Our teams have been working together to build enhanced security solutions that can better protect consumers and the industry from malicious events. Through this partnership we’ve had an opportunity to learn about McAfee, the possibilities of what a closer partnership between hardware and software could bring. […] We believe we can have products in the market, these enhanced products in the market, in the first part of 2011 […]. The underlying hardware technology ships in our core products today and will be extended into Atom in the near future. So these are already existing hardware features and functionality that can enhance security software like the products from McAfee, in addition to the cloud services that McAfee offers. So there’s some amount of work that has to be undertaken between the two of us that has been going on, as we said, for the last about 18 months. So we don’t need to come out with brand-new silicon, we have the underlying features available now". [96]

Results of the Commission assessment

198. The replies to the market investigation received, a number of internal documents of the parties, as well as public statements from Mr. Otellini and Ms. James suggest that Intel can technically tie its chipsets / CPUs with McAfee's endpoint solutions. The Commission concludes therefore that it is likely that Intel has the ability to engage in technical tying.

3.2. Incentives of Intel to technically tie

The notifying party's view

199. According to Intel, it has no incentive to engage in technical tying because it needs broad based software support. According to the notifying party, one of the driving factors behind McAfee's ePO [97] and Intel's hardware success in the enterprise segment is the open nature of their platforms. Engaging in technical tying would damage Intel's relationship with partners on whom it depends. Intel's partners are unlikely to lend their support to costly changes to computers that would only benefit Intel/McAfee.

200. Moreover, a technical tie would threaten the broad based software support on which Intel relies to drive demand for its processors with enterprise customers. According to the notifying party, these customers are sophisticated buyers that value flexibility and are knowledgeable about substitutes. Any attempt to impose a technological tie would put at risk both microprocessor and security software sales.

201. Furthermore, Intel claims that it is not able to persuade OEMs to adopt Intel solutions that do not bring clear significant end user benefits and, on this account, it refers to two recent examples, namely the Viiv platform and the Itanium processor the introduction of which failed because of the lack of support from OEMs.

202. Lastly, according to Intel, there is an important distinction to be made between technical tying (which is making inseparable products that can equally function separately) and product integration (which is integrating products to improve their global performance). According to Intel, while it has never engaged in technological tying, it has integrated new functionalities into its microprocessors and chipsets, whereby bringing substantial improvements in terms of performance, functionality or reduction of costs for its customers. Intel refers to several examples of such product integration that occurred on its platforms as well as competing platforms [98] . In other words, according to Intel, the migration of certain features into Intel's hardware has never been a mere combination of separated products but has always resulted in global product enhancement.

Results of the market investigation

203. The market investigation refers to several examples of technical tying/bundling in Intel's history including the following: (i) combination of Intel's CPU with wireless technologies that were previously implemented in separate semiconductor products, (ii) chipsets including Macrovision copy protection technology, without a real necessity for the final product, (iii) integration of graphics in the CPU die.

204. According to one of Intel's competitors, Intel has also successfully bundled hardware and firmware features to create their vPro brand creating a premium tier for which they are the sole provider and despite the existence of competitive solutions for most technical capabilities and the fact that many features go unused in most customers' environment. It says that "Intel has successfully bundled hardware and firmware features to create their vPro brand offering, a product with higher prices and margins. vPro is an Intel brand representing a number of technologies and capabilities, some of which are also available under separate brands, and sometimes no Intel brand. Intel worked directly with IT departments at many large and small enterprises to create a demand for vPro branded PCs, while also offering incentives for OEMs to provide PCs under this vPro brand. Despite the fact that there are competitive solutions for most of the technical capabilities that fall under the vPro brand umbrella, or that many of the vPro branded features go unused in customer environments, Intel successfully created a premium tier for which they are the sole provider given its significant market share in the CPU market." [99]

205. According to one OEM, incentives of Intel might include product innovation, elimination of double marginalisation allowing it to lower prices to OEMs, which would both be positive evolutions, but might also include a desire to reduce competition in the complementary product, or to reduce competition in CPUs by reducing innovation and viability of products that could be used with competing CPUs. [100]

206. The market investigation also suggests that it is unlikely that Intel could lose CPU sales from a technical tying strategy given the "must-stock" status of Intel's hardware. According to one McAfee's competitor, "since security software will always be required, linking it to Intel's "must-stock" hardware (with associated marketing suggesting a "safer" CPU) will create a "virtuous circle" of demand. Against this background there would be no reason for OEMs to object to the technical tying of security software with Intel hardware. Even if they did, they could only attempt to switch a very marginal percentage of their CPU requirements (to CPUs without any security software) given Intel's established "must-stock" status and the fact that AMD has not yet developed the equivalent of Intel's vPro technologies." [101] Two respondents to the market investigation make a link between this question and interoperability. One OEM considers that if the implementation does not negatively impact other security solutions, it is not to expect that it negatively impacts Intel CPU business. According to one customer, a loss of CPU sales could happen, if customers do not want to use McAfee's product.

207. Moreover, several respondents to the market investigation doubt that antitrust rules constitute an effective deterrent in relation to technical tying. According to one of them, Intel's repeated infringements of antitrust rules in the past together with its reactions denying the findings of the regulatory authorities are an indication that antitrust reaction would no act as a deterrent to Intel. Perhaps most importantly, some respondents to the market investigation claim that previous cases such as the Microsoft case show that antitrust enforcement usually comes too late to restore competition.

