assignments by way of security

• Online Payment
• Client Login

Bulletins | January 30, 2018

Assignment by way of security – beware of giving away more than you bargained for.

Construction

Assignment by way of security is a concept that comes up on many construction projects; typically as a condition of providing finance a funder will require an assignment by way of security of key construction documents, including building contracts and appointments, with the intention that if the borrower defaults on the loan, the assignment will be perfected and the funder will be entitled to enforce its rights under the constructions documents. How and when exactly such assignment takes place and the interplay with an employer’s rights under its contracts on a project was brought into focus in last year’s case of Mailbox (Birmingham) Limited v Galliford Try Construction Limited ([2017] EWHC 67 (TCC)).

Mailbox (Birmingham) Limited (“Mailbox”), the claimant special purpose vehicle set up to develop the Mailbox in Birmingham (“the Property”), a high-end mixed used development, boasting a Harvey Nichols and the base for BBC Birmingham, engaged Galliford Try Construction Limited (“Galliford”) for refurbishment works at the Property under a building contract dated 23 December 2013. A dispute arose between the parties regarding responsibility for delay, the final account, liquidated damages and Mailbox’s termination which was referred to adjudication, where Galliford were ordered to pay Mailbox £2,477,152.86 plus 75% of the adjudicator’s costs. Galliford did not pay the sums ordered, so Mailbox sought enforcement of the adjudicator’s decision in the High Court.

Did Mailbox have a right to bring an adjudication?

Galliford’s primary defence to the enforcement was that Mailbox had no right to bring the claim, as it had assigned the benefit of the building contract with Galliford to Aareal Bank AG Wiesbaden (“Aareal”) in accordance with the requirements of a debenture dated 10 May 2011. Mailbox raised three defences:

• The building contract was not in existence at the time of the assignment referred to in the debenture. Therefore there could be no assignment;
• Alternatively, any assignment was by way of charge rather than a legal assignment; or
• The contract had been re-assigned from Aareal to Mailbox before Mailbox commenced adjudication proceedings.

Mailbox failed on the first two defences, but won on the third so was able to enforce the adjudicator’s award. However, it was the analysis of the first and second defences and Mrs Justice O’Farrell’s review of the requirements for legal assignment under Section 138 of the Law of Property Act 1925 that are of particular note.

It was held that the wording of the debenture covered future contracts, including the building contract in question. The wording “each chargor with full title guarantee assigns absolutely by way of security in favour of the security trustee” amounted to a full legal assignment rather than an assignment by way of charge and/or a conditional assignment. Further, there was a requirement for notice of the assignment to be served and specific reference to rights being re-assigned, both of which were more akin to an absolute assignment. Express notice was given to Galliford, again consistent with an absolute assignment.  Thankfully for Mailbox, on the day it commenced the adjudication, Aareal had re-assigned the rights under the building contract to Mailbox. If it had not done so, or done so after the adjudication had been commenced, Mailbox would not have been entitled to commence the adjudication.

Practical Tips

When obtaining finance for a project it is crucial to understand what the funder really requires in relation to security over construction documents. If all rights are assigned, the employer no longer has the ability to enforce such rights and may have given away more than he bargained for.

It may be that the use of collateral warranties or third party rights together with a charge will suffice but if not (which is unfortunately still the common position), it is important that any such rights are re-assigned before the employer commences an adjudication or any other proceedings.

• France (FR)
• Germany (DE)
• Netherlands

United Kingdom

• United States

Introduction to Security

What is Security

Taking effective security over an asset means that the security holder can, on the insolvency of the borrower, take possession of that asset and use the proceeds to repay the loan. This puts the security holder in a stronger position than the unsecured creditors.

What does the security holder want?

Basically, a security holder has three aims. It wants to ensure that:

The security is effective on the insolvency of the borrower.

The security will take priority over anyone else who obtains a proprietary interest in the asset concerned.

The security can be enforced when required, even if the borrower is in insolvency proceedings.

A creditor may also want to know to what extent security can arise by operation of law and what alternatives there are to taking security.

Categories of Security under English law

There are four primary categories of security under English law as follows:

The term 'mortgage' and 'charge' tend to be used interchangeably but there are some technical differences.

This form of security involves the transfer of title to an asset in order to secure obligations, typically a debt on the condition that it will be re-transferred when the secured obligations are discharged. The assets secured can be tangible or intangible and physical possession of the mortgaged asset is not a requirement.

Depending on whether the necessary formalities have been complied with and whether the borrower has legal title to the asset, a mortgage can be legal or equitable.

Under an equitable mortgage, only a beneficial interest will pass to the mortgagee whereas under a legal mortgage legal title will pass to the mortgagee.

The transfer of title under a legal mortgage operates to prevent the mortgagor from disposing of the asset and assist in the creditor's ability to realise the security if required.

A legal mortgage is the most secure form of security interest and cannot (unlike an equitable mortgage) be taken over future property.

Mortgages over intangible assets such as choses in action (eg. Rights under a contract) are typically taken by an assignment by way of security which can be legal or equitable depending on the formalities complied with. See section 136 Law of Property Act 1925 ( LPA ) for requirements of a legal assignment.  An assignment by way of security transfers certain rights from the assignor to the assignee as security for the discharge of the obligations of the assignor or a third party. You cannot have multiple assignments running concurrently.

While under a mortgage title to the asset will pass to the mortgagee, under a charge title does not pass and the chargee instead  obtains an equitable proprietary interest in the security provider's assets e.g. the right to appropriate the charged assets in satisfaction of the debt, the right to restrict the security provider from dealing with the asset freely and a right to the proceeds of sale. There is no right to possession.

Charges can be fixed or floating. A fixed charge will attach immediately to the (definite and identifiable) charged asset while a floating charge hovers over a pool of assets (present and /or future) until conversion or 'crystallisation' (when it fastens onto and becomes a fixed charge over assets). The distinguishing feature of a fixed charge is that the chargor is not free to deal with the charged assets in the ordinary course of its business. The key characteristic of a fixed charge is that the lender has control over the charged asset. Control is crucial to the nature of a fixed charge. A floating charge on the other hand is a charge over a shifting class of assets which the chargor is free to deal and so permits the continuation of the business operations of e.g. a trading company.

Over certain assets e.g. stock-in-trade or inventory, only a floating charge can be created. This is because it would be impractical for a debtor not to be able to deal freely with its stock as this would cause cash-flow problems. The floating charge is normally therefore a catch-all provision for assets not specifically charged and will typically be granted over the whole undertaking.

In the case of present and future receivables, a fixed charge can, in practice, only be effectively taken if the proceeds of the receivables are paid into an account which is strictly operated as a blocked account (National Westminster Bank plc v Spectrum Plus Limited and others [2005] UKHL41) .

Liens generally arise by operation of law and are more common in commercial transactions e.g. when goods are being supplied, repaired or transported. They are accordingly more of benefit to trade creditors rather than financial creditors e.g. a creditor has a lien over goods until thay have been paid for by the security provider. However, creditors do need to think about doing due diligence in respect of any existing or future liens affecting assets that they might take security over as some will rank ahead of even prior mortgages e.g. a maritime lien.

In addition, it is possible to take a bill of sale over chattels owned by an individual under the Bills of Sale Acts 1878 and 1882, but rarely used because if you get it wrong you not only have invalid security , but the secured debt is also extinguished.

Quasi-security

Quasi-security applies to methods by which a creditor might try to enhance its position on the insolvency of the borrower without taking a full security interest.

Quasi-security includes:

Guarantees and indemnities from third parties

Comfort Letters from third parties e.g. the parent. Are they legally binding or merely expressions of intent?

Set-off and netting arrangements . Netting is a form of contractual set-off. Set-off is mandatory on insolvency for mutual credits, mutual debits and other mutual dealings. Banker's set-off-the general right of the bank to combine two or more accounts held by the same entity.

Bank guarantees and bonds. This is the bank's paper so bank has to pay absent fraud.

Standby Letters of Credit. Operate like a bank guarantee.

Retention of Title (RoT) - Romalpa clauses. Again, a lender needs to do due diligence to see whether its borrower's stock –in-trade actually belongs to the borrower or a third party supplier.

Flawed asset arrangements. This is a mandate arrangement between the bank and the borrower whereby the borrower agrees that the bank does not have to pay what it owes the borrower until the borrower pays what it owes the bank. It was held to be effective on a liquidation in BCCI No 8 [1997] 3 WLR 909 .

Negative Pledges. This a covenant by the borrower not to encumber its assets. These should preserve unencumbered assets for the general creditors. It is questionable whether they bind third parties and what effect a negative pledge has on a third party.

Hire purchase and finance lease. Title is with the lender not the borrower so no risk to the lender on the insolvency of the 'borrower'. This is an alternative method to the loan and mortgage for funding.

II. TYPES OF ASSET WHICH MAY BE SUBJECT TO SECURITY

Mortgage - includes securities, chattels and rights under a contract (via an assignment by way of security). Note that a legal mortgage can generally not be taken over most types of intangible property with the exception of: (i) documents that transfer title to the intangible property (e.g. bills of exchange) and (ii) intangibles that can be transferred into the name of the mortgagee and registered in that mortgagee's name (e.g. shares).

Charge - includes land (usually expressed to be a charge by way of legal mortgage, but a charge nonetheless), contracts, book debts, plant and machinery, goodwill, IP rights and licences.

Pledge - includes items of tangible property capable of being delivered (including documents of title to property such as bearer securities).

Lien - any asset.

III. TYPE OF OBLIGATIONS THAT MAY BE SECURED

Under English law, security may secure obligations of any kind (i.e. not just monetary obligations), including future obligations.

IV. LEGAL FORMALITIES REQUIRED

A Legal Mortgage or Charge over land must be created by way of deed (section 52(1) LPA).

A charge by way of legal mortgage over land must be executed as a deed i.e. it must state that it is a deed and be signed, witnessed and delivered as a deed.

Any mortgage or charge of land or other property (whether legal or equitable) must be by deed if the mortgagee or chargee is to have the statutory power of sale and the statutory power to appoint a receiver. Also, a power of attorney must be by deed.

A deed is a written instrument that requires more than a simple signature to be enforceable. A deed is distinguishable from a simple contract for two main reasons: (i) the limitation period for actions brought under simple contract is six years from the date of accrual of action whereas the period is generally twelve years for a deed; and (ii) deeds do not have to be supported by consideration to be enforceable.

For assignments by way of security of debts or other choses in action, the assignment must be in writing.

Pledge - in order for a pledge to be valid, the creditor must be in actual or constructive possession of the asset. A pledge can only be granted over a tangible chattel, excluding real property. No documentation is required but it is obviously preferable that the pledgor and pledgee enter into a letter or memorandum of pledge to record the terms of the pledge including the circumstances when the pledgee might sell the pledged asset.

Lien - no validity requirements as these normally arise by operation of law, although some liens depend on retention of the asset over which the lien is claimed.

Quasi-security - guarantees must be in writing and signed by the guarantor (section 4 Statute of Frauds 1667).

V. PUBLICITY/REGISTRATION REQUIREMENTS

Almost all security (other than pledges) created by English companies and LLPs must be registered at Companies House within the strict 21 day (extended to 31 days during covid, but now back to 21 days) time period. Companies House is a central registry for companies in England and Wales and a public registry.

In addition, charges by way of legal mortgage over land must be registered at the Land Registry regardless of whether it is a corporate or individual granting the charge.

Various other types of asset have their own registration requirements under different regimes e.g. IP rights, ships, aircraft and bills of sale over chattels. Art security can also be registered at the Art Loss Registry.

VI. OTHER PERFECTION REQUIREMENTS

An assignment is perfected when notice of assignment is given to and received by the other contracting party ( Dearle v Hall ( 1823-28) 3 Russ1). In the case of an assignment of the general partner's right to make capital calls on limited partners in funds finance, you cannot register security against an English Limited Partnership so the only way to perfect is by giving notice to the limited partners.

For pledges and liens, these are perfected merely by the creditor holding and continuing to hold the secured asset.

VII. COSTS OF SET UP AND REGISTRATION OF SECURITY

Any security registered at Companies House costs £15 to register online and £23 to register a hard copy.

The fee to register a charge at the Land Registry (assuming it is not registered simultaneously with the transfer of land where no fee is charged) is between £40 to £250 for each title charged depending on the amount secured.

