What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2024-02-15 compared with 2023-02-17 · 65 added, 58 removed, 244 unchanged (34% of the section changed)

13 unchanged sentences

We have developed policies, standards, and procedures to identify, protect, detect, respond, and recover from threats posed by cybersecurity risks, and failure to comply with these policies, standards, and procedures by our employees or suppliers could limit our ability to effectively manage threats from these cybersecurity risks.

In addition, we must ensure that our employees stay focused on cybersecurity threats especially in our hybrid work environment, or our ability to effectively manage cybersecurity risks could be impacted.

In addition, we must ensure that our employees stay focused on protecting the Company against cybersecurity threats especially in our hybrid work environment, or our ability to effectively manage cybersecurity risks could be impacted.

Our failure to effectively manage these security risks, including insider threats, could result in material harm to our business, including loss of or delay in revenues, failure to meet service level agreements, material liability claims, failure to maintain market acceptance, injury to our reputation, and increased costs, and could call into question our ability to preserve the security and stability of the internet.

3 unchanged sentences

However, such measures cannot provide absolute security.

While we strive to remediate known vulnerabilities on a timely basis, such vulnerabilities could be exploited before our remediation is effective and if so, could cause systems and service interruptions, data loss and other damages.

While we strive to remediate known vulnerabilities on a timely basis, such vulnerabilities could be exploited before a vulnerability has been disclosed or before our remediation is effective and if so, could cause systems and service interruptions, data loss and other damages.

Our failure to identify, remediate and mitigate security vulnerabilities, including any potential failure to timely replace and upgrade hardware, software, or other technology assets, could result in material harm to our business, including loss of or delay in revenues, failure to meet service level agreements, material liability claims, failure to maintain market acceptance, injury to our reputation, increased costs, and call into question our ability to preserve the security and stability of the internet.

9 unchanged sentences

The number of such attacks is increasing.

Recent advances in artificial intelligence have increased the sophistication of these types of attacks as attackers are able to create more personalized and targeted communications using information derived from people’s relationships, online behavior and preferences.

Social engineering attacks have occurred in concert with ransomware attacks.

18 unchanged sentences

A compromise of the RPKI system and related services, or unintentional or unauthorized manipulation of data therein, may also result in other denial of service attack conditions for our infrastructure and services.

The systemic dependencies introduced by RPKI and the relying parties of the RPKI system, including network service providers, are outside of our control, and systems that depend upon the RPKI may be only as secure as the weakest elements of the RPKI system.

The systemic dependencies introduced by the RPKI system and by the relying parties of the RPKI system, including internet service providers, are outside of our control, and systems that depend upon the RPKI may be only as secure as the weakest elements of the RPKI system.

Contracting with RIRs for the provision of and access to RPKI services carries material operational risks, as described above, as well as material contractual risks, which may expose us to service disruptions and material liability.

We could encounter system interruptions or systems failures resulting from activities beyond our direct control that could materially harm our business.

We depend on the uninterrupted operation of our various systems, secure data centers, and other computer and communication networks.

We depend on the uninterrupted operation of our various systems, secure data centers, points of presence around the world and other computer and communication networks.

Our systems and operations are vulnerable to damage or interruption from power loss, transmission cable cuts and other telecommunications failures, damage or interruption caused by fire, earthquake, and other natural disasters, intentional acts of vandalism, terrorist attacks, unintentional mistakes, or errors.

1 unchanged sentence

We are also subject to the risk of state suppression of internet operations.

Any of these problems or outages could create potential liability and exposure, including from a failure to meet our service level agreements, and could decrease customer satisfaction, harming our business, or resulting in adverse publicity and damage to our reputation or call into question our ability to preserve the security and stability of the internet.

Any of these scenarios could create potential liability and exposure, including from a failure to meet our service level agreements, and could decrease customer satisfaction, harming our business, or resulting in adverse publicity and damage to our reputation or call into question our ability to preserve the security and stability of the internet.

Our data centers, our data center systems, including the Shared Registration Systems located at our data centers, and our resolution systems are vulnerable to damage or interruption, which could impede our ability to provide our services, expose us to material liability, and materially harm our reputation.