208. The market investigation suggests that Intel competitors could perhaps try to create a competing solution. However, some respondents to the market investigation doubt that such a counter-strategy, in light of the limited market share of the competitors and the time necessary to go to the market, would be successful.

209. The possibility of an effective counterstrategy by OEMs is also regarded as doubtful given Intel's market power.

210. During its investigation, the Commission assessed several internal documents of the parties. According to one document, the embedding of security into silicon would be a "True game changer – […]. [102] Other internal documents point into the same direction. [103]

Results of Commission assessment

211. Taking into account the above, the Commission concludes that it is likely that Intel has incentives to engage in technical tying.

3.3 Effects on markets

The notifying party's view

212. According to Intel, even if it could engage in technical tying and had the incentive to do so, this would not result in substantial foreclosure. For instance, even if Intel were able either to integrate McAfee software into Intel silicon or promote McAfee software through an advertising “stub”, this would not foreclose any McAfee competitor. These steps might reduce McAfee’s distribution or promotional costs, but McAfee competitors would remain able to compete with the same access to Intel microprocessor functionality as they have today.

Results of the market investigation

213. As regards the impact on the security software market, some respondents to the market investigation expect a significant impact with the exit of certain software developers. Indeed, two respondents indicate that Intel competitors like AMD would not enable SSVs to reach a critical mass to compete with Intel/McAfee. Because Intel/McAfee would be the sole provider of hardware enhanced security, competitors would not be able to compete on equal technological terms. According to one respondent, ISVs would effectively be forced into the position of having to make a second sale to compete with the technically tied offering. Even though, this would not be tenable because, on the one hand, the security component embedded into the hardware would be extremely difficult to uninstall and, on the other hand, running multiple versions of security software would not be practicable, resulting in unacceptable performance, increased risk of system instability and no real improvement in security.

214. A number of respondents consider that ultimately choice will be reduced and prices of security software will be driven down which will reduce available funding for R&D. According to one respondent, "the rest of the security industry would compete for the remaining available market space. This would leave security vendors to increase prices to be able to fund innovation on specialised markets. Alternatively, and more realistically they would lower the price, which would result in companies not being able to invest in people and innovation. In that process, some vendors may be driven out of the market limiting choice for customers and reducing innovation." [104] On the other hand, two respondents indicate that innovation could be fostered by such a strategy.

215. Moreover, with regard to efficiencies, while some respondents to the market investigation do not exclude them, the market investigation suggests that any efficiencies resulting from technical tying should be balanced against the risk of a security software "monoculture" with a "single point of failure" stemming from such a strategy. According to one respondent of the market investigation, "the efficiency in collaborating more closely with a particular security vendor excludes competition from the market. This leads to dependence on a particular security solution. Whilst this may be a technically superior product it will nevertheless be targeted by hackers meaning that it actually is less secure than it would have been in a market with a diverse number of products where hackers’ efforts were less targeted. The efficiencies themselves intrinsically cause consumer harm". [105]

216. According to one McAfee competitor, "the general content security business relies heavily on the diversity of its offerings. A monoculture approach would lead to a single attack target as we’ve experienced in the past 15 years with Microsoft products, regardless of how safe they’ve been made. With Intel dominating the CPU and Chipset market at 84% we are on the edge of a similar risk. If they are allowed to bring in their ower to dominate the security solutions it will be just a question of time before attacks are focused on this single solution." [106]

217. Finally, the market investigation suggests that technical tying might lead to a significant increase of Intel's market share and/or the prices on the computer CPU markets. One respondent to the market investigation considers in particular that Intel/McAfee will have a de facto monopoly and could charge high prices for its hardware offering security features; moreover, once the products are launched, Intel will have reduced incentive to further invest in R&D. According to another respondent to the market investigation, the impact could be notably significant in the corporate segment/market. However, none of these concerns were substantiated. Moreover, some respondents to the market investigation anticipate an impact on other types of CPUs, such as handheld, embedded devices and consumer electronics.

Results of Commission assessment

218. In the light of the above, the Commission considers that the possible foreclosure of SSVs stemming from a possible technical tying and the resulting lack of access to Intel hardware or interference of tied McAfee solutions with competitors' products, gives rise to serious doubts as to the compatibility of the proposed transaction with the internal market.

3.4 Conclusion

219. The Commission considers it likely that Intel has the ability and incentives to technically tie its products with McAfee's endpoint security and that the negative effects of such a practice on the relevant markets would be significant.

220. On the basis of the replies received, the market investigation also provides evidence that such a strategy would give rise to serious doubts as to the compatibility of the transaction with the internal market.

221. The Commission concludes, also in the light of the results of the market investigation, that it is likely that the conglomerate effects resulting from a technical tie between the parties' products would lead to the foreclosure of McAfee's competitors in the endpoint security markets and thereby possibly to the strengthening of the current dominant position of Intel in the chipset and CPU markets.

4. Assessment of a foreclosure strategy based on commercial bundling

222. The Commission has assessed the likelihood of two forms of commercial bundling: pure and mixed bundling.

223. In the present case, pure bundling would imply that CPUs and security software are sold exclusively together while mixed bundling would imply that either the CPUs or the security software would be offered at a discount when cu