What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2022-02-18 compared with 2021-02-19 · 84 added, 80 removed, 232 unchanged (41% of the section changed)

8 unchanged sentences

Attempted security breaches, including from the exploitation of vulnerabilities, cyber-attacks and Distributed Denial of Service (“DDoS”) attacks against our systems and services increase our costs, expose us to potentially material liability, and could materially harm our business and reputation.

As an operator of critical internet infrastructure, we experience a high rate of cyber-attacks and attempted security breaches targeting our systems and services, including the most sophisticated forms of attacks, such as advanced persistent threat attacks and zero-hour threats.

The forms of these attacks are constantly evolving and may involve methods, tools and strategies that have not been previously identified or observed until the moment of launch, or until sometime after, making these attacks virtually impossible to anticipate and difficult to defend against.

In addition to external threats, our systems and services are subject to insider threat risks, including physical or electronic break-ins, sabotage, and from suppliers, such as consultants and advisors, SaaS providers, hardware, software, and network systems manufacturers, regional internet registries, and other vendors, or from current or former contractors or employees.

These threats and any resulting security breach can arise from intentional or unintentional actions.

The forms of these attacks are constantly evolving and may involve methods, tools and strategies that may not have been previously identified and may not have been observed until the moment of launch, or until sometime after, making these attacks virtually impossible to anticipate and difficult to defend against.

In addition to external threats, our systems and services are subject to insider threat risks, including physical or electronic break-ins, sabotage, and risks from suppliers, such as consultants and advisors, SaaS providers, hardware, software, and network systems manufacturers, regional internet registries, and other vendors, or from current or former contractors or employees.

These threats and any resulting security breaches can arise from intentional or unintentional actions.

Our continued exposure to these threats and the potential that they could lead to material liability claims against us requires us to expend significant financial and other resources.

Our failure to identify, remediate and mitigate security threats, including insider threats, could result in material harm to our business, including loss of or delay in revenues, failure to meet contracted service-level obligations, material liability claims, failure to maintain market acceptance, injury to our reputation, and increased costs, and could call into question our ability to preserve the security and stability of the internet.

We have developed policies, procedures and standards to identify, protect, detect, respond, and recover from threats posed by cybersecurity risks, and failure to comply with these policies, procedures and standards by our employees or suppliers could limit our ability to effectively manage threats from these cybersecurity risks.

In addition, we must ensure that our employees stay focused on cybersecurity threats especially in remote or hybrid work environment, including during the COVID-19 pandemic, or our ability to effectively manage cybersecurity risks could be impacted.

Our failure to effectively manage these security risks, including insider threats, could result in material harm to our business, including loss of or delay in revenues, failure to meet contracted service level obligations, material liability claims, failure to maintain market acceptance, injury to our reputation, and increased costs, and could call into question our ability to preserve the security and stability of the internet.

Security vulnerabilities in our systems and our vendors’ systems, including vulnerabilities in third party software and hardware, pose a material risk to our operations.

We use externally-developed technology, systems and services, including both hardware and software, for a variety of purposes, including compute, storage, encryption and authentication, back-office support, and other functions.

We have developed policies and procedures to reduce the impact of security vulnerabilities in system components, as well as at any vendors where our data is stored or processed.

We have developed policies, procedures, and standards to reduce the impact of security vulnerabilities in system components, as well as at any vendors where our data is stored or processed.

However, such measures cannot provide absolute security.

While we strive to remediate known vulnerabilities on a timely basis, such vulnerabilities could be exploited before our remediation is effective and if so, could cause systems and service interruptions, data loss and other damages.

Our failure to identify, remediate and mitigate security vulnerabilities, including any potential failure to timely replace and upgrade network equipment, servers, or other technology assets, could result in material harm to our business, including loss of or delay in revenues, failure to meet contracted service-level obligations, material liability claims, failure to maintain market acceptance, injury to our reputation, increased costs, and call into question our ability to preserve the security and stability of the internet.

Our failure to identify, remediate and mitigate security vulnerabilities, including any potential failure to timely replace and upgrade hardware, software, or other technology assets, could result in material harm to our business, including loss of or delay in revenues, failure to meet contracted service level obligations, material liability claims, failure to maintain market acceptance, injury to our reputation, increased costs, and call into question our ability to preserve the security and stability of the internet.