VIII. TIMING FOR PUBLICITY/REGISTRATION

Security has to be registered at Companies House within 21 days (temporarily increased to 31days during covid) of its creation counting from the day after creation. Dire consequences if you fail to do so including the charge being void against the company's other creditors including its liquidator and administrator and the secured debt becoming immediately repayable. If you fail to register, you can apply to the court for registration of the charge out of time (unless in the meantime the company has gone into administration or liquidation) or take a new charge (subject to potential set-aside until the relevant ' hardening periods have expired).

No specific deadline for registering at the Land Registry, but for priority purposes, best to do so within the priority period afforded by the pre-completion searches. Registering security within this period will ensure priority over subsequently registered charges.

Timing for submitting registration and obtaining proof of registration is almost simultaneous with online registration at Companies House and between one and two weeks in the case of a paper registration. In the case of the Land Registry the time period is approximately two weeks depending on how busy they are.

XI. LEX SITUS

Generally speaking, any security must be created under, and be in accordance with, the law of the jurisdiction where the asset is located, notwithstanding that this may be different to the jurisdiction in which the security provider is incorporated.

Mortgages -To create a valid mortgage over real property located in England and/or Wales, the mortgage has to be created under the laws of England and Wales.

To create a valid mortgage or charge over a chattel you normally have to have your security document governed by the law of the jurisdiction where the chattel is located.

X. WHAT TYPES OF RIGHTS DOES A SECURED CREDITOR HAVE?

Before enforcing its security, the holder must generally make a formal demand for payment on the borrower. The effect of a demand is to make the sums due under the loan facility payable. This is particularly important in the context of some of the enforcement rights implied under common law and statute which do not arise until the secured liabilities become payable (expressly granted enforcement rights will normally be exercisable on an event of default occurring under the loan agreement).

In relation to each type of security the following enforcement rights are available:

Legal Mortgage- Foreclosure (a court process whereby the mortgagor's rights in the secured asset are extinguished (i.e. the mortgagor's equity of redemption is extinguished) and that asset becomes vested in the mortgagee). This rarely occurs these days, although under the Financial Collateral Regulations there is a foreclosure equivalent which doesn’t involve any court process; Taking possession; Power of sale (provided the security document contains an express power of sale or is made by deed, in which case the power of sale is implied); and Appointment of a receiver (again available if express power to appoint or is made by deed in which case the power is implied).

and Appointment of receiver (same as for legal mortgage above). Note that on a sale an equitable mortgagee cannot transfer more than an equitable interest in the mortgaged asset.

For assignments by way of security where the secured property comprises choses in action (e.g. contractual rights), the assignee may exercise its power of sale (provided as above)  and/ or appoint a receiver (provided as above).

Charge -Taking possession (available provided the security document contains an express power to that effect); Power of sale (provided same as for legal mortgage above); Appointment of Administrative Receiver (only available to holder of pre-15 September 2003 floating charge over all or substantially all the chargor's assets); Appointment of Receiver (available provided circumstances relating to legal mortgages exist); Appointment of Administrator (available only to holders of a qualifying floating charges (QFCHs). A qualifying floating charge is a charge created by instrument that states that paragraph 14 of Schedule 18 to the Insolvency Act 1986 applies to it or that it purports to appoint an administrator or administrative receiver. A QFCH is generally a holder of qualifying charge which relates to the whole or substantially the whole of the company's property at the time of appointing the administrator.

Pledge -Power of Sale (available where the power is given either expressly in the security document or impliedly where the pledgor is in default and reasonable notice has been given to him).

Lien -Power of Sale (a lien holder may apply to court for an order of sale where: (i) the lien is equitable or (ii) there is a reason why a quick sale of the assets subject to the lien is preferable (e.g. perishable assets); Appointment of Receiver (available to holders of equitable liens, who may apply to the court for an order to appoint a receiver).

Compulsory Liquidation - a secured creditor can seek to have a company wound up if it has served a statutory demand for a debt in excess of £750 and the debtor fails to pay or if it can show that the debtor is insolvent.

XI. ENFORCEMENT

Foreclosure -This is a lengthy, two-stage court process that is rarely used in practice. First an order for foreclosure nisi must be obtained by the mortgagee and then the mortgagor is given a chance to pay the debt. If payment is not forthcoming, an order for the foreclosure to be made absolute can be sought. Little used because its effect is to deprive the mortgagor of its equity of redemption and it would be a very time-consuming process.

Taking Possession- in most cases a court order is required. Where a secured creditor is entitled to obtain possession of real estate, it can do so by either: i) taking physical possession of the secured property if possession is granted voluntarily; or (more commonly) ii) by bringing an action in the county court for a possession order. This can be a lengthy process e.g. up to two years.

A mortgagee in possession may incur unforeseen liabilities to third parties (e.g. the cost of environmental remediation) and owes certain duties (e.g. to the borrower to account for any income and profit actually received or which should have been received).

Power of Sale -Normally a court order is not required unless the mortgage does not include an express power of sale or is not made by way of deed. Also, a mortgagee may prefer to obtain a court order for sale if there are some issues concerning the consideration for the sale. Otherwise, a mortgagee can sell without a court order, but it does have a duty to get the best price reasonably obtainable and cannot itself buy the mortgaged property without the sanction of a court order.

Appointment of Administrative Receiver and Receiver -These are out of court processes. These can be appointed quickly by notice to and acceptance by, the Administrative Receiver/Receiver.

Appointment of Administrator -Some court involvement is always necessary. Administrators can be appointed in two ways: either simply by filing documents at court (the out of court route); or by making a formal application to the court, and (following a hearing) obtaining a court order (the court route).

Using the court route, the appointing creditor must first issue an application at the court, when a hearing date will be set, the timing of which vary depending  on the court calendar. Notice must then be given to a number of interested parties not less than five business days before the hearing. If appointed, the administrator's appointment may commence at the time of the hearing.

The out of court route is only available to QFCHs and the court route is available to all other creditors.

Using the out of court route, if there are no prior-ranking QFCHs, the appointing creditor can simply file the appointment documents at court and the appointment will commence from the time of filing. If there are prior-ranking QFCHs, the appointing creditor must serve notice of intention to appoint on the prior ranking QFCHs two business days before the appointment. If this period expires or the prior ranking QFCH consents, the appointing creditor can then appoint by filing the necessary documents at court. It is important to use the correct documents otherwise your purported administrator could end up being liable for damages as a trespasser.

Financial Collateral Arrangements (FCAs)- The Financial Collateral Regulations 2003 ( FCRs ) were brought into force to implement Directive 2002/47/EC of the European Parliament and Council and modify existing EU insolvency law in relation to FCAs, to give parties to FCAs certain rights in priority to other parties on the insolvency of the collateral giver, to dispense with registration requirements at Companies House and to permit out of court forfeiture. Briefly, an FCA applies where security over financial collateral (i.e. cash, financial instruments including shares or certain types of monetary claims) is provided by an entity (ie. not an individual) to a financial institution which must have possession or control of such financial collateral. It can also apply to stock-lending and repo arrangements.

Under the FCRs, the collateral taker can enforce an FCA even where an administrator is in place, and without having to account to (ordinarily prioritised) preferential creditors and unsecured creditors. The rights of administrators and liquidators in relation to FCAs are much more limited. For example, they have no right to dispose of the collateral, disclaim the FCA, and avoid the FCA even if it occurred after the commencement of the winding-up or to remove an administrative receiver of the financial collateral. In addition, if the FCA allows, the collateral taker can appropriate the collateral without having to obtain a court order for foreclosure.

Compulsory Liquidation -court sanctioned process. The creditor issues a petition at court to commence the process. A date for hearing is fixed at this point. Notice then must be given to the creditor at least five business days before the hearing. It is possible to obtain a winding up order within about six weeks of issuing the petition.

XII. LEGAL CONCERNS/PROHIBITIONS RELATED TO GRANTING/TAKING SECURITY

Corporate Benefit -Where security is given by a company in respect of the obligations of a third party company, the security provider, in its board minutes approving the transaction, must be able to confirm that it is in the company's interests to enter into the transaction. It is common for such third party security to be approved by unanimous ordinary resolution of the shareholders of the company in order to avoid the risk of the shareholders in the company challenging the grant of the security as being ultra vires the directors. In addition, the lender might require the directors to give a certificate of solvency in an effort to avoid the security being attacked as a transaction at an undervalue.

Security for Loans to Directors -Certain restrictions apply to the making of loans, and to related dealings such as the provision of security for loans, by a company, either to its directors, or to directors of its holding company or to persons connected with those directors. Basically a company cannot make a loan to its director or the director of its holding company or give a guarantee or provide security in connection with a loan made to a director unless it is approved by a resolution of the members of the company and (if the director is a director of the company's holding company) a resolution of the members of the holding company as well. There are additional restrictions covering quasi-loans and credit transactions to or for the benefit of directors and their connected persons   and guarantees and security for such loans in the case of a public company or a company associated with a public company where, again, approval by resolution of the members of the company and, if applicable, its holding company is required.

Taking Security over Shares in a Publicly Quoted Company

Another point to watch when taking security over shares in publicly quoted companies from its directors are the disclosure and notification requirements involved. For example, the  Market Abuse Regulations ( MAR ) (Article 19(1) and (7)) imposes notification obligations on any person discharging managerial responsibilities ( PDMR ) or their closely associated persons, within a company to which MAR applies. If a PDMR, or a person closely associated with a PDMR, grants security over his or her shares he/she must disclose the transaction to the company. The company then has to notify the market.

MAR (Article 19(11)) imposes 'closed periods' on PDMRs , or their closely associated persons, within a company to which MAR applies on dealing with its shares (including the grant of security). Clearance may only be provided in exceptional circumstances (e.g. severe financial difficulty).

The AIM Rules include certain disclosure obligations and restrictions on dealing in the company's shares for directors and their families. The AIM Rules also contain significant shareholder disclosure obligations and dealing restrictions for directors and applicable employees during closed periods.

The Takeover Code may apply to the company. If it does, there are potential disclosure obligations under Rule 8 if a charge is taken over 1% or more shares in the company. Security taken over 30% or more of the voting rights of the company could trigger a mandatory takeover offer when enforced.

Part 22 of the Companies Act 2006 allows a public company to serve notice on those 'interested' in its shares which could include a security holder. The notice can require the security holder to give information not only about its own interest but any concurrent interest of which the security holder has knowledge. Failure to comply with the notice entitles to company to obtain a court order that the shares be subject to restrictions.

Part 28 of the Companies Act 2006  contains 'squeeze out' and 'sell out' rules applying when an offeror has unconditionally agreed to acquire 90% in value of a target's shares giving the offeror the statutory right to buy out the remaining minority shareholders. This right cannot be excluded.

Under the FCA DTA disclosure regime, the holder of shares (or the voting rights in those shares) in UK companies whose shares are listed on the main market or AIM are required to notify the company (using a TR1-notification of major shareholding) once they reach the 3% threshold and each 1% change thereafter. If a lender therefore forecloses on shares under the FCRs or exercises its voting rights in respect of shares held by it as collateral the DTA disclosure regime can apply. For any questions please contact Brad Isaac .

XIII. RIGHTS OF CHALLENGE FOR THE SECURITY PROVIDER/THIRD PARTIES

General- The security provider might contest the debt, or contend that the debt was not due and owing (i.e. that the holder of the security had not made a proper demand) or that the security was invalid or not improperly perfected, or that the relevant appointment documents were invalid, or that the relevant notice requirements were not followed.

Limitation- A limitation period of 12 years from the cause of action applies where the document is executed as a deed. This is reduced to six years where the security document is signed under hand.

Conflicting arrangements- Security may not be enforceable if there is an inter-creditor or standstill deed in place governing the enforcement of the security which prohibits or delays enforcement.

Challengeable transactions- A liquidator and an administrator can, in certain circumstances, challenge and have security arrangements set aside, making the security unenforceable. Reviewable transactions include security arrangements that constitute: i) a preference, ii) a transaction at an undervalue; or iii) a (wholly or partly) invalid floating charge.

