TripAdvisor 2013 Annual Report Download - page 39

delays in internal systems, or systems of third parties that we rely upon including multiple co-location providers
for data centers and network access, or deterioration in the performance of any such systems, would impair our
ability to process transactions or display content and decrease the quality of the services we offer to travelers and
users. These interruptions could include security intrusions and attacks on our systems for fraud or service
interruption (called “denial of service” or “bot” attacks). If we were to experience frequent or persistent system
failures, our business, reputations and brand could be harmed.
In addition, we lack backup systems or contingency plans for certain critical aspects of our operations or
business processes. Many other systems are not fully redundant and their disaster recovery or business continuity
planning may not be sufficient. Fire, flood, power loss, telecommunications failure, break-ins, earthquakes, acts
of war or terrorism, acts of God, computer viruses, electronic intrusion attempts from both external and internal
sources and similar events or disruptions may damage or impact or interrupt computer or communications
systems or business processes at any time. Although we have put measures in place to protect certain portions of
our facilities and assets, any of these events could cause system interruption, delays and loss of critical data, and
could prevent us from providing content and services to users, travelers and/or third parties for a significant
period of time. Remediation may be costly and we may not have adequate insurance to cover such costs.
Moreover, the costs of enhancing infrastructure to attain improved stability and redundancy may be time
consuming and expensive and may require resources and expertise that are difficult to obtain.
Our processing, storage and use personal information and other data exposes us to risks stemming external
and internal security breaches and failure to comply with governmental regulation, which could give rise to
liabilities.
There are numerous laws regarding privacy and the storing, sharing, use, processing, disclosure and
protection of personal information and other consumer data, the scope of which are changing, subject to differing
interpretations, and may be inconsistent between countries or conflict with other rules. We strive to comply with
all applicable laws, policies, legal obligations and industry codes of conduct relating to privacy and data
protection. Any failure or perceived failure by us to comply with our privacy policies, privacy-related obligations
to users or other third parties, or privacy-related legal obligations, or any compromise of security that results in
the unauthorized release or transfer of personally identifiable information or other user data, may result in
governmental enforcement actions, litigation or public statements that could harm our reputation and cause our
customers and members to lose trust in us, which could have an adverse effect on our business, brand, market
share and results of operations.
The regulatory framework for privacy issues worldwide is currently in flux and is likely to remain so for the
foreseeable future. Practices regarding the collection, use, storage, transmission and security of personal
information by companies operating over the Internet have recently come under increased public scrutiny. The
U.S. Congress and federal agencies, including the Federal Trade Commission and the Department of Commerce,
are reviewing the need for greater regulation for the collection and use of information concerning consumer
behavior on the Internet. U.S. courts are also considering the applicability of existing federal and state statutes,
including computer trespass and wiretapping laws, to the collection and exchange of information online. In
addition, the European Union is in the process of proposing reforms to its existing data protection legal
framework, which may result in a greater compliance burden for companies, including us, with users in Europe
and increased costs of compliance.
Potential security breaches to our systems, whether resulting from internal or external sources, could
significantly harm our business. A party, whether internal or external, that is able to circumvent our security
systems could misappropriate user information or proprietary information or cause significant interruptions in
our operations. In the past, we have experienced “denial-of-service” type attacks on our systems that have made
portions of our websites unavailable for short periods of time as well as unauthorized access of our systems and
data. We may need to expend significant resources to protect against security breaches or to address problems
29