In addition, our networks have been, and likely will continue to be, subject to DDoS attacks.

5 unchanged sentences

We have historically incurred, and will continue to incur, significant costs to enable our infrastructure to process levels of attack traffic that are significant multiples of our normal transaction volume.

We are employing new technologies and new and different services and capabilities to help mitigate DDoS attacks.

We are employing new technologies and new and different

services and capabilities to help mitigate DDoS attacks.

If these new technologies, services and capabilities are not effective, our networks could be disrupted, our response times could increase, our ability to meet our contracted service level obligations could be negatively impacted, and our ability to provide reliable service to our customers and the broader internet community could be impeded.

We do not maintain specific reserves for security breaches, cyber-attacks and DDoS attacks against our systems and the amount of insurance coverage we maintain may be inadequate to cover claims or liabilities relating to such attacks.

We may introduce undetected or unknown defects into our systems or services, which could materially harm our business and harm our vendors or our customers.

6 unchanged sentences

Both route hijacks and route leaks can result in partial or full rerouting of internet traffic for the impacted destinations.

These events, which are beyond our control, could enable an array of attack conditions or service disruptions, and could result in adverse publicity and adversely affect the public’s perception of the security of e-commerce and communications over the internet, as well as of the security or reliability of our services.

These types of events, which are generally beyond our control, could enable an array of attack conditions or service disruptions, and could result in adverse publicity and adversely affect the public’s perception of the security of e-commerce and communications over the internet, as well as of the security or reliability of our services.

To address internet routing system vulnerabilities, many internet service providers are beginning to adopt and apply internet reachability policies based on a system known as the Resource Public Key Infrastructure (“RPKI”) operated by the regional internet registries (“RIRs”).

4 unchanged sentences

A compromise of the RPKI system and related services, or unintentional or unauthorized manipulation of data therein, may also result in other denial of service attack conditions for our infrastructure and services.

The systemic dependencies introduced by RPKI and relying parties of the RPKI system, including network service providers, are outside of our control and are only as secure as the weakest elements of the RPKI system.

The systemic dependencies introduced by RPKI and the relying parties of the RPKI system, including network service providers, are outside of our control, and systems that depend upon the RPKI may be only as secure as the weakest elements of the RPKI system.

We may contract with one or more RIRs to employ RPKI, which carries material operational risks, as described above, as well as material contractual risks, which may expose us to service disruptions and material liability.

5 unchanged sentences

Any of these problems or outages could create potential liability and exposure, including from a failure to meet our contracted service level obligations, and could decrease customer satisfaction, harming our business, or resulting in adverse publicity and damage to our reputation or call into question our ability to preserve the security and stability of the internet.

Our data centers, including the Shared Registration Systems located at our data centers, and our resolution systems are vulnerable to damage or interruption, which could impede our ability to provide our services, expose us to liability, and harm our reputation.

Our data centers, our data center systems, including the Shared Registration Systems located at our data centers, and our resolution systems are vulnerable to damage or interruption, which could impede our ability to provide our services, expose us to material liability, and materially harm our reputation.

Most of the computing infrastructure for our Shared Registration System is located at, and most of our customer information is stored in, our owned data centers.

In 2019, we began expanding some of our data center services to a leased data center facility.

These data centers are vulnerable to damage or interruption, including from fires, earthquakes, hurricanes, floods, power loss, hardware or system failures, physical or electronic break-ins, human error or interference.

These data centers are vulnerable to damage or interruption, including from natural disasters, such as fires, earthquakes, hurricanes, and floods, power loss, hardware or system failures, physical or electronic break-ins, human error or interference.

We are also updating our network architecture in several of our new and existing data centers.

If our data center facilities or the updated

network architecture do not operate as expected, including the ability to quickly switch over between sites, we could experience service interruptions or outages.

If our data center facilities or the updated network architecture do not operate as expected, including the ability to quickly switch over between sites, we could experience service interruptions or outages.

A failure in the operation of our Shared Registration System could result in the inability of one or more registrars to register or manage domain names for a period of time.

If such a registrar has not implemented robust services in a manner that preserves transactions until processed by the registry, then the failure in the operation of our Shared Registration System could result in permanent loss of transactions at the registrar during that period.

A failure in the operation of our Shared Registration System could also impact our ability to provide up-to-date information in our resolution systems, which could result in breaches of our service level obligations pertaining to our resolution services as well as impacting the resolution of domain names on the internet.

A failure in the operation of our Shared Registration System could also impact our ability to provide up-to-date information in our resolution systems, which could result in breaches of our service level obligations pertaining to our resolution services and impact the resolution of domain names on the internet.

Although we carry insurance, we do not carry insurance or designated financial reserves for such interruptions.

1 unchanged sentence

These connections depend upon the secure and efficient operation of internet service providers, internet exchange point operators, and internet backbone service providers.

Such providers have had periodic operational problems or experienced outages in the past beyond our scope of control and may continue to encounter problems and outages or may choose to discontinue their service.

Such providers have encountered periodic operational problems or experienced outages in the past beyond our scope of control and may continue to encounter problems and outages or may choose to discontinue their service.

If the providers that our connections depend upon do not protect, maintain, improve, and reinvest in their networks or present inconsistent data regarding the DNS through their networks, our business could be harmed.

A failure in the operation or update of the root zone servers, the root zone file, the Root Zone Management System, the TLD name servers, or the TLD zone files that we operate, including, for example, the .

gov registry, or other network functions, could result in (1) a DNS resolution or other service outage or degradation, (2) the deletion of one or more TLDs from the internet for a period of time, (3) the deletion of one or more second-level domain names from the internet for a period of time, or (4) a misdirection of a domain name to a different server.

gov registry, or other network functions, could result in, among other problems, (1) a DNS resolution or other service outage or degradation, (2) the deletion of one or more TLDs from the internet, (3) the deletion of one or more second-level domain names from the internet, or (4) a misdirection of one or more domain names to different servers.

A failure in the operation or update of the supporting cryptographic and other operational infrastructure that we maintain could result in similar consequences.

23 unchanged sentences

net Registry Agreement if, upon proper notice, (1) we fail to cure a fundamental and material breach of certain specified obligations, and (2) we fail to timely comply with a final decision of an arbitrator or court.

renewal of these agreements would be upon terms reasonably necessary to render such terms to be similar to the registry agreements for those other gTLDs.

Additionally, each of the .com and .net Registry Agreements provide that if certain terms of these agreements are not similar to such terms generally in effect in the registry agreements of the five largest gTLDs, then a renewal of these agreements would be upon terms reasonably necessary to render such terms to be similar to the registry agreements for those other gTLDs.

Any such terms, if they apply, could be unfavorable to us and have a material adverse impact on our business.

15 unchanged sentences

Our .com Registry Agreement, including its pricing provisions, has faced, and could face in the future, challenges, including possible legal challenges, or challenges under ICANN’s accountability mechanisms, from ICANN, registrars, registrants, and others, and any adverse outcome from these challenges could have a material adverse effect on our business.

Governmental regulation and the application of new and existing laws in the U.S.

and internationally may slow business growth, increase our costs of doing business, create potential liability and have an adverse effect on our business.

Government regulation and the application of new and existing laws in the U.S.

and internationally may slow business growth, increase our costs of doing business, create potential material liability and have a material adverse effect on our business.

Application of new and existing laws and regulations in the U.S.

or internationally to the internet or the domain name industry have imposed and may in the future impose new costs and new restrictions on our business.

Laws and regulations, including those designed to restrict who can register and who can distribute domain names or require registrants to provide additional documentation to register domain names, have, and may in the future, impose significant additional costs on our business and subject us to additional liabilities or could prevent us from operating in certain jurisdictions.

For example, the government of China has indicated that it will issue, and has issued, new regulations, and has begun to enforce existing regulations, that impose additional costs on, and risks to, our provision of registry services in China and could impact the growth or renewal rates of domain name registrations in China.

Laws and regulations, including those designed to restrict who can register and who can distribute domain names or to require registrants to provide additional documentation to register domain names, have, and may in the future, impose significant additional costs on our business and subject us to additional liabilities or could prevent us from operating in certain jurisdictions.

For example, the

government of China has indicated that it will issue, and has issued, new regulations, and has begun to enforce existing regulations, that impose additional costs on, and risks to, our provision of registry services in China and could impact the demand for domain name registrations in China.