Briefly, a preference occurs when a debtor has done something or allowed something to be done which has the effect of putting a creditor into a better position in the liquidation, administration or bankruptcy of the debtor than he would have been if the thing had not been done. Such a transaction is challengeable if it was done within 6 months of the insolvency or two years if the relevant parties were connected with debtor (e.g. in the case of  a debtor company, directors, shadow directors, associates of such directors or shadow directors and associates of the company and, in the case of an individual, a relative or life partner of such individual); the debtor was insolvent at the time or as a result of the transaction and the debtor had a desire to put the creditor in a better position than he would have been if the thing had not been done (section 239 Insolvency Act 1986 ( IA )). A classic example of this type of transaction is where the directors of a company have given a guarantee to a bank and then the company gives security for the previously unsecured debt within a short time of the company entering into formal insolvency. From a lender's standpoint, the main point to notice is that the transaction creating the preference has to be done voluntarily so if the lender exerts pressure on the debtor it should never be a preference.

Again briefly, a transaction at an undervalue occurs (section 238 IA) when a debtor enters into a transaction (e.g. a gift or guarantee) for a consideration the value of which, in monetary terms, is significantly less than the value of the consideration provided by the debtor. Such a transaction can be set aside if:

where the debtor is a company, the transaction took place within 2 years before the commencement of its winding-up and the debtor was insolvent or became insolvent as a consequence of entering into the transaction

where the debtor is an individual, the transaction took place within 5 years of the before the commencement of his bankruptcy and , if the bankruptcy occurs in the third, fourth or fifth years, the debtor was insolvent or became insolvent as a consequence of the bankruptcy (i.e. if the bankruptcy occurs within 2 years of the transaction, there is no need for an insolvency practitioner to prove that the debtor was insolvent or became insolvent as a consequence of entering into the transaction).

Where the debtor is a company, there is a defence if it can be shown that :

the debtor entered into the transaction in good faith and for the purpose of carrying out its business; and

when it did so, there were reasonable grounds for believing that the transaction would benefit the company.

When taking a guarantee from a company, it is therefore common practice to do the following:

Detail in the board minutes the benefits to the company in entering into the guarantee (to assist demonstrating that the transaction benefitted the company);

have the entering into the guarantee blessed by a unanimous resolution of the members (to prevent the transaction being ultra vires the directors); and

have the directors make a declaration of solvency (so that , if correct, the transaction could never be a transaction at an undervalue).

The position from the lender's standpoint is more difficult if the debtor is an individual especially if the bankruptcy occurs within the first two years of the transaction.

Under section 245 of the IA a floating charge created by a debtor company will be invalid in its liquidation or administration if it was created in favour of a connected person within 2 years before the commencement of insolvency proceedings or a non-connected person within I year of its administration or liquidation except to the extent of the value of the consideration of the floating charge which comprises money paid, goods or services supplied or debts discharged at the time of or after the creation of such floating charge. The section does not however apply to FCRs (described above).

Undue Influence- Where the security provider can show that he/she entered into the security document whilst under the influence of another, the security will be unenforceable. Undue influence can be implied where there exists a relationship of trust and confidence between the parties to a contract. Certain types of relationship gve rise to a presumption of undue influence and these include parent and child and husbands and wives. The issue for a lender is that if it can be shown that there was undue influence by the debtor on the guarantor even if the lender was unaware of such undue influence, the transaction involving the lender (e.g. a guarantee) can be set aside. If a lender is taking a guarantee in circumstances where there is no commercial relationship between the debtor and the guarantor, a lender needs to protect itself by:

requiring the guarantor take independent legal advice on the guarantee;

providing the guarantor's solicitor with sufficient financial information to be able to advise the guarantor appropriately; and

obtaining confirmation from the solicitor that he/she has advised the guarantor appropriately before the guarantor entered into the guarantee.

(See the leading cases of Barclays Bank v O'Brien [1994] 1 AC 180 and Royal Bank of Scotland v Etridge (No 2) [2002] 2 AC 773)

Lien - Statute provides that liens over the books, papers and records of a borrower are unenforceable to the extent that enforcement would deny their possession to a  liquidator and administrator.

XIV. SECURED CREDITORS' POSITION IN INSOLVENCY

Rights to and conditions required to continue/initiate security enforcement in insolvency

Perfection (as previously mentioned) is necessary to ensure that the security has the intended priority over the other creditors of the security provider, although perfection does not always guarantee validity and priority in all circumstances (for example, where a transaction is challengeable by an insolvency practitioner).

Further, when a chargor enters into administration or liquidation, unsecured  creditors must lodge formal notice of the debt owed to them, called a proof of debt, to the administrator or liquidator. A secured creditor can rely entirely on its security and not submit a proof or surrender its security and prove for the whole amount of the debt or place a value on its security and prove for the balance of the debt.

Administration- An automatic moratorium is imposed at the start of the administration which prevents creditors from enforcing security without the consent of the administrator or permission of the court, unless the FCRs apply to the security. A secured creditor is however, generally speaking, entitled to be repaid from the proceeds of sale of the secured assets. It may then claim as an unsecured creditor (who will receive a share of the assets proportionate to the size of the company's debt to the unsecured creditors) for any balance. Note that a company cannot enter into administration if an administrative receiver is in office.

Compulsory Liquidation- Compulsory liquidation provides a moratorium preventing creditors from enforcing security without permission of the court. A liquidator acts primarily in the interests of unsecured creditors and shareholders, but must distribute the assets in accordance with the following priority:

First: Fixed charge holders

Second: Administrators and Liquidators (for expenses in administration or winding up) Note that under the moratorium procedure introduced by the Corporate Insolvency and Governance Act 2020 if a company enters into administration or winding-up within 12 weeks of the end of a Part A1 moratorium, any unpaid moratorium debts or pre-moratorium debts (where the company does not have the benefit of a payment holiday for these) will benefit from super-priority (i.e. they will rank before administration or liquidation expenses).

Third: Ordinary Preferential Debts (e.g. employees' wages), Second Preferential Debts (e.g. claims from HMRC such as VAT, PAYE, employee NICs and Construction Industry Scheme deductions) and then the Prescribed Part up to a maximum of £800,000 for floating charges created on or after 6 April 2020).

Fourth: Floating Charge holders

Fifth: Ordinary unsecured creditors including all other taxes e.g. corporation tax (pro rata)

Sixth: Shareholders (receive any surplus).

Secured creditors' rights in influencing decisions in the creditors assembly

Receivership- The receiver only owes duties to the secured creditor who appointed him; there is no meeting of creditors.

Administration- The views of the secured creditor may be taken into consideration by the court when considering the appointment of the administrator. However, an administrator owes a duty to act in the interests of the creditors as a whole.

Compulsory Liquidation- A secured creditor may be able to exert some influence on the choice of liquidator by voting at creditors meetings, or if appointed to the liquidation committee, may take some limited further control over the liquidator's actions. If you have any questions, please contact Andrew Evans or your usual Banking contact.

Related Content

• practice notes (75)
• precedents (17)
• q&as (7)

Assignment (by way of security) definition

What does assignment (by way of security) mean, view the related practice notes about assignment (by way of security), priority between security interests—practical examples.

Priority between security interests—practical examples This Practice Note sets out examples of how the rules on priority could work...

Zambia—cross border banking and finance guide

Zambia—cross border banking and finance guide Loan market and developments Please provide a brief overview of the current state of...

Discover our 75 Practice Notes on Assignment (by way of security)

View the related precedents about Assignment (by way of security)

Assignment of intellectual property rights (asset purchase) (long form).

Assignment of intellectual property rights (asset purchase) (long form) This Agreement is made on [insert date] (Commencement Date) between...

Ireland—Debenture: single company chargor—bilateral—all monies

Bilateral debenture for a chargor incorporated as a limited company in Ireland to secure the chargor’s obligations to the lender...

Dive into our 17 Precedents related to Assignment (by way of security)

View the related q&as about Assignment (by way of security)

How could the funder of a ‘first purchaser’ of a construction development obtain rights against the construction/design team.

How could the funder of a ‘first purchaser’ of a construction development obtain rights against the construction/design team? It...

Subject to post-Brexit potential changes in enforcing foreign judgments, is it possible to state with certainty that: A) an EU judgment will be enforced against an English company in English courts B) an EU debenture affecting an English company would be enforceable in English courts.

Subject to post-Brexit potential changes in enforcing foreign judgments, is it possible to state with certainty that: A) an ...

See the 7 Q&As about Assignment (by way of security)

View the related News about Assignment (by way of security)

Insurance & reinsurance monthly highlights—august 2019.

This month’s edition of Insurance & Reinsurance monthly highlights includes analysis of the decision of the High Court to refuse...

Corporate weekly highlights—2 August 2018

This week’s edition of Corporate highlights includes LSE guidance for AIM companies on new corporate governance requirements that apply from...

Read the latest 4 News articles on Assignment (by way of security)

Speed up all aspects of your legal work with tools that help you to work faster and smarter. Win cases, close deals and grow your business–all whilst saving time and reducing risk.

Access this content for free with a 7 day trial of LexisNexis and benefit from:

• Instant clarification on points of law
• Smart search
• Workflow tools
• 41 practice areas

** Trials are provided to all LexisNexis content, excluding Practice Compliance, Practice Management and Risk and Compliance, subscription packages are tailored to your specific needs. To discuss trialling these LexisNexis services please email customer service via our online form. Free trials are only available to individuals based in the UK, Ireland and selected UK overseas territories and Caribbean countries. We may terminate this trial at any time or decide not to give a trial, for any reason. Trial includes one question to LexisAsk during the length of the trial.

"While we began looking at LexisNexis products primarily for cost saving, it quickly became more about customer service, ease of onboarding, ongoing training and breadth of resources available."

Access all documents on Assignment (by way of security)

0330 161 1234

• International Sales(Includes Middle East)
• Latin America and the Caribbean
• Netherlands
• New Zealand
• Philippines
• South Africa
• Switzerland
• United States

Popular Links

• Supplier Payment Terms
• Partner Alliance Programme

HELP & SUPPORT

• Legal Help and Support
• Tolley Tax Help and Support

LEGAL SOLUTIONS

• Compliance and Risk
• Forms and Documents
• Legal Drafting
• Legal Research
• Magazines and Journals
• News and Media Analysis
• Practice Management
• Privacy Policy
• Cookie Settings
• Terms & Conditions
• Data Protection Inquiry
• Protecting Human Rights: Our Modern Slavery Agreement

Assignment by way of security

Not hitherto commonly known as an ABWOS even though it jolly well ought to be.

There’s quite a bit more over at set-off and even more than that at netting , and some stuff at equitable set-off , too. Unless that’s just a redirect to set-off .

Unless it is “by way of security” in name only — don’t ask, but if you must, see the footnote [1] — an assignment by way of security , usually, does not meet all the formal requirements for a legal assignment set out in the Law of Property Act . So it’s not as good. Being, therefore, an equitable assignment and not a legal assignment , there differences relating to how an assignee enforces its claim against contracting party: a legal assignee can sue in its own name; and equitable assignee only by joining the assignor to the action (I know: shoot me, right?).

Do I need an assignment by way of security if I have a charge ?

Not unless you’re the sort of person who wears two pairs of underpants in case the first fails. [2] Both are equitable interests , but a fixed charge is more formal. The problem with a fixed charge is that it requires control over the asset (an actual thing) being charged: that is easy enough if you can take possession of it (prime brokers: hooray!), but if you can’t - if it is some vague right the debtor has to be paid money at a later date - then your fixed charge might wind up looking a bit like a floating charge, which means you may wind up behind other people in the queue.

Assignment and its effect on Netting and Set-off

Could a right to assign by way of security upset close-out netting such that one should forbid parties making assignments by way of security of their rights under a master netting agreement (such as an ISDA Master Agreement or a 2010 GMSLA ), for fear of undermining your carefully organised netting opinions?

Generally : No .

• An assignment by way of security is a preferred claim in the assignor’s insolvency over the realised value of certain rights the assignor holds against its counterparty. It is not a direct transfer of those rights to an assignee: the counterparty is still obliged to the assignor, not the assignee, and any claim the assignee would have against the counterparty would only be by way of subrogation of the assignor’s claim, should the assignor have imploded in the meantime or something.
• “ Nemo dat quod non habet ”: [3] the unaffected counterparty’s rights cannot be improved (or worsened) by assignment and, it being a single agreement , on termination of the agreement the assignee’s claim is to the termination amount determined under the Agreement, which involves terminating all transactions and determining the aggregate mark-to-market and applying close-out netting . No one can give what they do not have. [4]
• The assignee can be in no better position than the assignor and this takes subject to any set-off . The conduct of the debtor vis a vis the assignee is irrelevant, unless it gives rise to an estoppel. See Bibby Factors Northwest Ltd v HFD Ltd (paragraphs 38 and 48). [5]

At the point of closeout, the assignee’s right is to any termination payment payable to the Counterparty. Therefore any assignment of rights is logically subject to the netting, as opposed to potentially destructive of it.

But : This is only true insofar as your netting agreement does not actively do something crazy, like disapplying netting of receivables which have been subject to an assignment and dividing these amounts off as "excluded termination amounts not subject to netting".

I know what you are thinking. "But why on God’s green earth would anyone do that?" This is a question you might pose to the FIA ’s crack drafting squad ™, who confabulated the FIA ’s Professional Client Agreement , which does exactly that.

Lex situs for a chose in action like an assignment by way of security

Where the thing you are taking security over is a disembodied legal right — a “ chose in action ” and not a “ chose in possession ” — then what is the lex situs, seeing as this thing floats free of the ghastly, rusting mortal world of territorial boundaries? It is a Platonic right, and ethereal, idealised, utopian thing and as such as stateless, existing as it does on another plane, in another geometry, that that of tawdry earthly things like regulatory perimeters.

Here the lex situs is — in the absence of any other worldly place for it — the governing law of the right being assigned.

• Close-out netting
• Law of Property Act 1925
• ↑ An assignment by way of security could be a legal assignment, if it meets the formal criteria, but one of those is that the assignment is absolute and not by way of security only, so — yeah. And there is authority about this, by the way: Mailbox (Birmingham) Limited v Galliford Try Construction Limited [2017] EWHC 67.
• ↑ “That old man, despite all the hardships, still manages to put on a clean pair of underpants every day. And, you know? By the end of the week, he can’t get his trousers on.”—From There’s no land like Poland , by the Not The Nine O’Clock News team.
• ↑ “A chap cannot give away what he doesn’t own in the first place.” Of course, try telling that to a prime brokerage lawyer, or a counterparty to a 1994 New York law CSA .
• ↑ Except under New York law — isn’t that right, rehypothecation freaks?
• ↑ Bibby Factors Northwest Ltd v HFD Ltd [2015] EWCACiv 1908
• Taking security
• Credit Support
• English law

Navigation menu

Taking robust security over warranty and indemnity insurance policies

This article addresses the legal and practical issues for lenders on leveraged buy-outs in relation to taking security over warranty and indemnity insurance policies.

This article first appeared in the March issue of Butterworths Journal of International Banking and Financial Law.

• Warranty and indemnity (W&I) insurance policies are now frequently taken out by buyers on European leveraged buy-outs and can be a key element of the security package for the lenders.
• Review of the W&I policy is a key aspect of a lender’s diligence on the transaction to avoid pitfalls in the granting of security over the benefit of that policy.
• In most cases an assignment of the policyholder’s right to be paid proceeds under the W&I policy will be the most suitable form of security.

The M&A Landscape: rise of warranty and indemnity insurance

In recent years there has been a steady increase in the use of buy-side warranty and indemnity (W&I) insurance policies in the European mergers and acquisitions (M&A) markets as limited recourse acquisition structures prevail and the premium rates and terms on offer have become increasingly flexible and competitive. A W&I policy can provide the buyer with reliable financial protection, in many cases giving the potential for a more straightforward and expedient route to financial recompense than the alternative of a claim against the seller under the sale and purchase agreement (SPA) or against management warrantors who may remain within the business.

Many sellers will favour a clean exit from the SPA so that the sale proceeds can be distributed without the potential for claims, avoiding the need for sale proceeds to be held subject to escrow arrangements. This is particularly important for private equity sellers who may be prevented from taking on SPA liabilities under the terms of their fund documentation or need to make immediate distributions to their investors. W&I policies with no recourse against the seller (and a consequential increase in the policy premium) may therefore be preferred in many circumstances.

In principle, the existence of a well-constructed W&I policy should be an attractive prospect from the perspective of lenders financing an acquisition and a key element of their security package. It is no exaggeration to say that if a target business becomes distressed after acquisition, a claim under the W&I policy may be the only remaining asset that provides a route to a recovery.

It is critical for lenders to ensure that the security taken over these rights is appropriate and that the considerations for enforcing that security is well understood.

Understanding the policy

The first step to a lender obtaining a robust security position in relation to the W&I policy is to review the terms and coverage of the policy itself alongside the review of the SPA, as the rights of the lender under the security can never be better than those afforded to the buyer under the policy itself and (subject to any enhancements contained in the policy) the insured warranties/indemnities in the SPA. The areas of the policy that will be of particular relevance to the lender will include the following:

• Coverage and exclusions : At its core, the policy should provide an agreed level of coverage in respect of the representations and warranties made by the seller under the SPA, subject to exclusions and, potentially, enhancements. The policy will typically contain a schedule in which the cover position on each warranty/indemnity is set out.  Warranties will either be marked as insured or not insured, or insured subject to certain deemed amendments set out in the policy schedule.  The exclusions will include general matters (for instance known risks, forward looking statements and buyer fraud) and specific matters that the insurer will not be prepared to cover (for instance, relating to secondary tax liabilities or pension scheme funding shortfalls, or deal specific areas which the insurer has determined have not undergone sufficient due diligence). It is often also possible to obtain top-up cover (in excess of the W&I policy) for matters that are likely to exceed its limit of liability (for example, in respect of fundamental warranties concerning legal and beneficial title to the shares), and such risks may be insured under a separate (title) policy. A buyer may also require enhancements (for an additional premium) that provide coverage beyond the warranties from the sellers under the SPA, for instance a synthetic tax covenant.
• Check for any restrictions on assignment of the policy : Whilst W&I policies do typically allow for assignment of the proceeds of claims under them to entities providing financing to the buyer, it is essential to check that this is the case if such an assignment is to be taken (as discussed below). It should also be ensured that the security agreement complies with any specific policy requirements to achieve an assignment, such as using a required form of notice to the insurer. The policy should prohibit any other assignments and transfers of the buyer's rights under that policy.
• Onerous terms: Any entitlement to amounts claimed under the policy will always be subject to compliance with the policy terms imposed on the insured buyer.  When assessing the security value of an assignment, it is worth checking that there are no onerous conditions to cover (such as onerous claims reporting provisions or third party settlements restrictions allowing the insurer to avoid liability if not followed).
• Premium : Typically the premium paid will be a single lump sum paid at completion or shortly thereafter. The lender will need certainty that the premium has been paid since most policies will not be on risk if the premium is not paid. This may be a condition of the SPA, or if the policy requires payment after completion, may need to be addressed as a condition subsequent to the facilities agreement.
• De minimis and policy retention : Policies will typically contain two liability limitation provisions.  First, the policy will often specify a “ de minimis ”, which is the amount that each loss must reach before it engages cover under the policy (and is often set at the materiality threshold used for due diligence).  Once reached, the policy may “drop down” to cover the whole loss (and not just the excess over the de minimis ).  Other policies may only cover the excess.  In addition,  the policy will often specify that the buyer should bear the first aggregate proportion of claims arising under the policy by way of an aggregate retention. Similarly, the limit of liability under W&I policies is typically set at a value of between 10% and 30% of the transaction value (except in certain asset heavy transactions, where top up title cover may be obtained).  Lenders therefore need to assess whether or not the amount of insurance taken, and the retention/ de minimis provisions are adequate when assessing the value which the  security assignment will provide.
• Excess policies : It is not uncommon for additional limits of liability in excess of the primary W&I policy’s limits to be purchased from other insurers, who would each provide their cover by issuing excess policies. If so, it should be ensured that any security extends to these excess policies too and notifications are given direct to those insurers (and that the terms of those policies are truly aligned with the primary policy so there is no risk of mismatch of claims outcome between policy layers).

Lenders may also look to include a specific undertaking in the facilities agreement requiring the policyholder to comply with any on-going requirements under the W&I policy.

Assignment by way of security

Lenders would normally want to take an assignment by way of security over the buyer's contractual rights under the policy, being a mortgage over those intangible rights. In terms of the documentation, where the buyer is an English company, this will typically be included within the English law 'all asset' debenture granted by the buyer at exchange at the same time as the SPA and facilities agreement are signed.

Unless the transaction is structured such that there is very limited or no recourse against the seller, the lenders to the buyer are likely to require an assignment of the buyer’s rights under the SPA in addition to the security over the rights under the W&I policy.

Limiting the assignment to the proceeds of claims

It is important to ensure that such an assignment is in respect of the policyholder's rights to the proceeds of a claim, and does not purport to extend to an assignment of the policy itself. A transfer of the entire policy may more accurately be described as a novation of the insurance contract, where the assignee will become the insured party and assume the obligations of the policyholder. There is sufficient usage of the term "assignment" with this wider meaning, however, to lead to uncertainty if the drafting does not expressly limit the assignment to the rights to the proceeds of claims made by the policyholder under the policy. 1

An assignment of the entire policy is to be avoided, first as the lender will not expect to become liable for the obligations under the policy, and secondly as a purported transfer of the policy itself could lead to the insurer denying claims. This denial would be on the basis that the assignee as the new policyholder does not hold any insurable interest – it was not the entity to which the warranties were given – and/or that its insurable interest was not the interest covered by the policy. This would be on the basis that the assignee’s interest is related to the risk of non-payment of its loan, but that this was not the interest covered by the policy (which is the risk of loss through acquisition of a business which was not as valuable as it was warranted to be).

Provided there is no relevant restriction on assignment under the terms of the policy, an assignment by way of security can transfer the policyholder's right to the proceeds of a claim to the lenders (subject to the equity of redemption, allowing the policyholder to have the rights to the proceeds transferred back to it once the secured obligations have been discharged). The policyholder will continue to be responsible for bringing and litigating any claim under the policy.

This structure would not entitle the lender to control the conduct of the making of a claim under the policy. This means that if the policyholder is not co-operative, the making of a claim through it may need to be achieved in another way in any enforcement scenario, such as by procuring a change of the board of directors after having enforced share security over the shares in the policyholder or by exercising voting rights contained in that share security or by the exercise of a security power of attorney.

In practice, however, it would be difficult for a lender to be in a position to make a claim under the policy without cooperation from the policyholder, management of the target business and/or the private equity sponsor. A disputed claim under a W&I policy will likely be complex and will require the support of the key persons with detailed knowledge of the target business and/or that were involved with the acquisition. The purpose of the security interest should therefore better be considered as a means of ensuring that the proceeds from such claim are controlled and applied in repayment of the debt in priority to other creditors.

Transforming the equitable assignment into a statutory assignment

If no notice of the security interest is given to the insurer, the assignment of the buyer's rights to the secured party will be an equitable assignment. This can be transformed into a 'legal' or 'statutory' assignment pursuant to s.136(1) Law of Property Act 1925 by giving written notice of the assignment to the insurer, provided that the conditions in that section are complied with.

S.136(1) Law of Property Act 1925 applies to the assignment of a debt or other legal thing in action where the following conditions are satisfied:

• There is an "absolute assignment", that is, an assignment that is not conditional. An outright assignment of a debt with a proviso for reassignment on repayment by the assignor of the money lent (as will be the case in the security package) is regarded as absolute. Care must be taken with the drafting however, as an assignment that is stated to operate only until repayment of the money lent is regarded as conditional, and therefore incapable of being transformed into a legal assignment;2
• The assignment is "by writing under the hand of the assignor". The recent High Court judgment in the case of Frischmann v Vaxeal Holdings SA [2023] EWHC 2698 has caused consternation among finance practitioners in ruling that, owing to this requirement, an assignment executed by an attorney of the assignor is not capable of becoming a statutory assignment. So long as this legal uncertainty remains a cautious approach will likely be taken with respect to the use of powers of attorney in the execution of assignments by assignors.
• Express notice in writing must be given to the debtor. In the case of an assignment of proceeds from a W&I policy, as previously noted this will be a notice from the secured party to the insurer in a form typically scheduled to the security document and/or the policy.