2 unchanged sentences

These data centers are vulnerable to damage or interruption, including from natural disasters, such as fires, earthquakes, hurricanes, and floods, power loss, hardware or system failures, physical or electronic break-ins, human error or interference.

We are also updating our network architecture in several of our new and existing data centers.

If our data center facilities or the updated network architecture do not operate as expected, including the ability to quickly switch over between sites, we could experience service interruptions or outages.

We are also regularly updating and enhancing our network architecture in several of our new and existing data centers and globally distributed resolution systems.

If our data center facilities or the updated network architectures, hardware or software upgrades, or security controls do not operate as expected, including the ability to quickly switch over between sites, we could experience service interruptions or outages.

A failure in the operation of our Shared Registration System could result in the inability of one or more registrars to register or manage domain names for a period of time.

If such a registrar has not implemented robust services in a manner that preserves transactions until processed by the registry, then the failure in the operation of our Shared Registration System could result in permanent loss of transactions at the registrar during that period.

A failure in the operation of our Shared Registration System could also impact our ability to provide up-to-date information in our resolution systems, which could result in breaches of our service level agreements pertaining to our resolution services and impact the resolution of domain names on the internet.

Although we carry insurance, we do not carry insurance or designated financial reserves for such interruptions.

In addition, our services depend on the secure and efficient operation of the internet connections to and from customers to our Shared Registration System residing in our secure data centers.

A failure in the operation of our Shared Registration System could also impact our ability to provide up-to-date information in our globally distributed resolution systems, which could result in breaches of our service level agreements pertaining to our resolution services and impact the resolution of domain names on the internet.

We do not carry insurance or designated financial reserves for such interruptions.

In addition, our services depend on the secure and efficient operation of the internet connections to and from customers to our Shared Registration System residing in our secure data centers as well as our globally distributed resolution systems.

These connections depend upon the secure and efficient operation of internet service providers, internet exchange point operators, and internet backbone service providers.

Such providers have encountered periodic operational problems or experienced outages in the past beyond our scope of control and may continue to encounter problems and outages or may choose to discontinue their service.

If the providers that our connections depend upon do not protect, maintain, improve, and reinvest in their networks or present inconsistent, incorrect, or invalid data regarding DNS responses through their networks, our business could be harmed.

If the providers that our connections depend upon do not protect, maintain, improve, and reinvest in their networks or present inconsistent, incorrect, or invalid data regarding routing information or DNS responses through their networks, our business could be harmed.

A failure in the operation or update of the root zone servers, the root zone file, the Root Zone Management System, the TLD name servers, the TLD zone files that we operate, or other network functions, could result in, among other problems, (1) a DNS resolution or other service outage or degradation, (2) the deletion of one or more gTLDs or ccTLDs from the internet, (3) the deletion of one or more second-level domain names from the internet, or (4) a misdirection of one or more domain names to different servers.

1 unchanged sentence

Any of these problems or outages could create potential material liability and exposure from litigation and investigations, could result in a failure to meet our service level agreements, and could decrease customer satisfaction, harming our business.

These problems could also result in adverse publicity, decrease the public’s trust in the security of e-commerce, or call into question our ability to preserve the security and stability of the internet.

These problems could also result in adverse publicity, decrease the public’s trust in the security of e-commerce and other forms of online presence, or call into question our ability to preserve the security and stability of the internet.

We retain certain customer and employee information in our data centers and various domain name registration systems.

Any physical or electronic break-in or other security breach or compromise of the information stored at our data centers or domain name registration systems may jeopardize the security of information we retain or that is retained in the computer systems and networks of our customers.

In such an event, we could face material liability and exposure from litigation and investigations, fail to meet service level agreements, or be at risk for loss of various security and standards-based compliance certifications needed for operation of our businesses, and customers could be reluctant to use our services, any of which could also adversely affect our reputation and harm our business or cause financial losses that are either not insured against or not fully covered through any insurance.

In such an event, we could face material liability and exposure from litigation and investigations, fail to meet service level agreements, or be at risk of losing various security and standards-based compliance certifications needed for operation of our businesses, and customers could be reluctant to use our services.

Any such outcomes could also adversely affect our reputation and harm our business or cause financial losses that are either not insured against or not fully covered through any insurance.

We face risks from the operation of the root server system and our performance of the Root Zone Maintainer functions under the RZMA.

3 unchanged sentences

In this role, we provision and publish the authoritative root zone data and make it available to all root server operators under the RZMA with ICANN.

If we make errors in the publication of the root zone, we may be subject to material claims challenging the RZMA or our performance under it, including tort claims, and we may not have immunity from, or sufficient indemnification or insurance for, such claims.

If we make errors in the publication of the root zone or experience operational issues that impact the timeliness of updates to the root zone data, we may be subject to material claims challenging the RZMA or our performance under it, including tort claims, and we may not have immunity from, or sufficient indemnification or insurance for, such claims.

Economic and Competition Risk Factors

Deterioration of economic conditions, particularly in China, continues to negatively impact our business.

Our business is, and will likely continue to be, adversely affected by the deterioration in global economic conditions, including high inflation, interest rates, and currency fluctuations, as well as impacts from war, civil unrest, and other political and economic developments.

In particular, these conditions are negatively impacting our business in China, where demand for our services has substantially declined due to worsening economic conditions within China and from Chinese regulatory mandates that make it more difficult to register a domain name or establish an online presence using a domain name.

The overall economic impact, severity and duration of these conditions, as well as the timing, strength, and sustainability of any recovery, are not known at this time, and are not within the Company’s control.

The business environment is highly competitive and, if we do not compete effectively, we may suffer material adverse impact to our business, including lower demand for our products, reduced gross margins, and loss of market share.

We face competition from services that provide an online identity or presence, including other gTLDs and ccTLDs.

In order to remain competitive, we must continually demonstrate the security, stability, and resiliency of our services and must adopt and support new technologies to adapt our services to changing technologies, market conditions, and our customers’ and internet users’ preferences and practices.

Also to remain competitive, we have undertaken important initiatives such as our efforts to acquire the .web gTLD, and we may in the future undertake other important initiatives.

Any of these initiatives require significant resources, can subject us to regulatory scrutiny and/or negative publicity, and divert management attention from our existing business.

Such undertakings, including our efforts to acquire the .web gTLD, may be unsuccessful and costly.

In addition, competing technologies developed by others or the emergence of new industry standards may adversely affect our competitive position or render our services or technologies noncompetitive or obsolete.

Finally, consolidation within our industry has occurred and is likely to continue to occur.

Our ability to participate and benefit from such consolidations may be limited and consolidation within our industry among our competitors could harm our competitive position and adversely impact our business.

We have been designated as the registry operator for certain new gTLDs, including certain IDN gTLDs.

Our new gTLDs may not be as or more successful than the new gTLDs obtained by our competitors.

In addition, our new gTLDs may face additional universal acceptance and usability challenges and it is possible that resolution of domain names within some of these new gTLDs may be blocked within certain state or organizational environments, challenging universal resolvability of these domain names and their general acceptance and usability.

See the “Competition” section in Part I, Item 1 of this Form 10-K for further information.

Contractual, Regulatory, Legal and Compliance Risk Factors

11 unchanged sentences

net Registry Agreement if, upon proper notice, (1) we fail to cure a fundamental and material breach of certain specified obligations, and (2) we fail to timely comply with a final decision of an arbitrator or court.

Additionally, each of the .com and .net Registry Agreements provide that if certain terms of these agreements are not similar to such terms generally in effect in the registry agreements of the five largest gTLDs, then a renewal of these agreements would be upon terms reasonably necessary to render such terms to be similar to the registry agreements for those other gTLDs.

agreements for those other gTLDs.

Any such terms, if they apply, could be unfavorable to us and have a material adverse impact on our business.

7 unchanged sentences

Under the terms of the .com Registry Agreement, we may increase the annual fee of each .com domain name registration or renewal by up to 7% over the previous year in each of the final four years of each six-year period.

We can provide no assurance that we will exercise such right to increase the annual fee.

In addition to this contractual right, we are entitled to increase the annual fee of each .com domain name registration or renewal by up to 7% due to the imposition of any new specifications or policies adopted by ICANN pursuant to the procedures set forth in its bylaws and due process (“Consensus Policies”) or documented extraordinary expense resulting from an attack or threat of attack on the security and stability of the DNS (an “Extraordinary Expense”).

We can provide no assurances that we will exercise such right to increase the annual fee.

In addition to this contractual right, we are entitled to increase the annual fee of each .com domain name registration or renewal by up to 7% due to the imposition of any new specifications or policies adopted by ICANN pursuant to the procedures set forth in its bylaws and due process (“Consensus Policies”) or to a documented extraordinary expense resulting from an attack or threat of attack on the security and stability of the DNS (an “Extraordinary Expense”).

In addition, our ability to increase the price for .com domain name registrations and renewals due to a Consensus Policy or Extraordinary Expense may occur only in years in which we do not increase the price for .com domain name registrations and renewals as described above.

It is uncertain whether circumstances would arise that would permit us to take a price increase due to a Consensus Policy or Extraordinary Expense, or if they do, whether we would seek to increase the price for .com domain name registrations for this reason.

A failure to seek and obtain a price increase due to a Consensus Policy or Extraordinary Expense, when available, could negatively affect our operating results.

A failure to seek and obtain a price increase due to a Consensus Policy or Extraordinary Expense, when applicable, could negatively affect our operating results.

We also have the right under the Cooperative Agreement to seek the removal of these pricing restrictions on the .com gTLD if we demonstrate to the DOC that market conditions no longer warrant these restrictions.

6 unchanged sentences

Laws and regulations, including those designed to restrict who can register and who can distribute domain names or to require registrants to provide additional documentation to register domain names, have, and may in the future, impose significant additional costs on our business and subject us to additional liabilities or could prevent us from operating in certain jurisdictions.

For example, the government of China has indicated that it will issue, and has issued, new regulations, and has begun to enforce existing regulations, that impose additional costs on, and risks to, our provision of registry services in China and could impact the demand for domain name registrations in China.

Registries, including us, and China-based registrars are also required by some of these regulations to obtain a government-issued license for each gTLD or ccTLD operating in China.

Any failure to obtain or renew the required licenses, or to comply with any license requirements or any updates thereto, by us or our China-based registrars could impact our current and future business in China.

For example, the government of China has indicated that it will issue, and has issued, new regulations, and it has begun to enforce existing regulations differently, including by directing certain implementation models for registry services, that impose additional costs on, and risks to, our provision of registry services in China.

These regulations are impacting the demand for domain name registrations in China.

These regulations require registries, including us, and China-based registrars, to obtain a government-issued license for each gTLD or ccTLD operating in China.

Any failure to obtain or renew the required licenses, or to comply with any license requirements or any updates thereto, or any failure to comply with these regulations or directives, by us or our China-based registrars, could result in significant harm to our business in China including the suspension of some or all of our registry services in China.

We are also subject to changing laws and regulations that impact whether, how, and under what circumstances we may transfer, process and/or receive certain data that is critical to our operations, including data shared between countries or regions in which we operate and data shared among our products and services.

For example, following the invalidation of the U.S.-EU Safe Harbor by the European Court of Justice (“EUCJ”) in 2015, the European Union and United States agreed to an alternative framework for data transferred from the European Union to the United States, called Privacy Shield.

In 2018, Privacy Shield was also invalidated by the EUCJ.

In 2018, Privacy Shield

was also invalidated by the EUCJ.

In 2022, the United States and European Union announced a new, but undefined data transfer framework, which once finalized, also could be subject to further legal challenges.

New laws, regulations, directives or ICANN polices that require us to obtain and maintain personal information of registrants of domain names in the .com and .net gTLDs could impose material compliance costs and could create new, material legal and others risks to our business.

If we are required to, or choose to, obtain and maintain personal information of registrants of domain names in the .com and .net gTLDs we could be required to incur significant compliance and legal costs as a result of GDPR and other similar regulations.

New laws, regulations, directives or ICANN polices that require us to obtain and maintain personal information of registrants of domain names in the .

net gTLDs could impose material compliance costs and could create new, material legal and others risks to our business.

If we are required to, or choose to, obtain and maintain personal information of registrants of domain names in the .

net gTLDs we could be required to incur significant compliance and legal costs as a result of GDPR and other similar regulations.

For example, we could incur material costs to protect such information from unauthorized disclosure and, under GDPR, to ensure authorized disclosures are permitted.

Failure to properly protect such information, or failure to comply with GDPR, could expose the Company to material costs and penalties.

In addition, new obligations to obtain and maintain personal information of registrants in the .com and .net gTLDs could conflict with certain laws and regulations that may require such personal information be maintained solely within the jurisdiction of the data subject.

In addition, new obligations to obtain and maintain personal information of registrants in the .

net gTLDs could conflict with certain laws and regulations that may require such personal information be maintained solely within the jurisdiction of the data subject.

In addition, any such new obligations could increase the cost and risks associated with complying with regulations that require verification of registrant personal information, including for purposes of complying with the economic and trade sanctions programs administered by the Office of Foreign Assets Control (“OFAC”).

10 unchanged sentences

There can be no assurance that our employees, contractors and agents will not take actions in violation of such policies, procedures, laws and/or regulations.

the importation or exportation of our products and services and could have a material adverse effect on our business.

Violations of laws, regulations or internal policies and procedures by our employees, contractors or agents could result in financial reporting problems, investigations, fines, penalties, or prohibition on the importation or exportation of our products and services and could have a material adverse effect on our business.

In addition, we face risks inherent in doing business internationally, including:

12 unchanged sentences

government data collection policies.

Escalating political tensions between the United States and China in particular may pose additional risks to our business in China.

In 2020 and 2021, the U.S.

government announced restrictions on trading with certain Chinese companies.

The Chinese government subsequently announced actions that, if implemented, could impose additional restrictions on the Chinese operations of non-Chinese companies.

These and future government actions impacting our ability to operate in China may cause our management’s attention to be diverted, our reputation to be damaged, or our business in China to be adversely affected.

Political tensions between the United States and China in particular may pose additional risks to our business in China.

government has imposed restrictions on certain Chinese companies and on trading in certain technologies.

The Chinese government has announced actions that, if implemented, could impose additional restrictions on the operations of non-Chinese companies in China.

These and future government actions could impact our ability to operate in China and may cause our management’s attention to be diverted, our reputation to be damaged, or our business in China to be adversely affected.

Changes in, or interpretations of, tax rules and regulations or our tax positions may materially and adversely affect our income taxes.

10 unchanged sentences

The Organization for Economic Cooperation and Development (“OECD”) continues to issue guidance that will provide a long-term, multilateral proposal on the taxation of the digital economy.

Certain countries have enacted and other countries may enact legislation based on the OECD’s guidance that could impact the taxation of the digital economy.

Similarly, some international tax jurisdictions, independent of the OECD, have enacted or may enact new tax regimes aimed at income resulting from digital services.

6 unchanged sentences

Our Registry Agreements with ICANN require us to implement and comply with various technical standards and specifications published by the Internet Engineering Task Force (“IETF”).

ICANN could impose requirements on us through changes to these IETF standards, or new standards, that are inconsistent with our current or future plans, that impose substantial

costs on our business, that subject the Company to additional legal risks, or that affect our competitive position.

ICANN could impose requirements on us through changes to these IETF standards, or new standards, that are inconsistent with our current or future plans, that impose substantial costs on our business, that subject the Company to additional legal risks, or that affect our competitive position.

Any such changes to the IETF standards, or new standards, could have a material adverse effect on our business.

14 unchanged sentences

In addition, proceedings that we initially view as immaterial could prove to be material.

Adverse outcomes in lawsuits, audits and investigations, could result in significant monetary damages, including indemnification payments, or injunctive relief that could adversely affect our ability to conduct our business, and may have a material adverse effect on our financial condition, results of operations and cash flows.

Adverse outcomes in

lawsuits, audits and investigations, could result in significant monetary damages, including indemnification payments, or injunctive relief that could adversely affect our ability to conduct our business, and may have a material adverse effect on our financial condition, results of operations and cash flows.

For example, we are engaged in activities to help mitigate security threats and other forms of DNS abuse in the gTLDs and ccTLDs we operate and we are involved in community efforts that could increase and expand such activities including potential new contractual obligations.

5 unchanged sentences

Strategic, Business and Operating Risk Factors

Deterioration of economic conditions could materially harm our business.

Our business is, and could continue to be, adversely affected by the deterioration in national or global economic conditions, including high inflation rates, increasing interest rates, disruption in the supply chain, and currency fluctuations, resulting from the continuing economic effects of the COVID-19 pandemic, war and civil unrest, and other political and economic developments.

The severity and duration of a these economic conditions, as well as the timing, strength, and sustainability of any recovery, are unknown and are not within the Company’s control.

We face competition from services that provide an online identity or presence, including other gTLDs and ccTLDs.

Also to remain competitive, we have undertaken important initiatives such as our efforts to acquire the .web gTLD, and we may in the future undertake other important initiatives.

Any of these initiatives require significant resources, can subject us to regulatory scrutiny and/or negative publicity, and divert management attention from our existing business.

Such undertakings, including our efforts to acquire the .web gTLD, may be unsuccessful and costly.

Finally, consolidation within our

industry has occurred and is likely to continue to occur.

We have been designated as the registry operator for certain new gTLDs, including certain IDN gTLDs.

Our new gTLDs may not be as or more successful than the new gTLDs obtained by our competitors.

In addition, our new gTLDs may face additional universal acceptance and usability challenges and it is possible that resolution of domain names within some of these new gTLDs may be blocked within certain state or organizational environments, challenging universal resolvability of these strings and their general acceptance and usability.

See the “Competition” section in Part I, Item 1 of this Form 10-K for further information.

The evolution of technologies or internet practices and behaviors, the adoption of substitute technologies, or wholesale price increases of domain names in the gTLDs we operate may materially and negatively impact the demand for the domain names for which we are the registry operator.

6 unchanged sentences

Demand for domain names in the gTLDs we operate could be negatively impacted by new technologies that significantly decrease the use of traditional domain names to present and protect an online identity.

New technologies that encourage internet users to expand the use of third-level domains or alternate identifiers, such as identifiers from social networking, e-commerce platforms and microblogging sites, could also negatively impact the demand for domain names in the gTLDs we operate.

New technologies that encourage internet users to expand the use of third-level domains or alternative identifiers, such as identifiers from social networking, e-commerce platforms and microblogging sites, could also negatively impact the demand for domain names in the gTLDs we operate.

In addition, the demand for domain names in the gTLDs we operate could be impacted by alternative namespaces with domain-name-like identifiers that are operated outside the single authoritative DNS root zone, including blockchain namespaces.

To the extent that web browsers, applications, DNS registrars and DNS resolvers recognize and support such namespaces, and that internet users are able to perform online operations with identifiers from such namespaces, demand for domain names in gTLDs and ccTLDs in the single authoritative DNS root zone, including the gTLDs we operate, could be negatively impacted.

To the extent that alternative namespaces introduce user confusion about the relationship between identical or similar-looking identifiers in these namespaces and domain names in the DNS, demand for domain names and user confidence in the value of domain names as unique identifiers could also be negatively impacted.

Some registrars and registrants purchase and resell domain names at an increased price in a secondary market.

38 unchanged sentences

Despite our precautions, it may be possible for an external party to copy or otherwise obtain and use our intellectual property without authorization.

Furthermore, the laws of other countries may not protect our proprietary rights in those countries to the same extent U.S.

Furthermore, the laws of other countries may not protect our proprietary rights in those countries to the same

law protects these rights in the U.S.

7 unchanged sentences

Some of the software and protocols used in our business are based on standards set by standards setting organizations such as the IETF.

To the extent any of our patents are considered “standards essential patents,” in some cases we

may be required to license such patents to our competitors on reasonable and non-discriminatory terms or otherwise be limited in our ability to assert such patents.

To the extent any of our patents are considered “standards essential patents,” in some cases we may be required to license such patents to our competitors on reasonable and non-discriminatory terms or otherwise be limited in our ability to assert such patents.

We also license externally developed technology that is used in some of our products and services to perform key functions.

2 unchanged sentences

Some of the software and protocols used in our business are in the public domain or may otherwise become publicly available, which means that such software and protocols are or may become equally available to our competitors.

We rely on the strength of our Verisign brand to help differentiate Verisign in the marketing of our products.

We rely on the strength of our Verisign brand to help differentiate our products.

Dilution of the strength of our brand could harm our business.

We are at risk that we will be unable to fully register, build equity in, or enforce the Verisign logo in all markets where Verisign products and services are sold.

UNRESOLVED STAFF COMMENTS

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors