VMware 2015 Annual Report Download - page 17

TableofContents
• defectsandsecurityvulnerabilitiescouldbeexploitedorintroducedintooursoftwareproductsorourhybridcloudandSaaSofferings,therebydamaging
thereputationandperceivedreliabilityandsecurityofourproductsandservicesandpotentiallymakingthedatasystemsofourcustomersvulnerableto
furtherdatalossandcyberincidents;and
• personallyidentifiableorconfidentialdataofourcustomers,employeesandbusinesspartnerscouldbestolenorlost.
Shouldanyoftheaboveeventsoccur,wecouldbesubjecttosignificantclaimsforliabilityfromourcustomers,wecouldfaceregulatoryactionsfrom
governmentalagencies,ourabilitytoprotectourintellectualpropertyrightscouldbecompromised,ourreputationandcompetitivepositioncouldbesignificantly
harmedandwecouldincursignificantcostsinordertoupgradeourcybersecuritysystemsandremediatedamages.Consequently,ourbusiness,financialcondition
andoperatingresultscouldbeadverselyaffected.
We operate a global business that exposes us to additional risks.
Ourinternationalactivitiesaccountforasubstantialportionofourrevenuesandprofits,andweplantofurtherexpandinternationally.Inaddition,our
investmentportfolioincludesinvestmentsinnon-U.S.financialinstrumentsandholdingsinnon-U.S.financialinstitutions,includingEuropeaninstitutions.In
additiontotherisksdescribedelsewhereintheseriskfactors,ourinternationaloperationssubjectustoavarietyofrisks,including:
•difficultiesinenforcingcontractsandcollectingaccountsreceivableandlongerpaymentcycles,especiallyinemergingmarkets;
• difficultiesindeliveringsupport,traininganddocumentationincertainforeignmarkets;
•tariffsandtradebarriersandotherregulatoryorcontractuallimitationsonourabilitytosellordevelopourproductsandservicesincertainforeign
markets;
•economicorpoliticalinstabilityandsecurityconcernsincountriesthatareimportanttoourinternationalsalesandoperations;
•difficultiesintransferringfundsfromcertaincountries;
• increasedcompliancerisks,particularlyinemergingmarkets;and
•difficultiesinmaintainingappropriatecontrolsrelatingtorevenuerecognitionpractices.
Forexample,recenteconomicinstabilityinBrazil,ChinaandRussiahasadverselyaffectedouroperatingresultsinthesecountries,andouroperatingresults
maybefurtheradverselyaffectedifthiseconomicinstabilitycontinuesorspreadstoneighboringmarkets.Additionally,theChinesegovernmentisworkingto
implementnewnetworksecuritystandardsthatwillrequireITsystemsbeingsoldintocertainkeysectorstobecertifiedas“secureandcontrollable”.Aspartof
thateffort,inDecember2014,standardswereimplementedinthebankingsectorrequiringITcompaniessellingtoChinesebankstosubmittheirsoftwareand
othertechnologytointrusivesecuritytesting,includeindigenousChineseintellectualpropertyandencryptiontechnologyintheirsoftwareanddisclosesource
codeandotherproprietaryinformationtotheChinesegovernment.Implementationofthesestandardswassubsequentlysuspendedinlightofconcerns
communicatedbybanksandotherparties.However,in2015,thegovernmenthascontinuedtoenactorproposeadditionallawsandregulationstoaddress
informationandnetworksecurity.Forexample,inJuly2015,ChinaenactedaStateSecurityLawauthorizingthegovernmenttoimplementasystemfor
maintainingthesecurityofnetworksandinformation,anditalsopublishedadraftcybersecuritylawthatproposedvariousspecificinformationsecurityand
networksecuritymeasurestoenhance“cybersovereignty.”InNovember2015,theinsuranceregulatorinChinaissueddraftinsurancecyberrulesthatwould
requireinsurancecompaniestohavecompliantencryptiontools,secureandcomplianthardwareandsoftwareproducts,anddatastorage.InDecember2015,China
enactedanAnti-TerrorismLawthatgiveslocalpublicsecurityandstatesecurityauthoritiesthebroaddiscretionaryauthoritytorequirecompaniestoprovide
accesstotheirequipmentanddecryptionsupportinparticularcases.Failuretocomplywithsuchrequestscanresultinfinesandimprisonment.Inaddition,abroad
rangeofbusinesseswillberequiredtoverifytheidentitiesofcustomersandprohibittheprovisionofservicestocustomerswhoseidentitiesareunclearorwho
refusetocooperateintheverificationprocess.Ifwearenotableto,orchoosenotto,complywiththeseandotherinformationandnetworksecuritystandardsthat
theChinesegovernmentmightimplementinthefuture,ourbusinessinChinamaysuffer.
Furthermore,ifwefailtocomplywithlegalandregulatoryrequirementscoveringtheforeignactivitiesofU.S.corporations,suchasexportcontrol
requirementsandtheForeignCorruptPracticesAct,aswellaswithlocalregulatoryrequirementsinnon-U.S.jurisdictions,wemaybeexposedtosignificantfines
andpenaltiesandreputationalharm.Theseriskswillincreaseasweexpandouroperationsinlocationswithahigherincidenceofcorruptionandfraudulent
businesspractices.
Inaddition,potentialfalloutfrompastdisclosuresrelatedtotheU.S.Internetandcommunicationssurveillanceandpossibleeffortstoenableincreased
surveillancecouldmakeforeigncustomersreluctanttopurchaseproductsandservicesfromU.S.-basedtechnologycompaniesandimpairourgrowthratein
foreignmarkets.
16