Transforming the assignment to a statutory assignment is advantageous as it would allow the assignee (the secured party) to commence proceedings for non-payment of the proceeds of a claim  against the insurer without the need for joining the assignor (the policyholder) to those proceedings, which would be the case if there were only an equitable assignment. In the context of leveraged buy-outs, the request for a notice to the insurer may be resisted or requested to be moved to a perfection step taken at the time of an event of default or declared default, in line with the general trend in negotiation of security documentation on transactions with strong sponsors to move all but the most essential aspects of security perfection to matters to be taken only in a distressed scenario. Given the key importance of a W&I policy to the acquisition structure and likely corresponding limited (or lack of) recourse against the sellers, in most cases there should be no proportional reason for the lender to forego the notification to the insurer as a condition to closing (which, as noted, may in any event be a requirement under the terms of the policy). Most insurers providing W&I insurance will be accustomed to engaging with and accommodating the financing parties, and there are unlikely to be any commercial sensitivities which may occasionally exist in delivering such notices to the sellers in the case of an assignment of rights under the SPA.

Other protections

Other forms of direct contractual protection for lenders may be seen but are generally less advantageous or are more cumbersome:

• The lender may theoretically be added to the policy as co-insured, although this does not tend to be seen in the market because its insurable interest is different from the borrower’s (as explained earlier) and therefore would be resisted by W&I insurers. This would also increase the cost of the insurance, but any failure to comply with policy terms by the buyer under the insurance policy would then not result in the lender (or security agent on behalf of the secured parties) losing the benefit of co-insurance. This would be an additional protection, and not a replacement to the security assignment over the buyer's rights under the policy.
• The buyer may instruct the insurer to note the lender (or security agent on behalf of the secured parties) as sole loss payee, requiring the insurer to pay out to the lender first, or having the lender's interest noted on the policy. However, without a security assignment or some direct contractual agreement with the insurer, there would be nothing to prevent the buyer from subsequently reversing its instructions.

It is clear that a watertight security interest over the W&I policy could be vital in a severe downside scenario where policyholder and/or target business have become distressed and the acquisition warranties and/or indemnities in the SPA have been breached giving rise to recourse under that policy. This can sometimes be overlooked as an area of focus in the heat of negotiation and there are plenty of traps for the unwary.

1 For a discussion on these two usages of “assignment” in the context of insurance policies see Dr Chee Ho Tham, ‘Assignment (or novation) of indemnity policies?’, (2023) 11 JIBFL 748. https://plus.lexis.com/api/permalink/4fe11612-7f83-4ba9-a80d-857c28331eaf/?context=1001073

2 Tancred v Delagoa Bay and East Africa Railway (1889) 23 QBD 239; Durham Bros v Robertson [1898] 1 QB 765; Good v Revenue and Customs Commissioners [2023] EWCA Civ 114.

[ View source .]

Latest Posts

• House of Commons Treasury Select Committee – SME Access to Finance
• Public consultation and major updates from French Data Protection Authority on health data and research
• CFIUS Proposes Rule to Strengthen Its Monitoring and Enforcement Authorities
• UK invests in advanced nuclear fuel, moves forward on fusion
• APP fraud: UK PSR consults on CHAPS mandatory reimbursement requirement

See more »

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

Refine your interests »

Written by:

PUBLISH YOUR CONTENT ON JD SUPRA NOW

• Increased visibility
• Actionable analytics
• Ongoing guidance

Published In:

Hogan lovells on:.

"My best business intelligence, in one easy email…"

Security Assignments – Not Always What They Say They Are?

Contributor

The nature of security created under a security document does not always match its description in the document. Charlotte Drake explains how this recharacterisation risk can apply to security assignments. 

Is an "absolute" security assignment legal or equitable?

Legal assignments – key requirements.

Lenders commonly take security over "choses in action" (such as debts or rights under contracts) by way of assignment. An assignment involves the transfer of either legal ownership (legal assignment) or equitable ownership (equitable assignment).

Section 136 of the Law of Property Act 1925 dictates the formalities for taking a legal assignment. It requires that a legal assignment must (among other things):

• be in writing;
• be executed by the assignor; 
• be "absolute";
• not be expressed to be "by way of charge" only; and
• be notified in writing to the person against whom the assignor could enforce the assigned rights (the third party).

Legal assignments by way of security

There has been much case law on what "absolute" means. An assignment will not be absolute if it is conditional, or of part of a debt. However, a security assignment can qualify (provided it is not "by way of charge"): the fact the assignor has an equity of redemption under a security assignment does not of itself prevent the assignment from being "absolute". Security assignments sometimes use the term "absolute" to make clear they are intended to be legal assignments. However, the terminology used is not decisive. An assignment will not be "absolute" unless the third party can then deal with the assignee alone in respect of the assigned rights. The assignee owes an obligation to the assignor to reassign the rights on discharge of the secured liability. But the third party can continue to deal with the assignee until it receives notice of that reassignment.

In practice, this usually presents a considerable stumbling block to taking security by way of a legal assignment. Security assignments often allow the assignor to continue to deal with the third party, which commercially suits assignor, assignee and third party alike. However, such an assignment will not be "absolute" and so will take effect in equity only, even if the security document claims to effect a legal assignment.

The recent case of Ardila Investments NV v. ENRC NV and another 1 highlighted this. The judge accepted that the assignment clause in the document used "the words of a legal assignment". However, he pointed to other clauses in the assignment document which suggested the parties had intended it to take effect in equity rather than law. One of these clauses obliged the assignor to "pursue its rights" under the assigned contracts, which is clearly inconsistent with an absolute assignment.

Legal or equitable – does it matter?

Often not. A notified equitable assignment has as strong a priority against other interests in the assigned rights as a legal assignment.

One advantage of a legal assignment is that a legal assignee can sue the third party without the assignor's involvement. Received wisdom used to be that an equitable assignee could not sue alone and the assignor (as owner of the legal interest) must be joined in as party to proceedings (either as co-plaintiff if willing, or as co-defendant if not).

In Ardila the judge held that the assignment took effect in equity and that both assignor and assignee should join in the proceedings as co-claimants. As it happened, when the hearing took place, the assignor had been joined as co-claimant anyway. In other cases, an equitable assignee has been able to sue the third party alone. As a purely practical matter, even if the assignor does need to be joined into proceedings this is unlikely to be more than an inconvenience.

Could a security assignment be "floating" security?

Could there be another, more unpalatable, result of control remaining with the assignor following a security assignment? In Re Spectrum Plus 2 , the House of Lords of course held that a charge over a debt will be floating, not fixed, if the security holder fails to exercise control over the debt proceeds. Is a security assignment of a debt or similar contractual right also at risk of being recharacterised in this way? This is far from a settled point, but these obiter comments from Lord Scott in Re Spectrum Plus (at paragraph 107) suggest so: 

" Suppose, for example, a case where an express assignment of a specific debt by way of security were accompanied by a provision that reserved to the assignor the right, terminable by written notice from the assignee, to collect the debt and to use the proceeds for its (the assignor's) business purposes, ie, a right, terminable on notice, for the assignor to withdraw the proceeds of the debt from the security. This security would, in my opinion, be a floating security notwithstanding the express assignment. " 

There is some logic in this approach. If it were possible to "solve" Re Spectrum Plus by renaming all charges over debts as security assignments, the case would not have taken on the significance that it has. The risk of this type of recharacterisation is most obvious in a UK insolvency, where there is a clear distinction between the application of fixed and floating recoveries. In this context, at least, the "fixed/floating" distinction is likely to be more of a concern to a lender than whether its security assignment is "legal" rather than "equitable".

1. [2015] EWHC 1667 (Comm) (11 June 2015)

2. [2005] UKHL 41.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

Finance and Banking

Mondaq uses cookies on this website. By using our website you agree to our use of cookies as set out in our Privacy Policy.

Due: Sat May 25 11:59 pm Late submissions accepted until Sun May 26 11:59 pm

Assignment by Michael Chang & Julie Zelenski idea originated by Randal Bryant & David O'Hallaron (CMU). Modifications by Nick Troccoli, Brynne Hurst, Kathleen Creel and Jonathan Kula.

Learning Goals

This assignment focuses on understanding assembly code representations of programs. You will be building your skills with:

• reading and tracing assembly code
• understanding how data access, control structures, and function calls translate between C and assembly
• reverse-engineering
• understanding the challenges of writing secure and robust systems
• understanding privacy, trust, and the role of the ethical penetration tester
• mastering the gdb debugger!

You have been hired as a security expert for Stanford Bank (a fictional on-campus bank). They need you to investigate reports of infiltration and security issues and replicate the issues so that they can fix them.

There are three parts to this assignment, each of which can be completed independently:

• an ATM withdrawal program containing some vulnerabilities - you'll need to use your C and assembly skills to find and demonstrate how to exploit these vulnerabilities.
• A dataset that you will use to deanonymize bank users.
• The SecureVault program, a new product designed by the bank to provide increased security to the master vault. You'll be given an executable of the SecureVault program (no C code provided!) to show that it is possible to reverse engineer this program and break into the master vault without being told the passwords.

These problems are like C/assembly "puzzles" to solve, and we hope you enjoy solving them and exploring this material as much as we enjoyed creating them!

Note: check out our assignment overview video on Canvas ; it goes over the different parts of the assignment, what to expect, and tips and tricks! Note the overview video is from this quarter last year, but the assignment is the same (save for the fact that questions 2 and 3 are exchanged).

Spring 2024: Lecture 22 (Mon 5/20) is necessary to work on questions 3 and 4 in part 2 of this assignment.

A few reminders:

• The working on assignments page contains info about the assignment process.
• The collaboration policy page outlines permitted assignment collaboration, emphasizing that you are to do your own independent thinking, design, writing, and debugging. Even without any code being submitted, you should not be doing any joint debugging/development, sharing or copying written answers, sharing specific details about SecureVault behavior, etc. If you are having trouble completing the assignment on your own, please reach out to the course staff; we are here to help!

To get started on this assignment, clone the starter project using the command

View Full Starter File List

• vault : Your SecureVault executable program, custom-generated for each student.
• custom_tests : The file where you will add custom tests to reproduce vulnerabilities in the provided ATM withdrawal program.
• input.txt : A blank text file where you should add the passwords for each SecureVault level, one per line. See the section on SecureVault for more information.
• readme.txt : A file where you should add answers to short written questions for all three parts of the assignment.
• .gdbinit : A gdb configuration file you can optionally use to run certain gdb commands each time gdb launches. See the section on using GDB in SecureVault for more information.
• samples : A symbolic link to the shared directory for this assignment. It contains:
• atm : The executable ATM program, which you will explore for vulnerabilities.
• atm.c : The C source code for the ATM program, which you will explore for vulnerabilities. Note that you're not able to edit or recompile this code/executable.
• checkins.csv : A file containing public social media location check-in data for various locations on Stanford campus over the past three months.
• search_checkins : An executable program to search the check-in data.
• bank : a folder containing the following:
• customers.db : A file with the list of all users and balances for the ATM program.
• transactions.csv : A file with ATM transaction information from the past three months at the Stanford campus ATM.
• SANITY.INI and sanity.py : Files to configure and run sanity check. You can ignore these files.
• wordlist : A list of dictionary words used for SecureVault.
• tools : Contains symbolic links to the sanitycheck and submit programs for testing and submitting your work. ( codecheck is not needed on this assignment)

You will be using gdb frequently on this assignment. Here are essential resources as you work - note that you should make sure you have downloaded the CS107 GDB configuration file mentioned in the Getting Started Guide if you didn't previously do so.

Open Getting Started Guide Open GDB Guide Open Lab5 GDB Tips Open Lab6 GDB Tips

1. ATM Security

Stanford Bank recently updated the ATM software to a version with some additional features. The IT team reviewed the new code and thought it all looked good, but having now installed it in production, they are observing some suspicious activity. The bank has called you because your superior C and assembly skills are just what's needed to investigate and resolve these problems!

In the samples folder, they have provided you the code ( atm.c ) and compiled executable ( atm ), which you can examine/run but cannot recompile or edit (since they want to ensure you work with the same executable installed on the ATMs themselves). The ATM program is invoked with an amount and the credentials for a particular account. If the credential is authorized and the account has sufficient funds, the amount is withdrawn and dispersed in cash. Accounts must maintain a minimum balance of $50, and the ATM is supposed to maintain bank security by rejecting unauthorized access. Every time you run the program, it will print out information to the terminal about the transaction that took place, or the error that occurred, if any. For example, if you ask to withdraw $100 from your account balance of $107, it should be denied with an error message because that would bring your current $107 balance below the required minimum of $50. If you try to sneak cash from another account or use a fake name, your credential should get rejected as unauthorized.

Here are a few examples - try it out yourself! Note that $USER automatically acts as your SUNET ID, and every account balance is set to be $107. Also, each time you run the program anew, all balances return to their original starting levels. No money actually changes hands in this ATM, which is a blessing given its security flaws.

Expand ATM Sample Runs

The bank has identified three anomalies in the ATM program behavior that they need your help investigating. For each of the anomalies (a), (b), and (c) below, you will need to do the following:

• include a test case in your custom_tests file to showcase how to reproduce the vulnerability. Note that there may be more than one way to trigger a vulnerability.
• A concise description of the underlying defect in the code.
• An explanation of exactly how you constructed your test case to exploit it.
• Your recommendation for fixing it. The bank is not looking for a major rewrite/redesign, so in your proposed changes you should directly address the vulnerability with minimal other disruption. Note that there may be more than one possible remedy for fixing each issue. Also make sure you do not remove intended functionality of the bank program, and account for any potential additional security issues introduced by your proposed fix .

NOTE: when running your own custom tests, make sure to inspect the output to ensure your tests are causing the behavior you expect! The sanitycheck tool itself does not verify that the tests cause the specified exploits.

As you work through your investigation, you will need to review the source code for the atm program. The program is roughly 175 lines of C code of similar complexity to what you have been writing this quarter, and is decomposed and fairly readable, though sorely lacking in comments. You should find that the program's approach seems reasonable and the code is sincere in its attempt to operate correctly. As you're reading, take a minute to reflect on how far your awesome C skills have come to let you read through this provided program!

NOTE: when running the ATM program under GDB, make sure you are in the samples folder first before running gdb atm .

a) Negative Balances

A prior version of the ATM program restricted a withdrawal to be at most the full account balance, allowing the customer to drain their account to $0, but no further. The current version has changed the withdraw function to require a non-zero minimum balance. The expected behavior should be that all account balances stay above this minimum. However, the bank saw an (otherwise ordinary) withdrawal transaction that not only caused an account to go below the minimum, but also overdrew so far as to end up with a negative balance. Oops, that's definitely not supposed to happen! Review the C code for the withdraw function, specifically the changes from the old version. It seems to work in many cases, but apparently not all. Read carefully through this function to try and discover the flaw - your understanding of signed and unsigned integers will be useful here! Once you have found the vulnerability, determine a command to make a withdrawal as yourself that withdraws more money than is present in your account . Put this command in custom_tests , and answer the specified readme questions.

b) Unauthorized Account Access

The bank has also received a customer complaint about an unauthorized withdrawal from their account. It seems that another user with different credentials was able to successfully withdraw money from the aggrieved customer's account. Moreover, the credential used appears to be entirely fake - no such user exists in the database! A user should not be able to access a different customer's account and especially not by supplying a bogus credential! Review the C code for the find_account function that is responsible for matching the provided username to their account number. It seems to work properly when the username matches an existing account, but not when the username doesn't match an existing account. Trace through line by line how the function executes when called with an invalid username that is not in the database. What lines are executed? Once you do this, you'll find that the function appears to behave unpredictably. Your next task is to examine the generated assembly to determine precisely how the function will behave - your understanding of the %rax / %eax register will be useful here! Once you have found the vulnerability, determine a command with a designed bogus name credential to withdraw $40 from one of the CS107 staff member's accounts. Put this command in custom_tests , and answer the specified readme questions. (The samples/bank/customers.db file contains information about all valid users and their balances, and the first 15 users in the database are staff accounts.)

c) Accessing The Master Vault

The most worrisome issue is repeated illicit withdrawals from the master vault account, account number 0. The name on the master account is not an actual user, so this account cannot be accessed using the simple username-based credential. Instead, the user must specify two account arguments, the account's number and its secret passcode, as a form of heightened security, like this:

At first the bank thought the vault passcode had been leaked, but changing the passcode did nothing to thwart the attack. In a fit of desperation, the bank removed the vault passcode file altogether, figuring this would disable all access to the vault, yet the rogue user continues to make withdrawals from it! It seems that the high-security passcode authentication may have its own security flaw! The code that handles this authentication is in the lookup_by_number and read_secret_passcode functions. These functions work correctly in many situations, but fail in certain edge cases. Remember that it seems that in certain cases supplied credentials are accepted despite the lack of a saved passcode file . The vulnerability is subtle in the C code, so you should also use GDB to examine the code at the assembly level and diagram out the memory on the stack for these functions . This problem is similar to the stack diagramming/exploit problem from lab6 - revisit that problem if you need a refresher! Your exploit should not involve reading from any file. Once you have found the vulnerability, determine a command to withdraw $300 from the bank vault despite its disabled passcode . Put this command in custom_tests , and answer the specified readme questions.

2. Dataset Aggregation

Separate from the faulty ATM software, Stanford Bank believes that someone was able to gain access to their account logs and get a list of ATM transaction information for their Stanford campus ATM. The company believes that this poses little threat because the transaction logs have limited recorded data. However, you are concerned that this data can be combined with other available data in dangerous ways, such as to learn private information. For instance, knowing someone's history of large (or small) transactions might tell you about their financial situation; knowing memberships in clubs or organizations might tell you about social relationships and webs of networks. Your task is to combine this data with another dataset you have found of public location check-ins to show the harms of a potential data breach. To aid in investigating your concerns, the bank has made the ATM transaction data available to you in the samples/bank/transactions.csv file. This file has one account transaction per line, and each transaction occurred at the Stanford campus ATM. Each line has the following format:

For example, here is one line from the file that represents a withdrawal of $15 on 2/15/21 at 4:54PM:

Transactions with the same account identifier are guaranteed to be for the same bank account, but the identifier doesn't give any information about whose account it is (intentionally done by the bank to obfuscate the data).

You have already downloaded a publicly-available location checkins dataset from an online social network, in the file samples/checkins.csv . It is too large to read through manually, so you also already created a program search_checkins that displays that checkin data and lets you search through it more easily. Run the program ( samples/search_checkins ) for instructions on how to use it.

Show the risks of dataset aggregation and express your concerns to the bank managers by answering the following questions in your readme.txt . Note that you are not expected to create any additional programs to parse or otherwise process these datasets with code - the intent is for you to skim the transactions.csv file by hand and use it along with the search_checkins program to answer the following questions.

• a) The likely user who made multiple large transactions?
• b) Two (there may be more, but you must identify only two) likely members of the Stanford SecurityStars Club, which has a club meeting on the 15th of each month where people must bring $15 to pay their membership dues? (Assume they are procrastinators in withdrawing the money)
• How were you able to de-anonymize the transactions data?
• Beyond encrypting the data, what recommendations would you give to Stanford Bank to further anonymize or obfuscate the account data in the case of accidental data breaches?
• Use one or more of the four models of privacy discussed in lecture to explain why disclosure of the information that can be aggregated here is (or is not) a violation of privacy.

3. SecureVault

Stanford Bank is rolling out a new tool, SecureVault, to provide increased security at the master vault at each of their branches. Employees must enter four secret passwords into this program to gain access to the master vault. For extra security, the bank creates a different SecureVault program for each branch with different expected passwords; the bank headquarters does not give the source code to any of the branches; and the program triggers an alarm that notifies the central system each time an incorrect password is entered. They are confident that this means only someone who is told the password can get access, and any potential intruders will be detected by the alarm system. They have hired you to test this. Your task is to show that you can reverse engineer the program to gain access to the bank vault without being told the password, and without alerting central security.

Do not start by running SecureVault and entering passwords to "see what will happen" . You will quickly learn that what happens is the alarm goes off and it deducts points :-) When started, SecureVault waits for input and when you enter the wrong password, it will raise the alarm and notify the central system, deducting points. Thoroughly read the SecureVault information below before attempting to enter any passwords! There is a lot of information below, but it is included to help provide useful tips for you to work through this part of the assignment.

Without the original source code, all you know is that SecureVault has four "levels" of security, each with a different password. If the user enters the correct password, it deactivates the level and the program proceeds on. But given the wrong input, SecureVault raises an alarm by printing a message, alerting central security and terminating. To reach the master vault, one needs to successfully disarm each of its levels.

This is where the bank needs your help. Each of you is assigned a different generated SecureVault executable unique to you, generated just as they would be for each bank branch. Your mission is to apply your best assembly detective skills to reverse engineer the SecureVault executable to work out the input required to pass each level and reach the master vault, thus proving the insecurity of the bank's approach.

Specifically, you must fill in your input.txt file with the passwords to defuse each level in order, 1 per line, for each level you have solved. You must also answer the following questions in your readme.txt file. Make sure to verify your input.txt file (with appropriate protections!) to ensure proper formatting and that all lines are entered correctly before submitting! We will test by running ./vault input.txt on your submission, using the original SecureVault program generated for you. Here are the readme questions to work through as you go:

• What tactics did you use to suppress/avoid/disable alarms?
• level_1 contains an instruction near the start of the form mov $<multi-digit-hex-value>,%edi . Explain how this instruction fits into the operation of level_1 . What is this hex value and for what purpose is it being moved? Why can this instruction reference %edi instead of the full %rdi register?
• level_2 contains a jg that is not immediately preceded by a cmp or test instruction. Explain how a branch instruction operates when not immediately preceded by a cmp or test . Under what conditions is this particular jg branch taken?
• Explain how the loop in the winky function of level_3 is exited.
• Explain how the mycmp function is used in level_4 . What type of data is being compared and what ordering does it apply?
• How would you describe Stanford Bank’s trust model? (In other words: who among the bank headquarters, the bank branches, and you was trusted?) Justify your answer.

SecureVault Information

From the SecureVault assembly, you will work backwards to construct a picture of the original C source in a process known as reverse-engineering . Note that you don't necessarily need to recreate the entire C source; your goal is to work out a correct input to pass the level. This requires a fairly complete exploration of the code path you follow to deactivate the level, but any code outside that path can be investigated on a need-to-know basis. Once you understand what makes your SecureVault program "tick", you can supply each level with the password it requires to disarm it. The levels get progressively more complex, but the expertise you gain as you move up from each level increases as well. One confounding factor is that SecureVault raises an alarm whenever it is given invalid input. Each time the alarm goes off (except for a free pass the first time), it notifies central security (the CS107 staff) and points are deducted from your score. Thus, there are consequences to setting off the alarm -- you must be careful!

The bank has confirmed to you a few things about how the SecureVault programs operate:

• If you start SecureVault with no command-line argument, it reads input typed at the console.

If you give an argument to SecureVault, such as input.txt :

SecureVault will read all lines from that file and then switch over to reading from the console. This feature allows you to store inputs for solved levels in input.txt and avoid retyping them each time.

Alarms can be triggered when executing at the shell or within gdb. However, gdb offers you tools you can use to intercept the alarms, so your safest choice is to work under gdb and employ preventive measures.

• It is not possible to know for sure whether the central system (course staff) is notified about an alarm. You must use your investigative skills and best defensive measures!
• The central system will give you a free pass (no point deduction) the first time they are notified about an alarm.
• The SecureVault program in your repository was lovingly created just for you and is unique to your id. It is said that it can detect if an impostor attempts to run it and won't play along.
• The SecureVault program is designed for the myth computers (running on the console or logged in remotely). There is a rumor that it will refuse to run anywhere else.
• It seems as though the function names were left visible in the object code, with no effort to disguise them. Thus, a function name of initialize_vault or read_five_numbers can be a clue. Similarly, it seems to use the standard C library functions, so if you encounter a call to qsort or sscanf , it is the real deal.
• There is one important restriction: Do not use brute force!   You could write a program to try every possible input to find a solution. But this is trouble because a) you lose points on each incorrect guess which raises an alarm, b) trying all possible inputs will take an eternity and risk saturating the network, and c) part of your submission requires answering questions that show you understanding of the assembly code, which guessing will not provide :)

Using tools such as gdb , objdump and new tools nm and strings is critical to effectively investigating and disarming each level. Once you are familiar with the tools at your disposal, first work to reliably prevent alarms from triggering , then proceed with disarming each of the levels .

Step 1: Familiarity with Tools

Here are some helpful tools to gather general information:

• nm : use the nm utility ( nm vault ) to print what's called the "symbol table" of the executable, which contains the names of functions and global variables and their addresses. The names may give you a sense of the structure of the SecureVault program.
• strings : use the strings utility ( strings vault ) to print all the printable strings contained in the executable, including string constants. See if any of these strings seem relevant in determining the passwords.
• gdb lets you single-step by assembly instruction, examine (and change!) memory and registers, view the runtime stack, disassemble the object code, set breakpoints, and more. Live experimentation on the executing SecureVault program is the most direct way to become familiar in what's happening at the assembly level.
• Compiler Explorer : pull up tools like the Compiler Explorer interactive website from lab, or gcc on myth , to compile and explore the assembly translation of any code you'd like. For example, if you're unsure how to a particular C construct translates to assembly, how to access a certain kind of data, how break works in assembly, or how a function pointer is invoked by qsort , write a C program with the code in question and trace through its disassembly. Since you yourself wrote the test program, you also don't have to fear it setting off any alarms :-) You can compile directly on myth using a copy of a Makefile from any CS107 assignment/lab as a starting point, and then use gdb or objdump to poke around.

GDB Suggestions

GDB is absolutely invaluable on this assignment. Here are some suggestions on how to maximize your use of gdb in addition to the tips in lab5 and lab6 :

• Expand your gdb repertoire. The labs have introduced you to handy commands such as break , x , print , info , disassemble , display , watch , and stepi/nexti . Here are some additional commands that you might find similarly useful: jump , kill , and return . Within gdb, you can use help name-of-command to get more details about any gdb command. See the quick gdb reference card for a summary of many other neat gdb features.

Get fancy with your breakpoints. You can breakpoints by function name, source line, or address of a specific instruction. Use commands to specify a list of commands to be automatically executed whenever a given breakpoint is hit. These commands might print a variable, dump the stack, jump to a different instruction, change values in memory, return early from a function, and so on. Breakpoint commands are particularly useful for installing actions you intend to be automatically and infallibly completed when arriving at a certain place in the code. (hint!)

gdb kill workaround : gdb 9.2 (current version on myth as of 04/2021) has a bug when attempting to use kill in the commands sequence for a breakpoint that creates a cascade of problems --can cause gdb itself to crash or hang. The gdb command signal SIGKILL can be used as an alternate means to kill a program from a commands sequence that doesn't trip this bug.

Use a .gdbinit file . The provided file named .gdbinit in the assignment folder can be used to set a startup sequence for gdb. In this text file, you enter a sequence of commands exactly as you would type them to the gdb command prompt. Upon starting, gdb will automatically execute the commands from it. This will be a convenient place to put gdb commands to execute every time you start the debugger. Hint: wouldn't this be useful for creating breakpoints with commands that you want to be sure are always in place when running the SecureVault program? The .gdbinit file we give you in the starter repo has only one command to echo Successfully executing commands from .gdbinit in current directory . If you see this message when you start gdb, it confirms the .gdbinit file has been loaded. If you see an error message about auto-loading .gdbinit being declined when starting gdb, this means you haven't installed the CS107 GDB configuration file - see the top of this page for instructions.

• Custom gdb commands . Use define to add your own gdb "macros" for often-repeated command sequences. You can add defines to your .gdbinit file so you have access to them in subsequent gdb sessions as well.
• Fire up tui mode (maybe...). The command layout asm followed by layout reg will give you a split window showing disassembly and register values. This layout will display current values for all registers in the upper pane, the sequence of assembly instructions in the middle pane, and your gdb command line at the bottom. As you single-step with si , the register values will update automatically (those values that changed are highlighted) and the middle pane will follow instruction control flow. This is a super-convenient view of what is happening at the machine level, but sadly, you have to endure a number of quirks and bugs to use it. The tui mode can occasionally crash gdb itself, killing off gdb and possibly the SecureVault program while it's at it. Even when tui is seemingly working, the display has a habit of turning wonky, often fixable by the refresh command (use this early and often!) but not always. A garbled display could cause you to misunderstand the program state, misidentify where your SecureVault is currently executing, or accidentally execute a gdb command you didn't intend. Any alarm suppression mechanism that requires you, the fallible human, to take the right action at a critical time could easily be waylaid by interference, so don't attempt tui before you have invincible automatic protection against alarms. Selective use of auto-display expressions (introduced in lab6) is a great alternative with less disruption. You can exit tui using ctrl-x a and re-enter it again (this doesn't require leaving gdb and losing all your state).

Step 2: General Investigation and Preventing Alarms

Once you are familiar with the tools at your disposal, your next step is to gather general information about how the SecureVault program works to figure out how to reliably prevent alarms from triggering . There are simple manual blocks that give some measure of protection, but it is best to go further to develop an invincible guard. Feel free to use any technique at your disposal, such as leveraging gdb features, tweaking the global program state, modifying your setup, tricking the SecureVault program into running in a safe manner, etc. Avoiding the alarm entirely is one straightforward approach to ensure that we won't hear about it, but there are ways to selectively disable just the transmission portion to the central system (course staff) . Once you figure how to set up appropriate protection against alarms, you will then be free to experiment with the levels without worry. Note that the program can only trigger an alarm when it is "live", i.e., executing in shell or running with gdb .

Step 3: Disarming Levels

Your next task is to approach each level individually to figure out a password that disarms it. There may be more than one password for each level; your task is to enter your 4 passwords, one per line, starting with level 1, into your input.txt file. Here are key tips for how to approach your reverse engineering exploration:

• Run the program live in GDB (with appropriate alarm protections!) and step through to better understand its behavior. Reading and diagramming the assembly by hand is useful to an extent, but quickly becomes infeasible with larger programs.
• Break the assembly into chunks. For instance, if it calls any functions, that's a good stopping point to orient yourself and understand the assembly just up to that point.
• Use gdb to verify your hypotheses. Verify key assumptions you make about the vault behavior to ensure you're on the right track. One helpful trick is you can change register contents while running gdb. E.g. if you think "I believe if %rdi stored this, it would do that", then try it! You can do p $rdi = val to change register contents mid-program. Or if you think something is a char * , cast and print it out, e.g. p (char *)$rdi .
• Document your knowns and unknowns. If you run into a situation where you are stuck due to seemingly-conflicting assumptions, document them and re-verify them. If you have multiple conflicting assumptions, at least one must not be the case.
• Use compiler explorer to see what code looks like in assembly. If you think you happened upon e.g. a loop, if statement, etc. try using compiler explorer to type in some code quickly and see what that code looks like in assembly. If it resembles the assembly you're seeing, perhaps that can help you better understand its structure.
• Use library functions to your advantage. If you spot a call to what looks like a library function, it's the real deal. Use the man page for that function to learn about what parameters it takes in, what it does, and what it returns. This can give you key information about the types of data in different registers - e.g. if you see a call to strlen , then the value put into %rdi must be of type char * , and what's stored in %rax afterwards must be a size_t string length.
• When tracing an unknown function, before dissecting its behavior first learn about the input/output of the function and what role it plays. Does it return anything? What parameters does it take in? If it has a return value, is it checked to be something in particular? Going into a function with an idea of what must be returned for you to continue with the vault can help you focus on understanding how to achieve that.

Sanity Check

The default sanitycheck test cases are ATM inputs and one test case that reports the line count of your input.txt file. This sanitycheck is configured to only allow test cases for ATM in your custom_tests file. The SecureVault executable is not run by sanitycheck.

Once you are finished working and have saved all your changes, check out the guide to working on assignments for how to submit your work. We recommend you do a trial submit in advance of the deadline to allow time to work through any snags. You may submit as many times as you would like; we will grade the latest submission. Submitting a stable but unpolished/unfinished version is like an insurance policy. If the unexpected happens and you miss the deadline to submit your final version, this previous submit will earn points. Without a submission, we cannot grade your work.

We would also appreciate if you filled out this homework survey to tell us what you think once you submit. We appreciate your feedback!

For this assignment, here is a tentative point breakdown (out of 119):

• custom_tests (24 points) Each successful attack test case earns 8 points. We will test by running tools/sanitycheck custom_tests on your submission. Your custom_tests should contain 3 test cases, one for each ATM attack.
• readme.txt (55 points) The written questions will be graded on the understanding of the issues demonstrated by your answers and the thoroughness and correctness of your conclusions.
• Input.txt (40 points) Each SecureVault level you have solved earns 10 points. We will test by running ./vault input.txt on your submission. The input.txt file in your submission should contain one line for each level you have solved, starting from level 1. Malformed entries in your input.txt or wrong line-endings will cause grading failures. To avoid surprises, be sure that you have verified your input.txt in the same way we will in grading (i.e., ./vault input.txt ).
• SecureVault alarms triggered (up to 6 points deducted) Each alarm notification (beyond the first one) that reaches the staff results in a 1 point deduction, capped at 6 points total.

Post-Assignment Check-in

How did the assignment go for you? We encourage you to take a moment to reflect on how far you've come and what new knowledge and skills you have to take forward. Once you finish this assignment, your assembly skills will be unstoppable, and you will have a better understanding of trust, privacy and security! You successfully found vulnerabilities in a program using its source and assembly, and reverse engineered a complex program without having access to its source at all. Rock on!

To help you gauge your progress, for each assignment/lab, we identify some of its takeaways and offer a few thought questions you can use as a self-check on your post-task understanding. If you find the responses don't come easily, it may be a sign a little extra review is warranted. These questions are not to be handed in or graded. You're encouraged to freely discuss these with your peers and course staff to solidify any gaps in you understanding before moving on from a task.

• What are some of the gdb commands that allow re-routing control in an executing program?
• What is the main indication that an assembly passage contains a loop?
• What makes someone a trustworthy fiduciary or guardian of personal data? How and why should an institution like a bank protect the privacy of its customers?
• Explain the difference between a function's return value and its return address.
• Consider the mechanics of function pointer work at the assembly level. How is a call through a function pointer the same/different when compared to an ordinary function call?
• For performance reasons, the compiler prefers storing local variables in registers whenever possible. What are some reasons that force the compiler to store a local variable on the stack instead?
• For the instruction sequence below, what must be true about values of op1 and op2 for the branch to be taken? What changes if ja is substituted for jg ? cmp op1,op2 jg target

NEWS... BUT NOT AS YOU KNOW IT

‘I’m coming for his heart!’ – Tyson Fury and Oleksandr Usyk separated by security during fiery weigh-in

Share this with

Tyson Fury and Oleksandr Usyk were separated by security after their final weigh-in ahead of Saturday’s undisputed heavyweight title fight in Saudi Arabia.

A lean ‘Gypsy King’ hit the scales at his lightest weight in five years, coming in at 262lbs.

Usyk, who danced his way down to the stage on Friday night, comes in at 233.5lbs, his heaviest ever weight.

Following Thursday’s final press conference, Fury refused to make eye contact with Usyk , starting off into the crowd and posing for cameras as he avoided the Ukrainian’s icy stare.

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

That changed on Friday with the two coming face-to-face with security wading in to separate the two as it all kicked off on stage.

I’m gonna knock this little f****r spark out,’ Fury bellowed after the two had been separated. ‘I’m coming for his heart.

‘F**k his belts, I’m coming for his heart. He’s getting it tomorrow. F**k all his team too, they can all get it they want it too.’

Closer look… 🔎 The FINAL face off between #FuryUsyk got HEATED! 🔥 pic.twitter.com/F6vkUgYeY3 — Sky Sports Boxing (@SkySportsBoxing) May 17, 2024

‘Don’t be afraid, I will not leave you alone tomorrow,’ Usyk said, delivering a final message to his rival.

Fury vs Usyk: Last five fighting weights

Ngannou: 277.75lbs Chisora: 268.75lbs Whyte: 264.75lbs Wilder 3: 277lbs Wilder 2: 273lbs

Oleksandr Usyk

Dubois: 221lbs Joshua 2: 221.5lbs Joshua 1: 221.25lbs Chisora: 217.25lbs Witherspoon: 215lbs

Asked how he has stayed so calm, Usyk added: ‘Because that is my plan. If I am nervous, I will not win.’

Fury, the WBC champion, and Usyk, who holds the IBF, WBO and WBA titles are fighting to crown the heavyweight division’s first undisputed champion since Lennox Lewis 25 years ago.

Tensions have been building in a tense fight week that sparked into life when John Fury, Tyson’s father, headbutted a member of Team Usyk on Monday.

MORE : What time and channel is Tyson Fury vs Oleksandr Usyk fight in the UK?

MORE : No bad blood after fight week chaos but Tyson Fury and Oleksandr Usyk mind games are underway

MORE : Oleksandr Usyk’s team lodge complaint over ring just days before Tyson Fury fight

Get us in your feed

Facility for Rare Isotope Beams

At michigan state university, international research team uses wavefunction matching to solve quantum many-body problems, new approach makes calculations with realistic interactions possible.

FRIB researchers are part of an international research team solving challenging computational problems in quantum physics using a new method called wavefunction matching. The new approach has applications to fields such as nuclear physics, where it is enabling theoretical calculations of atomic nuclei that were previously not possible. The details are published in Nature (“Wavefunction matching for solving quantum many-body problems”) .

Ab initio methods and their computational challenges

An ab initio method describes a complex system by starting from a description of its elementary components and their interactions. For the case of nuclear physics, the elementary components are protons and neutrons. Some key questions that ab initio calculations can help address are the binding energies and properties of atomic nuclei not yet observed and linking nuclear structure to the underlying interactions among protons and neutrons.

Yet, some ab initio methods struggle to produce reliable calculations for systems with complex interactions. One such method is quantum Monte Carlo simulations. In quantum Monte Carlo simulations, quantities are computed using random or stochastic processes. While quantum Monte Carlo simulations can be efficient and powerful, they have a significant weakness: the sign problem. The sign problem develops when positive and negative weight contributions cancel each other out. This cancellation results in inaccurate final predictions. It is often the case that quantum Monte Carlo simulations can be performed for an approximate or simplified interaction, but the corresponding simulations for realistic interactions produce severe sign problems and are therefore not possible.

Using ‘plastic surgery’ to make calculations possible

The new wavefunction-matching approach is designed to solve such computational problems. The research team—from Gaziantep Islam Science and Technology University in Turkey; University of Bonn, Ruhr University Bochum, and Forschungszentrum Jülich in Germany; Institute for Basic Science in South Korea; South China Normal University, Sun Yat-Sen University, and Graduate School of China Academy of Engineering Physics in China; Tbilisi State University in Georgia; CEA Paris-Saclay and Université Paris-Saclay in France; and Mississippi State University and the Facility for Rare Isotope Beams (FRIB) at Michigan State University (MSU)—includes  Dean Lee , professor of physics at FRIB and in MSU’s Department of Physics and Astronomy and head of the Theoretical Nuclear Science department at FRIB, and  Yuan-Zhuo Ma , postdoctoral research associate at FRIB.

“We are often faced with the situation that we can perform calculations using a simple approximate interaction, but realistic high-fidelity interactions cause severe computational problems,” said Lee. “Wavefunction matching solves this problem by doing plastic surgery. It removes the short-distance part of the high-fidelity interaction, and replaces it with the short-distance part of an easily computable interaction.”

This transformation is done in a way that preserves all of the important properties of the original realistic interaction. Since the new wavefunctions look similar to that of the easily computable interaction, researchers can now perform calculations using the easily computable interaction and apply a standard procedure for handling small corrections called perturbation theory.  A team effort

The research team applied this new method to lattice quantum Monte Carlo simulations for light nuclei, medium-mass nuclei, neutron matter, and nuclear matter. Using precise ab initio calculations, the results closely matched real-world data on nuclear properties such as size, structure, and binding energies. Calculations that were once impossible due to the sign problem can now be performed using wavefunction matching.

“It is a fantastic project and an excellent opportunity to work with the brightest nuclear scientist s in FRIB and around the globe,” said Ma. “As a theorist , I'm also very excited about programming and conducting research on the world's most powerful exascale supercomputers, such as Frontier , which allows us to implement wavefunction matching to explore the mysteries of nuclear physics.”

While the research team focused solely on quantum Monte Carlo simulations, wavefunction matching should be useful for many different ab initio approaches, including both classical and  quantum computing calculations. The researchers at FRIB worked with collaborators at institutions in China, France, Germany, South Korea, Turkey, and United States.

“The work is the culmination of effort over many years to handle the computational problems associated with realistic high-fidelity nuclear interactions,” said Lee. “It is very satisfying to see that the computational problems are cleanly resolved with this new approach. We are grateful to all of the collaboration members who contributed to this project, in particular, the lead author, Serdar Elhatisari.”

This material is based upon work supported by the U.S. Department of Energy, the U.S. National Science Foundation, the German Research Foundation, the National Natural Science Foundation of China, the Chinese Academy of Sciences President’s International Fellowship Initiative, Volkswagen Stiftung, the European Research Council, the Scientific and Technological Research Council of Turkey, the National Natural Science Foundation of China, the National Security Academic Fund, the Rare Isotope Science Project of the Institute for Basic Science, the National Research Foundation of Korea, the Institute for Basic Science, and the Espace de Structure et de réactions Nucléaires Théorique.

Michigan State University operates the Facility for Rare Isotope Beams (FRIB) as a user facility for the U.S. Department of Energy Office of Science (DOE-SC), supporting the mission of the DOE-SC Office of Nuclear Physics. Hosting what is designed to be the most powerful heavy-ion accelerator, FRIB enables scientists to make discoveries about the properties of rare isotopes in order to better understand the physics of nuclei, nuclear astrophysics, fundamental interactions, and applications for society, including in medicine, homeland security, and industry.

The U.S. Department of Energy Office of Science is the single largest supporter of basic research in the physical sciences in the United States and is working to address some of today’s most pressing challenges. For more information, visit energy.gov/science.

• UN Women HQ
• Americas and the Caribbean

Caribbean pave the way for women's leadership in peace and security: Trinidad and Tobago hosted a key convening for the advancement of women’s ownership of the peace and security agenda in the Caribbean

Date: Friday, 17 May 2024

Representatives of Caribbean states, United Nations organizations and Our Secure Future met at Trinidad and Tobago to advance the development of Women, Peace and Security National Action Plans. Photo: UN Women

Port of Spain, Trinidad and Tobago - May 15th, 2024 - A significant gathering in Port of Spain, Trinidad and Tobago, brought together Caribbean leaders and key stakeholders to ensure women play a central role in responding to common regional challenges. The Women, Peace, and Security (WPS) Caribbean National Action Plan Convening, co-hosted by Our Secure Future and the United Nations Entity for Gender Equality and the Empowerment of Women (UN Women), took place from May 13th to 15th, 2024.

Government representatives, leaders from women's and civil society organizations, and regional intergovernmental frameworks met to assess the challenges for peaceful and safe societies in the Caribbean and address them through the advancements of the WPS agenda by focusing on women's leadership in peacebuilding, as highlighted by United Nations Security Council Resolution 1325 and subsequent resolutions.

While delivering remarks at the opening event, Tonni Brodber, Representative, UN Women Multi-Country Office – Caribbean, said:

“Coming out of this training, we look forward to your expert guidance on how best this particular agenda can be adapted to the realities of Trinidad and Tobago as well as the broader region and how we can work collaboratively to ensure that we are applying the context for our lived reality. Focused work around Women, Peace and Security, began in 2000 with 1325 when the UN General Assembly and Security Council recognised the need to have women at the center of peacebuilding and peacekeeping. We have continued throughout the years making space also for understanding and integrating climate security perspectives and the unique perspectives of small island developing states.”

Photos: UN Women

The event, convened by UN Women and Our Secure Future (OSF), provided actionable strategies through international expert-led discussions, helping participants design and implement impactful National Action Plans (NAPs). These plans are vital tools for addressing regional peace and security challenges and fostering women's participation in shaping effective solutions.

“We are aiming to advance the Women, Peace, and Security agenda by underscoring that women are not just victims, which is the current narrative, but we see women as agents of change, in particular in securing a peaceful and more secure environment for all of us. Today, we have about 110 countries that have adopted National Action Plans as a form of policy and practice to advance their national objectives, and this is really saying a lot because it is not mandated, but we see countries continually not only adopting these Plans and creating a multi-stakeholder process to do them but also renewing them year after year”, said Sahana Dharmapuri, OSF Vice President at the opening ceremony.

Over three days, the workshop facilitated collaboration across various sectors, emphasizing the importance of gender equality in peace processes. Participants shared insights and strategies to overcome barriers, reaffirming their commitment to empowering women to lead in addressing the Caribbean's security challenges.

“Given the level of violent crime, Caribbean countries can never claim to be living in peace, therefore, I am of the view we have a collective responsibility to address the issue of violence. We must adopt a position that none of us in the Caribbean is safe unless all of us are safe”, said Mr. Vijay Gangapersad, Permanent Secretary of Gender and Child Affairs at the Trinidad and Tobago Prime Minister Office.

“As a natural response, we have seen greater investment in the national security apparatus. We have seen investment in the police. More police, more guns for those policing. I believe that the solution is not more police and more guns. The answer is in this room, in this workshop”, Mr. Gangapersad added.

Our Secure Future and UN Women saluted the commitment of all countries that took part in this convening. Both organizations reaffirmed their eagerness to collaborate with national governments in launching their respective National Action Plans, ensuring women's full participation in preventing and responding to challenges while implementing strategic actions to maintain safe and peaceful communities across the region.

The event had over 35 participants, including relevant ministries and civil society organizations representing Barbados, Guyana, Jamaica, Trinidad and Tobago, and CARICOM.

Learn more about the work of UN Women on Women, Peace, and Security, and Humanitarian Action here: https://lac.unwomen.org/en/que-hacemos/paz-y-seguridad 

About UN Women: UN Women, the United Nations entity for gender equality and the empowerment of women, is dedicated to advocating for and advancing gender equality worldwide. With initiatives spanning the globe, UN Women works with governments, civil society, and other partners to empower women, promote their leadership, and ensure their rights are upheld in all aspects of life. The organization is also focused on guaranteeing the full participation of women as key actors in responding to the challenges of peace, security, and humanitarian action.

About Our Secure Future: Our Secure Future (OSF) believes that women make the crucial difference in achieving more effective governance and lasting peace. OSF aims to strengthen the Women, Peace, and Security movement by amplifying women’s voices, strengthening the global network of women peacebuilders, and promoting committed action by multiple stakeholders to turn policy into practice.

Contact information: [ Click to reveal ]

• About UN Women
• Executive Director
• Representative
• Deputy Representative
• Guiding documents
• Report wrongdoing
• Procurement
• Leadership and Political Participation
• UNiTE Caribbean Actions
• The 2030 Agenda for Sustainable Development
• Intergovernmental Support in the Caribbean
• Planning and Budgeting
• UN system coordination
• Gender Equality Forum 2024
• In Focus: Gender equality matters in COVID-19 response
• Publications
• Civil Society
• Antigua and Barbuda
• The Bahamas
• Saint Lucia
• St Kitts and Nevis
• St Vincent and Grenadines
• Trinidad and Tobago
• GBV In The Caribbean
• GBV Sources of Law
• GBV and State Accountability
• GBV Developments In The Law
• GBV Country Resources

• Practical Law

Taking security

Practical law uk practice note overview 2-107-4032  (approx. 37 pages), get full access to this document with a free trial.

Try free and see for yourself how Practical Law resources can improve productivity, efficiency and response times.

About Practical Law

This document is from Thomson Reuters Practical Law, the legal know-how that goes beyond primary law and traditional legal research to give lawyers a better starting point. We provide standard documents, checklists, legal updates, how-to guides, and more.

650+ full-time experienced lawyer editors globally create and maintain timely, reliable and accurate resources across all major practice areas.

83% of customers are highly satisfied with Practical Law and would recommend to a colleague.

81% of customers agree that Practical Law saves them time.

• Reviewable Transactions
• Lending - General
• Project Finance
• Asset Finance
• Restructuring and Insolvency Transactions
• Security and Quasi Security
• Structured Finance
• Trade Finance
• Mortgages and Security - Land and Buildings
• Asset finance and trade finance
• Corporate lending
• Equities & fixed income, currency and commodities
• Funding a construction project
• Infrastructure financing
• Project finance and real estate finance
• Resolution, restructuring and insolvency