Registries, including us, and China-based registrars are also required by some of these regulations to obtain a government-issued license for each TLD operating in China.

Any failure to obtain the required licenses, or to comply with any license requirements or any updates thereto, by us or our China-based registrars could impact our current and future business in China.

In addition, laws have been, and may be in the future, adopted that are designed to restrict counterfeit goods or intellectual property violations such as cybersquatting or that restrict the transfer of data.

Any failure to obtain or renew the required licenses, or to comply with any license requirements or any updates thereto, by us or our China-based registrars could impact our current and future business in China.

In addition, laws have been and may in the future be adopted, that are designed to restrict counterfeit or illegal goods or intellectual property violations such as cybersquatting, prevent on-line abuse, increase access to registrant personal information or that restrict the transfer of data.

The costs of complying or failing to comply with these laws and regulations could limit our ability to operate in our current locations, expose us to compliance costs and substantial liability, and result in costly and time-consuming litigation.

Similarly, the European Union’s General Data Protection Regulation, which greatly increases the jurisdictional reach of European Union law and adds broad new requirements for handling personal data, including the public disclosure of significant data breaches, and significant penalties, became effective in May 2018.

Other countries and other states, such as California with

the California Consumer Privacy Act, have enacted or are enacting data protection laws regulating or limiting the collection, storage, and processing of personal data as well as granting new rights to data subjects.

Other countries, such as China, and other states, such as California with the California Consumer Privacy Act, have enacted or are enacting data protection laws regulating or limiting the collection, storage, and processing of personal data as well as granting new rights to data subjects.

To conduct our operations, we regularly move data across national borders and receive data originating from different jurisdictions, and consequently we are subject to these continuously evolving and developing laws and regulations both in the United States and internationally regarding privacy, data protection and data security.

1 unchanged sentence

These evolving legal, regulatory and compliance frameworks could impose significant costs for us that are likely to increase over time.

In addition, as we market our TLDs in international locations, we are likely to raise our profile in certain foreign countries thereby increasing the regulatory and other scrutiny of our operations.

Any negative developments arising from such increased scrutiny could diminish demand for our domain names, increase our costs of regulatory compliance, affect our reputation, expose us to liability, penalties or fines, force us to change our business practices or otherwise materially harm our business.

Our international operations expose us and our business to additional economic, legal, regulatory and political risks that could have an adverse impact on our revenues and business.

Our international operations expose us and our business to additional economic, legal, regulatory and political risks that could have a material adverse impact on our revenues and business.

A significant portion of our revenues is derived from customers outside the U.S.

31 unchanged sentences

These and future government actions impacting our ability to operate in China may cause our management’s attention to be diverted, our reputation to be damaged, or our business in China to be adversely affected.

Changes in, or interpretations of, tax rules and regulations or our tax positions may adversely affect our income taxes.

Changes in, or interpretations of, tax rules and regulations or our tax positions may materially and adversely affect our income taxes.

We are subject to income taxes in both the U.S.

8 unchanged sentences

Should additional taxes be assessed as a result of an audit or litigation, an adverse effect on our results of operations, financial condition and cash flows in the period or periods for which that determination is made could result.

The Organization for Economic Cooperation and Development (“OECD”) plans to issue a final report that will provide a long-term, multilateral proposal on the taxation of the digital economy.

If this proposal is ultimately agreed to and implemented by the OECD’s member states, there could be significant modifications in the way multinational corporations are taxed.

In addition, some international tax jurisdictions, independent of the OECD, have enacted or may enact new tax regimes aimed at income resulting from digital services.

Although we cannot predict the nature or outcome of such changes or the likelihood of such proposals being adopted throughout the world and tax treaties being modified accordingly, any or all of these changes in tax policy for the digital economy could increase our taxes and adversely impact our financial condition, results of operations and cash flow.

In the U.S., a number of legislative proposals, including the “Build Back Better” bill, are being considered which could impact how multinational corporations are taxed.

In addition, the Organization for Economic Cooperation and Development (“OECD”) plans to issue guidance and a final report that will provide a long-term, multilateral proposal on the taxation of the digital economy.

Similarly, some international tax jurisdictions, independent of the OECD, have enacted or may enact new tax regimes aimed at income resulting from digital services.

Although we cannot predict the nature or outcome of such changes or the likelihood of such legislative proposals being adopted in the U.S.

or throughout the world, any or all of these changes in tax laws could increase our taxes and adversely impact our financial condition and cash flow.

Our business faces risks arising from ICANN’s consensus and temporary policies, technical standards and other processes.

3 unchanged sentences

For example, ICANN has adopted a Consensus Policy that would require us to receive and display registrants’ personal and contact information and designated administrative and technical contact information (“Thick Whois data”) for .com and .

net , although that Policy is undergoing modification by a new Consensus Policy that may make such transfer of Thick Whois data optional.

We can provide no assurances that such a modification will occur or that we would not choose to receive and display Thick Whois data for our .

net registries under it.

The costs of complying or failing to comply with Consensus and Temporary Policies could expose us to compliance costs and substantial liability and exposure, and result in costly and time-consuming investigations or litigation.

net , although that Policy is undergoing modification by a subsequent Consensus Policy that may make such transfer of Thick Whois data to us optional.

We can provide no assurances that such a modification will occur or that we would not choose to or ultimately be required to receive and display Thick Whois data for our .

net registries.

The costs of complying or failing to comply with Consensus and Temporary Policies, particularly the cost of compliance if the .

net registries receive Thick Whois data could expose us to substantial compliance costs, liability and exposure, and result in costly and time-consuming investigations or litigation.

Our Registry Agreements with ICANN require us to implement and comply with various technical standards and specifications published by the Internet Engineering Task Force (“IETF”).

1 unchanged sentence

Any such changes to the IETF standards, or new standards, could have a material adverse effect on our business.

Changes to the multi-stakeholder model of internet governance could materially and adversely impact our business.

Weakening of, or changes to, the multi-stakeholder form of internet governance could materially and adversely impact our business.

The internet is governed under a multi-stakeholder model comprising civil society, the private sector, including for-profit and not-for-profit organizations such as ICANN, governments, including the U.S.

government, academia, non-governmental organizations and international organizations.

If ICANN fails to uphold or significantly redefines the multi-stakeholder model, it could harm our business.

In the fourth quarter of 2016, the U.S.

government completed a transition to the multi-stakeholder community of the historical role played by the National Telecommunications and Information Administration (“NTIA”) in the coordination of the DNS.

Changes arising from this transition to the multi-stakeholder model of internet governance could materially and adversely impact our business.

For example, ICANN has adopted bylaws that are designed, in part, to enhance its accountability through an organization called the Empowered Community, which is comprised of a cross section of stakeholders.

ICANN or the Empowered Community may assert positions that could negatively impact our strategy or our business.

By completing the transition, the U.S.

government through the NTIA has ended its coordination and management of important aspects of the DNS including the IANA functions and the root zone.

If ICANN fails to uphold, or if the multi-stakeholder model is significantly redefined, it could harm our business.

For example, certain governments, governmental organizations, and private actors continue to express dissatisfaction with the multi-stakeholder form of internet governance and have proposed alternatives including oversight by the United Nations or by international treaties.

Furthermore, national legislation has been proposed on topics such as information security and access to personal information that effectively supplants the multi-stakeholder process for policy development in the DNS.

Substantially weakening or replacing the multi-stakeholder form of internet governance could materially harm our business.

In addition, in 2016 the U.S.

government transferred key internet functions to ICANN, who adopted new and enhanced accountability mechanisms in its bylaws such as the creation of the Empowered Community.

There can be no assurance that the removal of the U.S.

government oversight of these key functions will not negatively impact our business.

Claims, lawsuits, audits or investigations in which we are or could become involved may result in adverse outcomes to our business.

government oversight of these key functions, or the changes to ICANN’s bylaws, will not negatively impact our business.

Claims, lawsuits, audits or investigations in which we are or could become involved may result in material adverse outcomes to our business.

We are, and may in the future become, involved in claims, lawsuits, audits and investigations, including intellectual property litigation and infringement claims.

2 unchanged sentences

Adverse outcomes in lawsuits, audits and investigations, could result in significant monetary damages, including indemnification payments, or injunctive relief that could adversely affect our ability to conduct our business, and may have a material adverse effect on our financial condition, results of operations and cash flows.

For example, the current arbitration proceeding against ICANN challenging the validity of ICANN’s award of the .web gTLD to us could adversely affect our ability to operate the .web gTLD.

For example, we are engaged in activities to help mitigate security threats and other forms of DNS abuse in our TLDs and we are involved in community efforts that could increase and expand such activities including potential new contractual obligations.

Such activities include, for example, receiving reports of suspected threats and abuse from appropriate “trusted notifiers” (typically involving national and international law enforcement) and notifying registrars or others of domain names associated with suspected malicious or illegal activity.

Our activities may also include disabling one or more domain names in the TLDs we operate including in response to governmental directives and orders in those jurisdictions in which we operate.

Activities such as these have resulted in, and could in the future result in, significant litigation and could harm our reputation.

Given the inherent uncertainties in litigation, even when we are able to reasonably estimate the amount of possible loss or range of loss and therefore record an aggregate litigation accrual for probable and reasonably estimable loss contingencies, the accrual may change in the future due to new developments or changes in approach.

1 unchanged sentence

Strategic, Business and Operating Risk Factors

The effects of the COVID-19 pandemic have impacted how we operate our business, and the extent to which the effects of the pandemic will impact our business, operations, financial condition and results of operations remains uncertain.

The effects of the COVID-19 pandemic have impacted how we operate our business, and the extent to which the effects of the pandemic will materially impact our business, operations, financial condition and results of operations remains uncertain.

The United States and the global community we serve are facing unprecedented challenges posed by the COVID-19 pandemic.

3 unchanged sentences

• the duration and scope of the pandemic;

• the extent and effectiveness of responsive actions, including the relaxation and re-imposition of orders by authorities and the delivery and administration of vaccines, and the impact of these and other factors on our employees, customers and vendors;

• the extent and effectiveness of responsive actions, including the relaxation and re-imposition of orders by authorities and the delivery and administration of vaccines, including vaccination requirements and mandates by government regulation, and the impact of these and other factors on our employees, customers and vendors;

• the impact of the pandemic on our key personnel and other employees (including the impact of work-from-home arrangements on employee productivity and morale);

6 unchanged sentences

I f we are unable to successfully respond to and manage the impact of the pandemic, and the resulting responses to it, our business, operations, financial condition and results of operations could be adversely impacted, and the impact could be material.

The business environment is highly competitive and, if we do not compete effectively, we may suffer lower demand for our products, reduced gross margins, and loss of market share.

The business environment is highly competitive and, if we do not compete effectively, we may suffer material adverse impact to our business, including lower demand for our products, reduced gross margins, and loss of market share.

We face competition from services that provide an online identity or presence, including other gTLD and ccTLD registries.

1 unchanged sentence

If we do not successfully evolve and demonstrate the value of our services, we may not be able to compete effectively with current or future competitors, and such competitive pressures could materially harm our business.

In addition, competing technologies developed by others or the emergence of new industry standards may adversely affect our competitive position or render our services or technologies

noncompetitive or obsolete.

In addition, competing technologies developed by others or the emergence of new industry standards may adversely affect our competitive position or render our services or technologies noncompetitive or obsolete.

Finally, consolidation within our industry has occurred and is likely to continue to occur.

Our ability to participate and benefit from such consolidations may be limited and consolidation within our industry amongst our competitors could harm our competitive position and adversely impact our business.

Our ability to participate and benefit from such consolidations may be limited and consolidation within our industry among our competitors could harm our competitive position and adversely impact our business.

We have been designated as the registry operator for certain new gTLDs, including certain IDN gTLDs.

2 unchanged sentences

See the “Competition” section in Part I, Item 1 of this Form 10-K for further information.

The evolution of technologies or internet practices and behaviors, the adoption of substitute technologies, or wholesale price increases of our domain names may negatively impact the demand for the domain names for which we are the registry operator.

The growth of technologies, including social media, mobile devices, apps and the dominance of search engines, has evolved and continues to evolve, changing the internet practices and behaviors of consumers and businesses.

The evolution of technologies or internet practices and behaviors, the adoption of substitute technologies, or wholesale price increases of domain names in our TLDs may materially and negatively impact the demand for the domain names for which we are the registry operator.

Technologies relating to online presence, including social media, mobile devices, apps, and search engines, have evolved and continue to evolve, changing the internet practices and behaviors of consumers and businesses.

These ongoing changes can negatively impact the demand for our domain names.

2 unchanged sentences

Technology changes to web browser or internet search technologies could reduce demand for domain names.

Similarly, if internet users’ preferences or practices shift away from recognizing and relying on web addresses or if internet users were to significantly decrease the use of web browsers in favor of applications to locate and access content demand for our domain names could be negatively impacted.

Demand for our domain names could be negatively impacted by new technologies that significantly decrease the use of domain names to develop and protect an online identity.

New technologies that encourage internet users to expand the use of third-level domains or alternate identifiers, such as identifiers from social networking, e-commerce platforms and microblogging sites, could also negatively impact the demand for our domain names.

In addition, demand for domain names in our TLDs could be impacted by alternative TLDs that are operated outside the single authoritative root zone have been and continue to be proposed, for example, as part of certain blockchain namespace systems.

To the extent that web browsers, applications, registrars and DNS resolvers recognize and support such TLDs, and that internet users are able to perform online operations with such TLDs, demand for domain names in TLDs in the single authoritative root zone, including our TLDs, could be negatively impacted.

Some registrars and registrants seek to purchase and resell domain names at an increased price.

Adverse changes in the resale value of domain names, changes in the business models for such domain name registrars and registrants, or other factors, including regulations limiting the resale of domain names, could result in a decrease in the demand and/or renewal rates for domain names in our TLDs.

Similarly, if internet users’ preferences or practices shift away from recognizing and relying on web addresses or if internet users were to significantly decrease the use of web browsers in favor of applications to locate and access content, demand for domain names in our TLDs could be negatively impacted.

Demand for domain names in our TLDs could be negatively impacted by new technologies that significantly decrease the use of traditional domain names to present and protect an online identity.

In addition, the demand for domain names in our TLDs could be impacted by alternative namespaces with domain-name-like identifiers that are operated outside the single authoritative DNS root zone, including, for example, blockchain namespaces.

To the extent that web browsers, applications, DNS registrars and DNS resolvers recognize and support such namespaces, and that internet users are able to perform online operations with identifiers from such namespaces, demand for domain names in TLDs in the single authoritative DNS root zone, including our TLDs, could be negatively impacted.

Some registrars and registrants purchase and resell domain names at an increased price.

Adverse changes in the resale value of domain names, changes in the business models for such domain name registrars and registrants, or other factors,

including regulations limiting the resale of domain names, could result in a decrease in the demand and/or renewal rates for domain names in our TLDs.

Some registrars and registrants seek to generate revenues by registering domain names specifically for website advertising.

Changes in the way these registrars and registrants are compensated (including changes in methodologies and metrics) by advertisers and advertisement placement networks, such as Google, Yahoo!, Baidu and Bing, have adversely affected, and may continue to adversely affect the market for domain names used for this purpose, which has resulted in, and may continue to result in, a decrease in demand and/or the renewal rate for such domain names.

Changes in the way these registrars and registrants are compensated (including changes in methodologies and metrics) by advertisers and advertisement placement networks, such as Google, Baidu and Bing, have adversely affected, and may continue to adversely affect the market for domain names used for this purpose, which has resulted in, and may continue to result in, a decrease in demand and/or the renewal rate for such domain names.

In addition, if spending on online advertising and marketing is reduced, this may result in a further decline in the demand for domain names used for this purpose.

Under the terms of the .com Registry Agreement, as amended, we may increase the annual fee of each .com domain name registration or renewal by up to 7% over the previous year in each of the final four years of each six-year period.

To the extent we increase wholesale prices, there could be a decrease in the demand and/or renewal rates for .com domain names.

If we fail to expand our services into developing and emerging economies in foreign locations, our business may not grow.

We seek to serve many new, developing and emerging economies in foreign locations to grow our business.

Under the terms of the .com and .net Registry Agreements, as amended, we are permitted to increase the annual fee of each .com and .net domain name registration or renewal according to the provisions in these agreements.

To the extent we increase our prices, there could be a decrease in the demand and/or renewal rates for .com or .net domain names.

If we fail to expand our services into developing and emerging economies in international locations, our business may not grow.

We seek to serve many new, developing and emerging economies in international locations to grow our business.

These economies are rapidly evolving and may not grow or even if they do grow, our services may not be widely used or accepted there.

6 unchanged sentences

• the introduction and consumer acceptance of new generations of mobile devices, and in particular, the use of mobile applications as the primary engagement mechanism for navigating the internet;

• government regulations affecting the internet, internet access and availability, domain name registrations or the provision of registry services, data security or data localization, e-commerce or telecommunications.

• government regulations affecting the internet, internet access and availability, domain name registrations or the provision of registry services, data security, privacy, or data localization, e-commerce or telecommunications.

If our services are not widely accepted or adopted in these locations, our business may not grow.

3 unchanged sentences

Consolidation in the registrar or reseller industry or changes in ownership, management, or strategy among individual registrars or resellers, including vertical integration by registrar or reseller industry participants, could result in significant changes to their businesses, operating models, and cost structures.

These changes could include reduced marketing efforts or other operational changes that could adversely impact the demand and/or the renewal rates for the domain names for which we are the registry operator.

These changes could include reduced marketing efforts for our TLDs or other operational changes that could adversely impact the demand and/or the renewal rates for the domain names for which we are the registry operator.

With the introduction of new gTLDs, many of our registrars and resellers have chosen to, and may continue to choose to, focus their short- or long-term marketing efforts on these new offerings and/or reduce the prominence or visibility of our products and services on their e-commerce platforms.

4 unchanged sentences

If we are unable to keep a significant portion of their marketing efforts focused on selling registrations of domain names in our TLDs, as opposed to other competing TLDs, including the new gTLDs, or their own services, our business could be harmed.

We depend on highly skilled employees to maintain and provide innovative solutions for our business, and our business could be harmed if we are not able to attract and retain such qualified talent.

We depend on highly skilled employees to maintain and provide innovative solutions for our business, and our business could be materially harmed if we are not able to attract and retain such qualified talent.

Our business is highly technical and requires individuals skilled and knowledgeable in unique technologies, configurations, operating systems, and software development tools.

We depend on the knowledge, experience, and performance of our highly skilled employees and leaders to effectively manage and provide innovative solutions for our business.

We depend on the knowledge, experience, and performance of these employees and leaders to effectively manage and provide innovative solutions for our business.

For example, we require employees with expertise in DNS operations and with certain cybersecurity specialties.

Because such employees are in high demand by our competitors and other companies, we must be able to attract, integrate, retain and motivate such highly skilled employees and leaders, and we must implement succession plans for these employees, or our business could be harmed.

Because such employees are in high demand by our competitors and other companies, we must be able to attract, integrate, retain and motivate such highly skilled employees and leaders.

In addition, we must effectively manage our transition to a post-pandemic work environment to attract and retain these employees to meet our business needs.

Failure to attract and retain such employees and to effectively implement succession plans for these employees could harm our business.

Intellectual Property Risk Factors

We rely on our intellectual property rights to protect our proprietary assets, and any failure by us to protect or enforce, or any misappropriation of, our intellectual property could harm our business.

Our success depends in part on our internally developed technologies and related intellectual property.

8 unchanged sentences

In the future, we may have to resort to litigation to enforce and protect our intellectual property rights, to protect our trade secrets or to determine the validity and scope of the proprietary rights of others.

This type of litigation is inherently unpredictable and, regardless of its outcome, could result in substantial costs and diversion of management attention and

technical resources.

This type of litigation is inherently unpredictable and, regardless of its outcome, could result in substantial costs and diversion of management attention and technical resources.

Some of the software and protocols used in our business are based on standards set by standards setting organizations such as the IETF.

3 unchanged sentences

The loss of, or our inability to obtain or maintain, any of these technology licenses could hinder or increase the cost of our services, launching new products and services, entering into new markets and/or otherwise harm our business.

Some of the software and protocols used in our business are in the public domain or may otherwise become publicly available, which means that such software and protocols are equally available to our competitors.

Some of the software and protocols used in our business are in the public domain or may otherwise become publicly available, which means that such software and protocols are or may become equally available to our competitors.

We rely on the strength of our Verisign brand to help differentiate Verisign in the marketing of our products.

3 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors