Item 1. BUSINESS
Overview
Certicom is an encryption technology company specializing in security solutions for mobile computing and wireless data markets, including mobile eCommerce, or mCommerce. Our solutions often use less processing power and bandwidth than conventional encryption technologies, and are therefore more suitable for many mobile and wireless environments. Our original equipment manufacturer, or OEM, customers incorporate our patented technology into their applications for handheld computers, mobile phones, two-way pagers and other Internet information appliances. As these devices communicate increasingly sensitive and valuable information, we believe the demand for stronger security will increase.
Our product line includes cryptographic toolkits, information security protocol toolkits, and public-key infrastructure, or PKI, products. We have announced for availability later this year certificate authority, or CA, services and a virtual private network, or VPN, client application. In addition to licensing our security products, we provide consulting and systems integration services to assist our customers in designing and implementing efficient security solutions. Our customers include 724 Solutions, Aether Systems, BellSouth Wireless Data, Motorola, Palm, Inc., PUMATECH, Inc. and QUALCOMM.
- 1 -
Industry Background
The Growth of the Internet
The Internet continues to evolve toward a trusted global communications medium for exchanging information, establishing business relationships and conducting commerce electronically. International Data Corporation, or IDC, projects that the number of Internet users worldwide will increase from approximately 140 million at the end of 1998 to 502 million by the end of 2003. Rapid growth in the number of people who access the Internet continues to drive the acceleration of on-line business activity. We believe businesses and consumers will continue to leverage the Internet to conduct communications and transactions that traditionally would have been handled in more personal ways.
The Growth of eCommerce
As a growing number of businesses and individuals access the Internet, they increasingly establish commercial relationships and conduct electronic commerce, or eCommerce. GartnerGroup estimates that worldwide eCommerce will grow to approximately $7.3 trillion in 2004. Recent federal legislation, the Electronic Signatures in Global and National eCommerce, or E-SIGN, Act, gives electronic signatures the same legal status as handwritten signatures. This legislation may further encourage eCommerce by allowing individuals to sign agreements online.
Currently, eCommerce consists of business-to-business and business-to-consumer transactions conducted primarily over the wireline Internet infrastructure. For example, a business-to-business transaction such as that required to execute vertical supply chain management involves data exchange between enterprise servers across the wireline Internet. In addition, business-to-consumer applications such as on-line banking, on-line stock trading and on-line shopping generally involve electronic transactions between enterprise servers and personal computers or workstations.
The Growth of Mobile Computing and the Wireless Internet
We believe that a substantial portion of the future growth of the Internet will occur in the mobile and wireless environments. Early adoption of the Internet relied upon a wireline infrastructure and a large base of personal computers and workstations. While the number of personal computers and workstations continues to grow, we expect the use of mobile devices to expand more rapidly. Increased mobile access to the Internet by businesses and consumers is being facilitated by Internet-enabled digital wireless devices such as the Palm VII(TM) handheld computer, the NeoPoint 1000 smartphone and the RIM Inter@ctive(TM) Pager 950. IDC forecasts that the number of users in the United States of wireless devices that have the ability to send and receive information over the Internet will increase from 7.4 million in 1999 to 61.5 million in 2003. As a result, we believe that individuals will increasingly use Internet-enabled mobile devices to enhance their productivity when away from their homes or offices.
The Growth of mCommerce
As technologies for mobile computing and wireless data advance, we believe that mCommerce, which encompasses any eCommerce transaction in a mobile environment, will account for an increasing portion of eCommerce. Current business-to-business mCommerce applications include supply chain management in vertical markets such as health care, insurance and real estate. Current business-to-consumer mCommerce applications include on-line shopping, on-line banking and securities trading. According to IDC, the total annual value of wireless Internet transactions will increase from $4.3 billion in 1998 to $38.1 billion in 2003. While we believe that mCommerce will continue to be a rapidly growing part of eCommerce, certain obstacles must be overcome for this to occur.
The Importance of Security in eCommerce and mCommerce
Speaking with a person either face-to-face or over the telephone provides a natural way of ensuring that each person involved in a communication or transaction is known to the other, or authenticated. In electronic communication, authentication and other security services are required to protect both parties to a communication.
- 2 -
For example, typical eCommerce transactions, such as on-line shopping, require authentication of the vendor and an encrypted communication path between the purchaser and the vendor to communicate sensitive information such as credit card numbers. Due to the immediacy of Internet communications, this trust relationship between the parties should be established immediately and without a prior introduction.
With the increased use of the Internet by individuals and businesses for the transmission of sensitive data, the risk of fraud is present. For example, it has been reported that while 2% of Visa International's credit card business relates to Internet transactions, 50% of its disputes and discovered frauds are in that area.
The potential damage to the emerging Internet economy goes beyond security for transactions. In the early stages of Internet growth, institutions could apply their existing risk management models and techniques to avoid liability and manage fraud. Individuals were not at tremendous risk of loss due to fraud. However, now that the information available on-line is increasingly personal, potential damage to individuals may become increasingly prevalent.
We believe there is a need for an increased level of trust within eCommerce and mCommerce applications. Individuals, or clients, interacting with institutions, or servers, should be certified by a registration authority that is trusted by both parties. Institutions want more assurance that they are transacting with their true customer and individuals want assurance that their reputations will not be damaged by unauthorized access to and misuse of their personal information. Mutual authentication within either an eCommerce or mCommerce transaction would satisfy both institutions and individuals.
Cryptographic technology is used to address the above-discussed security challenges inherent in open networks. Cryptography delivers four basic information security services:
o confidentiality, or keeping communications secret from anyone other than an intended recipient;
o data integrity, or verifying that the message or transaction has not been modified en route between the sender and the recipient;
o authentication, or verifying the identity of another party to ensure that communication is with a known or authorized person; and
o non-repudiation, or signing a document or a record of transaction to attest to its validity. This digital signature can be checked by a relying party and its correctness can be demonstrated to a third-party arbiter, allowing enforcement of legally binding digital contracts.
Limitations of Existing Security Technologies
Currently, the vast majority of eCommerce transactions use a conventional encryption algorithm that is the de facto public-key security standard in the wireline Internet environment. These transactions generally do not involve mutual authentication and thus are not as secure as they could be. We believe that as eCommerce evolves, businesses will increasingly demand mutual authentication, particularly for employee enterprise data access and high-value transactions. Conventional encryption technologies can be used for mutual authentication. However, while these technologies offer a high level of security for transactions conducted over the wireline network, they have certain inherent limitations in providing the same level of security when operating in mobile and wireless environments. Specifically, as a result of the relatively large key sizes used in these technologies, mutual authentication is relatively difficult and expensive due to the following disadvantages:
o Slower Processing Speed. Key generation and digital signature operations using these technologies consume significant amounts of processing time. For example, we have determined that the public-key cryptographic components of a mutually authenticated SSL handshake currently take approximately 23 seconds using conventional technologies on a Palm VII(TM)handheld computer with a 20 MHz processor. This handshake, or a similar handshake, would be used when a Palm VII(TM) connects to a secure web server for a mutually authenticated mCommerce transaction. This amount of processing time may be unacceptable in devices that attempt to deliver immediate user interaction.
- 3 -
o Large Bandwidth Requirements. There is a limited amount of wireless bandwidth available for use by mobile applications. Authentication messages signed using conventional security algorithms consume significant amounts of this limited wireless bandwidth.
o Increased Battery Requirements. Due to the increased processing time associated with conventional cryptographic operations, these operations would cause a drain on the battery power found in some wireless and mobile devices.
While any one or more of the above disadvantages inherent in the use of conventional security technologies for mutual authentication in mobile and wireless environments can be overcome, either through the addition of a cryptographic coprocessor to the device or otherwise, we believe that the cost of doing so would generally be significant.
Market Opportunity
We believe that a cost-effective and efficient security solution is required to realize the full potential of mCommerce and other mobile and wireless applications. What is needed is a security solution designed for mobile and wireless devices that is substantially faster, uses significantly less processing power, bandwidth and battery power, and provides secure authentication and encryption to ensure the validity and privacy of mCommerce transactions.
The Certicom Solution
We are an encryption technology company specializing in security solutions for mobile computing and wireless data markets, including mCommerce. Our products and services, which we provide to many of the leading mCommerce OEMs, enable trust through mutual authentication. We provide cryptographic toolkits, information security protocol toolkits and PKI products that enable secure mCommerce. In addition, we have announced for availability to our OEM customers in calendar year 2000 CA services and a VPN client application. We also offer a wide range of cryptographic consulting and design services, including design and review of secure systems. We provide comprehensive and innovative solutions to our OEM customers that allow them to develop new mobile computing and wireless data applications and to accelerate their product delivery, reducing their costs.
Our Elliptic Curve Cryptography-Based Solutions
We believe that our elliptic curve cryptography, or ECC-based solutions offer significant advantages in providing mutual authentication of mCommerce transactions and applications over the wireless Internet. Our patented implementation of ECC technology can provide a more efficient alternative to conventional public-key cryptographic algorithms in many mobile and wireless environments, resulting in generally faster processing speed, reduced bandwidth requirements and decreased battery requirements. These advantages make our ECC-based security technology particularly well suited to mobile devices that incorporate less powerful processors, such as handheld computing devices, Internet-enabled phones and two-way pagers. We have performed extensive research in ECC, and we have developed numerous proprietary techniques and hold several patents related to its implementation. ECC is included in many prominent standards - including specifications from the National Institute of Standards and Technology, or NIST, and more commercially-oriented forums such as the American National Standards Institute, or ANSI, the Institute for Electrical and Electronics Engineers, or IEEE, and the International Organization for Standardization, or ISO. For a more complete discussion of ECC, please refer to "Cryptographic Systems and Elliptic Curve Cryptography" at the end of this Item 1.
We believe that our ECC-based solutions allow us to deliver strong security and trusted communications based on mutual authentication, which help address the problem of identity fraud on the wireless Internet. ECC performs more efficiently than conventional security algorithms in many mobile and wireless environments. When applied to mutual authentication on mobile and wireless devices, our ECC implementation can provide, with equivalent security strength, the following technical advantages over conventional encryption technologies:
o Faster Processing Speed. We have determined that characteristics of ECC allow rapid mutual authentication from mobile and wireless devices. For example, the public-key cryptographic components of a mutually authenticated, ECC-based, SSL handshake currently take approximately
- 4 -
3 seconds on a Palm VII(TM)handheld computer with a 20 MHz processor. This compares to approximately 23 seconds for an SSL handshake using conventional technologies on the same device. This handshake, or a similar handshake, would be used when the Palm VII(TM)connects to a secure web server for a mutually authenticated mCommerce transaction. These faster processing speeds help deliver a more acceptable user experience with mobile and wireless devices.
o Reduced Bandwidth Requirements. The shorter key lengths of ECC significantly reduce the amount of data required to be exchanged for security purposes. This reduced use of the limited wireless bandwidth results in time savings for device users and lower bandwidth costs.
o Decreased Battery Requirements. Some ECC operations take less time to process, which reduces the amount of battery power consumed by a secure application. This results in an extension of the battery life of the mobile and wireless devices.
We believe our ECC-based solutions can provide the following principal benefits to our OEM customers:
o Lower costs. Because less processing power is required for equivalent security, some mobile and wireless products built with our technologies are less expensive for our OEM customers to produce.
o Increased security. Our ECC-based technology enables greater security than conventional encryption technologies in many mobile and wireless environments when evaluated at equivalent levels of processing power, bandwidth and battery capacity.
o Faster time-to-market. By incorporating our products and services, our customers can quickly develop a wide range of mobile computing and wireless data applications.
o Differentiated applications and services. Our solutions enable customers to create new applications and deliver levels of service that are high in value and easy to use.
o Increased trust. Our clients use our solutions to build increased trust into their products and deliver reliable services for users of mobile and wireless devices.
Built-in Security
Our encryption products and services allow our OEM customers to build PKI, secure communication protocols and cryptographic algorithms directly into their applications which enable rapid development of flexible trust management solutions. We also provide security integration services to OEMs to assist them in the incorporation of our cryptographic products and custom designed security solutions into their products.
Vertically Integrated Security Offerings
We are poised to deliver a comprehensive set of tools, products and services designed to provide an integrated ECC-based PKI solution to secure network applications, including mobile and wireless devices. Our solution is designed to allow an entity to act as a certificate authority for mCommerce applications and to enable enterprises to form secure communities of trust.
Strategy
Our objective is to become the leading provider of information security products and services for applications in the mobile computing and wireless data markets, including mCommerce. We believe that our ECC-based technology will allow us to provide the preferred security solution for mCommerce OEMs. Our strategy includes the key elements discussed below.
- 5 -
Deliver a comprehensive security product line for the mobile computing and wireless data markets
We intend to become the provider of the most comprehensive line of security products and services for the mobile computing and wireless data markets. Our offerings currently include ECC-based cryptographic toolkits, information security protocol toolkits and PKI products. We have announced, for availability in the second half of calendar year 2000, CA services and a VPN client application allowing us to address all aspects of our customers' mobile and wireless security requirements. Unlike the offerings of many of our competitors, our patented ECC-based technology and integrated standard security protocols have been designed specifically for the constraints associated with applications in the mCommerce market. By providing an end-to-end, standards-based solution that is designed for the mobile computing and wireless data markets, we intend to become the de facto technology standard and market leader for delivering secure and trusted communications for mCommerce.
Continue to build brand awareness
Through our current marketing and branding efforts, we have built significant brand awareness for Certicom. Through co-branding with leading companies, as well as other marketing programs, we intend to establish the certicom encryption(TM) ingredient brand logo as the assurance of trusted communications in the mobile computing and wireless data markets.
Emphasize research and development to produce innovative standards-based security solutions
Our implementation of our ECC-based technology is based on 15 years of fundamental cryptographic research by our Chief Cryptographer and his staff, as well as research by teams at leading academic institutions with which we have working relationships. Through the continuation of this research and the relationship between these research groups and our product development groups, we intend to continue to incorporate leading-edge cryptographic technology into our security products and services. We also intend to continue to capitalize on our technical expertise in cryptography to differentiate our products and services from other commercially available solutions. In addition, we intend to continue to work with standards organizations to develop emerging industry standards based on our technology.
Leverage our OEM business model and strategic technology relationships
Our security solutions are embedded in a wide variety of third-party products and services, including those of 724 Solutions, Aether Systems, BellSouth Wireless Data, Palm, Inc. and PUMATECH, Inc. By continuing to pursue this OEM business model, all of our OEM customers in effect become our distributors, broadening our sales channels. We work strategically with many of our OEM customers in developing security solutions for their future products in order to further the acceptance of our security technology with these market leaders. We intend to use these existing strategic relationships and develop additional strategic relationships to position ourselves as the leader in the mCommerce security market.
Apply our technical expertise to enter new and emerging markets
In addition to our primary focus on security technology for the mobile computing and wireless data markets, our expertise in security is well-suited to other information and business applications. Other applications using our efficient cryptographic technology include CyberSafe's secure payment solutions, Critical Path's Internet messaging solution and XM Radio's satellite radio broadcast solution. We intend to leverage our success in mobile computing and wireless data applications into related applications and markets.
Products and Services
Our solutions include the following products and services:
o Cryptographic Toolkits;
o Information Security Protocol Toolkits;
o PKI Products;
- 6 -
o Certificate Authority Services (announced for commercial availability in the second half of calendar year 2000);
o Virtual Private Network Client (announced for commercial availability in the second half of calendar year 2000);
o Consulting and Design Services; and
o Hardware Components.
Cryptographic Toolkits
Our Security Builder software development toolkit family, which is based on our proprietary ECC-based technology, enables customers to integrate a comprehensive selection of cryptographic components into their applications. The current version of Security Builder supports platforms such as Microsoft Windows 95/98/NT, Sun Solaris, several versions of UNIX, Microsoft Windows CE and the Palm OS(R) platform. We also offer integration services to port Security Builder to other platforms, including real-time operating systems intended for embedded devices.
Information Security Protocol Toolkits
Our information security protocol toolkits include:
o SSL Plus. Our SSL Plus software development toolkit family provides a comprehensive set of libraries that permit customers to add secure communications quickly and easily using the secure socket layer, or SSL, and transport layer security, or TLS, security protocols. The family includes SSL Plus 3.0, SSL Plus for Embedded Systems and SSL Plus for Java. This variety of toolkits allows developers to come to one source for industry standard secure communications over Internet, Intranet, mobile computing and embedded system domains. SSL Plus is the first SSL toolkit that enables secure connections of handheld computers into enterprise data systems over both wired and wireless networks. SSL Plus is available on platforms such as Microsoft Windows NT, Sun Solaris, HP/UX, QNX RTOS, Microsoft Windows CE and the Palm OS(R)platform. SSL Plus is built using the ANSI C language, and we provide services to port to other platforms on request. The SSL Plus for Embedded Systems toolkit extends SSL connections to handheld computing environments and other embedded devices by integrating our ECC-based technology with the TLS 1.0 specification (the successor standard to SSL 3.0).
o WTLS Plus. This information security protocol toolkit implements the wireless transport layer security, or WTLS, protocol for secure transport layer communication over wireless networks. WTLS is part of the wireless application protocol, or WAP, specification and delivers secure Internet communications and advanced telephony services on mobile phones, pagers and personal digital assistants.
PKI Products
Our Trustpoint PKI product line is a comprehensive set of software components, products and tools for PKI development and deployment. Trustpoint PKI products can be used by our OEM customers to build trust management solutions into their products. Our Trustpoint product line consists of certificate toolkits, a CA, a Registration Authority, or RA, an administrative console and end-entity software. These components operate on Linux, Microsoft Windows 95/98/NT, Sun Solaris, HP/UX, Java JDK, Microsoft Windows CE and the Palm OS(R) platform. Additionally, Trustpoint components are built to open industry standards for PKI interoperability, including X.509 and PKIX. We have commenced shipping our Trustpoint PKI products for revenue during the first quarter of fiscal 2001.
- 7 -
Certificate Authority Services
We have announced, for commercial availability in calendar year 2000, Internet-based trust services that assure the identity of both servers and clients in eCommerce and mCommerce information systems. We will market these trust services as MobileTrust managed certificate services. MobileTrust will package the MobileTrust CA service with our PKI products, security protocol toolkits and integration services to provide an integrated ECC-based managed trust solution for our OEM customers. The MobileTrust CA service will operate in a secure data center to provide reliability and protection against external threats. We currently are beta testing our trust services.
Virtual Private Network Client
We have announced, for commercial availability in calendar year 2000, a VPN client application for the Palm Computing Platform. The VPN client will deliver an IPSec standard protocol implementation compatible with existing VPN installations. The VPN client will also support a wide range of encryption algorithms, enabling interoperability with the current installed base of enterprise VPN products, and includes Certicom's ECC for vertical integration with the MobileTrust CA service.
Consulting and Design Service
We deliver advanced security solutions. Our experts in cryptography and information security provide a comprehensive range of consulting and design services. These services are designed to help customers get their products finished faster and with higher levels of confidence in their security. We offer the following services:
o Security Design and Integration. We offer design and development support to help our customers minimize time-to-market and to maximize performance, efficiency and robustness of security applications.
o Product Review and Evaluation. We provide confidential reviews of our clients' products to assist them in fielding practical and robust security solutions. Our reviews include detailed technical evaluations, architectural overviews and business plan viability analysis.
o Enterprise and Information Security Reviews. We assist in identifying threats and evaluating networks and computer security risks, and we recommend solutions for potential security breaches. Typically, we perform risk analysis, physical site reviews, network security reviews, security architecture design, disaster recovery planning, security policies and product review and recommendations as part of our enterprise consulting services.
o Cryptographic Algorithm Design and Review. We have expertise in efficient cryptographic security implementations. We help our customers design and review custom cryptographic algorithms for building strong security in demanding environments. Customers typically use our services in wireless handheld devices, high value financial transactions, server- and client-based applications and network security systems.
o Security and Cryptographic Training. We offer training courses to our customers that cover a broad range of cryptographic and digital information security topics. These courses are tailored to help our customers make informed decisions concerning technical designs and new product and service opportunities.
o Public-Key Infrastructure Solutions. We help clients evaluate PKI products and define PKI system architectures. Our development teams have fielded robust solutions for our customers that we believe meet the demands of new and challenging environments.
Hardware Components
We offer several hardware components that are manufactured by others to our specifications. These products provide secure processing and storage for cryptographic keys based on ECC-based technology. Our smart card product line addresses the need for low-cost, high-strength user identification and authentication services in a
- 8 -
form factor similar to a credit card. Our Certilock security module provides a secure, hardware-based execution environment in a PCI card form factor for use in secure application servers and certificate authorities.
Intellectual Property
We rely on combinations of proprietary technologies, trade secrets, patent protection and copyright protection in the conduct of our business. Our cryptographic research has resulted in ten patents granted in the United States and internationally. Our research has also led to our filing numerous patent applications over the past five years. As of June 30, 2000, we had forty-four pending patent applications, each of which is filed in one or more jurisdictions. Most of our patent applications are filed in the United States and Canada, while a portion are filed in Europe and Japan. We have filed patent applications in countries which we perceive to be significant markets. We also rely on certain trade secret aspects of our products and services to provide a commercially prudent level of protection to our proprietary technology, both in markets in which we have filed patent applications and those in which we have not.
A majority of our pending patent applications relate to implementations of ECC, while some of them relate to techniques used with other public-key cryptosystems as well. We believe that our existing patents, together with our pending patent applications, cover the most advantageous methods of implementing ECC. We have licensed and may in the future license our patents to OEM customers. We believe that our ECC-based technology will be commercially competitive against public domain encryption systems.
We also engage in joint development work which has resulted in the filing of additional patent applications. As a result of joint development efforts, we jointly own two patents with Motorola. In addition, such work also resulted in the filing of several applications for jointly owned patents with Pitney Bowes.
Research and Development
We are engaged in advanced cryptographic research involving computational algorithms and integrated circuit architectures for cryptographic processing. Dr. Scott Vanstone, our Chief Cryptographer, leads our efforts in this area. Dr. Vanstone is also a professor of Mathematics and Computer Science at the University of Waterloo, a leading Canadian center for cryptographic research, and has published numerous books and articles on cryptography. He is an Executive Director for the Centre of Applied Cryptography, the holder of the NSERC/Pitney Bowes Senior Chair of Applied Cryptography at the University of Waterloo and a Fellow, Royal Society of Canada, Academy of Science. We maintain a cooperative relationship with the University of Waterloo, including our sponsorship of the Certicom Chair of Cryptography. We also sponsor research at Stanford University.
As of June 30, 2000, we employed 20 cryptographers involved in pure research and applied cryptographic development. We also retain several leading cryptographic researchers at academic institutions as paid consultants. We present at a number of cryptography conferences and hold numerous workshops worldwide on ECC.
In addition to our core expertise in applied cryptographic research, we emphasize the development of software toolkits that package core technology innovations and standard security protocols into easy-to-use products targeted at the development community. We have expertise in the development of printed circuit board and integrated circuit designs that integrate our ECC implementations directly into hardware solutions.
Our research and development staff is active in many important industry standards bodies, including the Institute for Electrical and Electronics Engineers, or IEEE, the American National Standards Institute, or ANSI, the International Organization for Standardization, or ISO, the Internet Engineering Task Force, or IETF, and WAP, among others. We have formed our own standards group, the Standards for Efficient Cryptography Group, or SECG, to promote ECC interoperability among the major companies planning to ship ECC-based products. Members of SECG, include companies such as Hewlett-Packard, VeriSign and American Express.
Customers
As of June 30, 2000, the Company had over 100 licensed customers. The following is a partial list of companies that have licensed our Security Builder cryptographic toolkit or SSL Plus protocol toolkit product, or custom-developed security solutions:
- 9 -
724 Solutions Inc. Motorola, Inc. Aether Systems Inc. NeoPoint, Inc. AvantGo Inc. Palm, Inc. BellSouth Wireless Data, L.P. Pitney Bowes ClearCommerce Corp. PUMATECH, Inc., Inc. Critical Path, Inc. QUALCOMM, Inc. CyberCash, Inc. Schlumberger Limited CyberSafe Corporation Sterling Commerce, Inc. Datakey, Inc. Sybase, Inc. JP Systems, Inc. XM Satellite Radio, Inc.
We license our cryptographic and information security protocol toolkits to our OEM customers, which in turn use them to build security into their products for sale to their end-user customers. Listed below are examples of applications where our encryption technology has been implemented in products or services offered to consumers or enterprise end-users.
Customer Applications
BellSouth Wireless Data--Fidelity Investments
BellSouth Wireless Data is a leading provider of wireless data services with one of the largest wireless data networks in the United States. BellSouth embeds our ECC technology into its BellSouth Powertool(TM) application, which provides a development environment used by developers looking to quickly develop secure wireless data applications for the RIM Inter@active(TM) Pager 950. Our ECC technology allows the establishment of a secure wireless communications link between a gateway server and a RIM two-way pager for the transfer of sensitive application data utilizing the BellSouth Intelligent Wireless Network(TM). Fidelity Investments licensed BellSouth's Powertool(TM) for the development of its Fidelity InstantBroker(TM) secure wireless brokerage application. This application allows Fidelity's brokerage customers to check account information, receive quotes and place orders securely.
Aether Systems--Charles Schwab & Co., Inc.
Aether Systems is a leading provider of wireless and mobile data services, allowing real-time communications and transactions across a full range of devices and networks. Aether embeds our ECC technology into their Aether Intelligent Messaging software platform allowing application providers to securely extend their reach to wireless platforms. Aether chose our security technology in order to secure communications from the wireless device back to the application server. Financial institutions, such as Charles Schwab & Co., Inc., partner with Aether to develop wireless trading services for their brokerage customers. These services are designed to enable customers to access their accounts and conduct transactions from a wide range of mobile information appliances.
724 Solutions--Bank of Montreal
724 Solutions provides an Internet infrastructure software solution to financial institutions that enables them to offer personalized and secure on-line banking, brokerage and eCommerce services across a wide range of Internet-enabled wireless and consumer electronic devices. 724 Solutions chose our SSL Plus and Security Builder toolkits to embed ECC technology into client-device financial applications. For example, 724 Solutions uses ECC technology in home banking and customer solutions as well as in their back-end architecture. Bank of Montreal deployed wireless banking and investment applications based on software provided by 724 Solutions. These applications provide Bank of Montreal customers with the capability to access bank account balances and transaction details, transfer funds, pay bills, conduct wireless trading, view investment portfolios and view credit card transactions and payments.
- 10 -
Palm, Inc.--Amazon.com
Palm is the world's leading provider of personal companion handheld devices with a 68% market share in the worldwide personal companion handheld device market in 1998 according to IDC. For its wireless Palm VII(TM) handheld computer, we designed a custom implementation of our ECC-based technology that seamlessly embeds security into the Palm OS(R) platform. Palm's ECC-based security allows the establishment of a secure link between a Palm VII(TM) handheld and the Palm.Net(TM) wireless communications service allowing over-the-air service activation as well as secure mobile eCommerce applications. Amazon.com launched its Amazon.com Anywhere application, based on software acquired in their acquisition of Convergence Corporation, which utilizes the secure link between the Palm VII(TM) handheld and the Palm.Net(TM) servers that is enabled by our security technology. Amazon.com Anywhere allows its customers to securely shop for books, music, software, electronics and other products and check the status of auction items at Amazon.com when they are away from their desktop computers.
Sales and Business Development
We sell our cryptographic products and services directly to OEM customers through dedicated technical sales representatives. We focus our efforts on market leaders in the sectors in which the advantages of our technology are most compelling.
We have sales offices in the United States and Canada. We intend to expand our sales and business development presence into Europe and the Asia Pacific region.
In North America, our sales representatives are assigned account responsibilities based on market sector. This enables the team and its members to develop expertise in their specific market sector. Each sector team will consist of a business development manager, a group of sales specialists, and field application engineers.
As the market matures for our technology, we anticipate complementing our direct sales force with indirect channels to increase our sales reach worldwide.
Marketing
We maintain marketing programs aimed at increasing market awareness of Certicom, our technology and the need for security solutions in general.
Demand Generation
We generate demand from OEMs for our products by exhibiting and speaking at industry conferences, trade shows, seminars and consortium meetings. We focus our marketing efforts on selected opportunities to reach technical and business decision-makers within particular target market sectors.
Customer Education
We educate our customers to help them understand public-key cryptography and information security as it applies to their specific business opportunities. For this we use a combination of white papers, case studies, data sheets, product demonstrations and on-line tutorials.
Ingredient Brand
We provide our certicom encryption(TM) ingredient brand logo, a diamond with the words "certicom encryption" inside, for use by our licensees in their end-user product packaging to indicate the use of our technology in their products. We also provide variations of our logo for use in handheld devices and other systems where screen space is at a premium. Our logo features regularly in our advertisements, trade show graphics, product packaging and other promotional efforts.
Standards Marketing and Education
We maintain an active commitment to open standards in the cryptography industry and participate in setting standards that pertain to various aspects of our technology. Our success in marketing our security products
- 11 -
and services is partially dependent on the acceptance of our technology by standards organizations. In many cases, the membership of standards committees are comprised of representatives from our most important customers.
Confidence in the strength of cryptographic algorithms is essential to the expansion of their use. We have engaged in extensive educational activities to explain the mathematical basis underlying elliptic curve cryptosystems. These educational initiatives have been directed towards not only customers but also the ultimate end-users of our products, including banks, credit card associations and governments.
Competition
We face competition from vendors offering a wide range of security products and services, including the following:
Cryptographic Toolkits
Our primary competitor in this market is RSA Security, Inc., or RSA Security. The RSA public-key algorithm has long been established as the de facto standard for the wired Internet. In addition, competition may come from solutions developed in-house, or by companies who attempt their own encryption implementations without licensing commercial toolkits.
Information Security Protocols
RSA Security also markets products in this segment. There are a number of other companies worldwide who offer commercial protocol products. In addition, OpenSSL, a royalty-free source-code implementation, is used by some companies.
PKI Products
Competition in this segment is increasing as traditional PKI companies such as Entrust Technologies, Inc., or Entrust and Baltimore Technologies, Inc., or Baltimore, move into the mobile and wireless market. RSA Security also participates in this segment. In Europe and Asia, some specialty vendors are emerging, such as Sonera SmartTrust, who develop and sell PKI products for GSM phones.
CA Services
Competition in this segment may come from companies such as VeriSign, Inc., or VeriSign, Entrust and IBM. These companies have CA products and services for issuing and maintaining digital certificates for use on public and private networks. Although traditionally desktop focused, they have begun to modify their offerings to address the mobile and wireless market.
VPN Client
Competition in this segment is only just emerging. One other company, V-ONE, has announced a VPN client for the Microsoft Windows CE platform. Potential market entrants include SSH Communications Security and traditional security software providers such as Entrust Technologies, Baltimore Technologies, and RSA Security.
In addition, we may face competition in the future from competitors who develop new cryptosystems. We believe that the important factors in choosing security technologies in our market are proven technology, reputation of the vendor, efficiency of the algorithms and ease-of-use of the products. We believe that our products currently compete favorably with those of our competitors, but there can be no assurance that we can maintain our competitive position against current and future competitors.
Regulatory Matters
Our products are subject to export, import and/or use restrictions imposed by the governments of the United States, Canada and other countries. Therefore, our ability to export and re-export our products from the United States and Canada to other countries are subject to a variety of government approvals or licensing requirements.
- 12 -
Such restrictions potentially could have a material adverse effect on our business, financial condition and operating results.
In general, our products can be exported from, imported into and used in the United States and Canada without licenses or other approvals. In other countries, the trends regarding export, import and use restrictions are mixed. For example, France appears to be relaxing its requirements, whereas China appears to be imposing new requirements. Given that the laws, regulations and requirements governing the export, import and use of encryption products change frequently and without advance notice, we cannot predict their ultimate impact on our activities.
Employees
As of June 30, 2000, we had 210 full-time, part-time and contract employees: 79 in cryptographic research and engineering, 41 in sales and marketing, 34 in consulting and systems integration services, and 56 in finance and administration. None of our employees is represented by a labor union or subject to a collective bargaining agreement. We consider our relationship with our employees to be good. All our employees enter into intellectual property rights assignments and non-disclosure agreements with us.
Cryptographic Systems and Elliptic Curve Cryptography
The expansion of digital data communication and the Internet has led to a need to protect valuable information with cryptography. There are two types of cryptographic systems: symmetric-key systems and public-key systems. In a symmetric-key system, both communicating parties share the same key, which must be kept secret. Secret keys require complex key management systems to distribute them to the appropriate parties while keeping them secret from others.
In contrast, in a public-key system, there are two distinct but related keys, forming a key pair: a public key and a private key. The public key is used for encrypting messages, which can then be decrypted using the corresponding private key. It is extremely hard to determine or derive the private key from the public key. Thus, the public key can be openly published without compromising the confidentiality of the corresponding private key, which the user must keep secret. Because the public key need not be kept secret, key management systems for public-key cryptography can be much simpler than for symmetric-key systems. As symmetric-key systems deliver better performance than public-key systems, but public-key systems provide better key management, hybrid solutions using both systems are generally used to construct cryptographic solutions.
Public-key systems offer the ability to create digital signatures. To sign digital data, a user applies his or her private key in a prescribed manner to the data to be signed, creating a digital signature. Subsequently, anyone can verify the correctness of the signature using the user's public key. This allows the user to prove that he or she possesses the correct private key and proves that the message has not been modified, thus creating:
o integrity, since the message can be shown to be unmodified;
o authentication, because the user can be identified as the holder of the private key; and
o non-repudiation, because the message and signature can be presented to a third party who can independently validate the signature and treat it as legally binding, where appropriate.
Because a digital signature allows a user to prove only that he or she holds the private key which matches a particular public key, additional data is necessary to use signature validation to create an assurance of identity. This is accomplished with digital certificates, which are signed messages that bind a name or other attributes of the holder of a given private key to the corresponding public key. Each certificate is signed by a trusted party, known as the certificate authority, which makes the assertion that a given user is the sole holder of the private key which matches the public key. The signature from the certificate authority allows the binding of the name to the public key to be trusted. This allows a relying party to validate the identity of a user or server by first checking the validity of the certificate, then verifying a signature against the certified public key. The collection of certificate authorities, policies and procedures associated with the management of public keys is known as public-key infrastructure, or PKI.
- 13 -
All known public-key cryptographic systems are based upon advanced mathematics. They use the idea of a trapdoor one-way function, a mathematical problem which is hard to solve without knowledge of some secret trapdoor information. With this knowledge, the problem is easy to solve; without it, it is extremely difficult. In a public-key cryptographic system, the public key is the statement of the mathematical problem; the private key is the secret trapdoor information. For example, one of the earliest and most commonly used public-key cryptographic systems is RSA, which is based on taking two large prime numbers, each dozens of digits long, and multiplying them together. It is very difficult to take the composite result and determine the two unique prime factors that were used to create it. Here, the large composite number is the public key, and knowledge of its prime factors is the secret trapdoor information and can be used as the private key.
Before elliptic curve cryptography, or ECC, was invented, only two major families of public-key cryptographic systems were known. Each of these conventional algorithm families is based on a different one-way function. The families are called the integer factorization family and the discrete logarithm family, and both are based on arithmetic using whole numbers. The integer factorization family consists of algorithms such as RSA. The discrete logarithm family is based on the difficulty of taking logarithms when arithmetic is performed while taking remainders under division by a large number at each stage. The best-known systems in this family are the Diffie-Hellman key agreement protocol and the DSA signature scheme.
In 1985, Neal Koblitz and Victor Miller realized that elliptic curves had practical application to public-key cryptography. Elliptic curves have been studied as mathematical objects for over 150 years and formed the basis in 1995 of Andrew Wiles' much publicized proof of Fermat's Last Theorem--a problem which had remained unsolved for hundreds of years and at the time was the most celebrated open question in mathematics. ECC is based on a problem related to the discrete logarithm family, except that arithmetic is performed on elliptic curve points rather than on whole numbers.
Although a poorly-designed cryptographic system can be insecure regardless of how long its keys are, the strength of secure, accepted cryptographic systems can generally be measured in terms of key size, which is measured in bits. The use of advanced mathematics in a public-key cryptographic system leads to its keys being relatively large and its operations being relatively slow when compared to those of a symmetric-key cryptographic system.
The most commonly used public-key systems must use a 1,024-bit key to deliver the same security as an 80-bit symmetric key and take a great deal of computation to create or verify signatures or to encrypt or decrypt data. Because the elliptic curve problem is harder to attack than the whole number problems used in conventional public-key systems, ECC offers similar security with just 163-bit keys. We believe that the advantage of ECC over these older public-key systems will increase as available computing power, and thus the ability to attack a cryptosystem, increases. The following table illustrates this advantage by showing the key sizes for various kinds of cryptosystems that provide comparable security.
Comparable key sizes for cryptographic systems, in bits
Public Key ------------------------------------- Conventional Symmetric Key ECC Algorithms ---------------- ---------------- ------------------- 80 163 1,024 128 283 3,072 192 409 7,680 256 571 15,360
Although 80-bit symmetric keys currently provide acceptable commercial security, we believe that the next generation standards for symmetric-key systems will use keys in the 128-bit to 256-bit range in order to withstand attacks made possible by the rapid advance of computing power. For equivalent security strength, either 571-bit ECC keys or extremely large 15,360-bit RSA keys should be used to protect 256-bit symmetric keys in hybrid solutions. Given that the processing effort for a cryptographic algorithm generally grows with the key size, the bandwidth and computational advantages of ECC grow disproportionately as security increases.
- 14 -
The security of a system is very dependent on its design. Confidence in the security of ECC's design stems from 15 years of scrutiny by cryptographic experts. This confidence is reflected by the inclusion of ECC in many prominent standards, including specifications from government bodies and more commercially-oriented forums such as ANSI, IEEE and ISO. Most recently, a digital signature standard based on ECC has become a U.S. Government Federal Information Processing Standard. Given that the standardization process in these organizations has typically taken several years, and because we monitor these processes, we do not expect that any novel algorithms will achieve standardization by these organizations in the near future.
RISK FACTORS
You should carefully consider the risks described below and the other information in this Form 10-K. If any of the following risks occur, our business, financial condition or results of operations could be materially harmed.
Risks Related to Our Business
We have historically incurred losses and will for the foreseeable future.
We have experienced substantial net losses in each fiscal period since we were formed. As of April 30, 2000, we had an accumulated deficit of $54.3 million and, in addition, an accumulated other comprehensive loss of $2.5 million. The risk factors described in this Form 10-K, among other factors, make predicting our future operating results difficult. We expect to incur additional losses for the next few years, and we may never achieve profitability. If we do, we may not be able to sustain it. Because we may be unable to sustain our revenue growth, you should not consider our historical growth indicative of our future revenue levels or operating results.
Our business depends on continued development of the Internet, the acceptance of mobile and wireless devices and the continued growth of eCommerce and mCommerce.
Our future success is substantially dependent upon continued growth in the use of the Internet and the acceptance of mobile and wireless devices and their use for mobile eCommerce, or mCommerce. The adoption of the Internet for commerce and communications, particularly by individuals and companies that have historically relied upon alternative means of commerce and communication, generally requires the understanding and acceptance of a new way of conducting business and exchanging information. In particular, companies that have already invested substantial resources in other means of conducting commerce and exchanging information may be particularly reluctant or slow to adopt a new, Internet-based strategy that may make their existing personnel and infrastructure obsolete. To the extent that individuals and businesses do not consider the Internet to be a viable commercial and communications medium, and do not increase their use of mobile and wireless devices, our business may not grow.
In addition, our business may be materially adversely affected if the number of users of mobile and wireless devices does not increase, or if eCommerce and mCommerce do not become more accepted and widespread. The projections, estimates and forecasts in this regard of third parties that we cite in this Form 10-K could prove to be overly optimistic. The use and acceptance of the Internet and of mobile and wireless devices may not increase for any number of reasons, including:
o actual or perceived lack of security for sensitive information, such as credit card numbers;
o congestion of traffic or other usage delays on the Internet;
o inconsistent quality of service or the lack of availability of cost-effective, high-speed service;
o lack of high-speed modems and other communications equipment;
o competing technologies;
o possible outages or other damage to the Internet;
- 15 -
o governmental regulation; and
o uncertainty regarding intellectual property ownership.
Published reports have indicated that capacity constraints caused by growth in the use of the Internet may impede further development of the Internet to the extent that users experience delays, transmission errors and other difficulties. If the necessary infrastructure, products, services or facilities are not developed, or if the Internet does not become a viable and widespread commercial and communications medium, and if individuals and businesses do not increase their use of mobile and wireless devices for mCommerce, our business, financial condition and operating results could be materially adversely affected.
Unless the demand for mutual authentication in mCommerce transactions increases, our growth prospects will be materially adversely affected.
Most of the advantages of our ECC-based technology for mobile and wireless devices over conventional security technology are not applicable to a transaction that does not involve the mutual authentication of both parties to the transaction. The vast majority of eCommerce and mCommerce transactions currently do not involve mutual authentication. Participants in mCommerce have only recently begun to require mutual authentication in some applications, such as enterprise data access and certain high-value transactions. Unless the number of mCommerce transactions involving mutual authentication increases, the demand for our products and services, and our growth prospects, will be materially adversely affected.
Our success depends on ECC technology becoming accepted as an industry standard.
To date, ECC technology has not been broadly accepted. In order for our business to be successful, ECC technology must become accepted as an industry standard, which may never happen. The technology of our principal competitor, RSA Security, is, and has been for the past several years, the de facto standard such for security over open networks like the Internet. RSA Security owns a patent relating to its algorithm that expires in September, 2000. This patented technology should be freely available after that date and may become commoditized. The inexpensive or free availability of such security technology could significantly delay or prevent the acceptance of ECC as a security standard.
Our quarterly operating results are subject to fluctuations and if we fail to meet the expectations of securities analysts or investors in any quarter, our share price could decline significantly.
Our quarterly operating results have historically fluctuated and may fluctuate significantly in the future. Accordingly, our operating results in a particular period are difficult to predict and may not meet the expectations of securities analysts or investors. If this occurs, our share price would likely decline significantly. Factors that may cause our operating results to fluctuate include:
o the level of demand for our products and services as well as the timing of new releases of our products;
o our dependence in any quarter on the timing of a few large sales, as described below;
o our ability to maintain and grow a significant customer base;
o the fixed nature of a significant proportion of our operating expenses, particularly personnel, research and development and facilities;
o costs related to the opening or expansion of our facilities;
o unanticipated product discontinuation, exchange or deferrals by our original equipment manufacturer, or OEM, customers;
o changes in our pricing policies or those of our competitors;
o competition from sources that provide products similar to ours for free;
- 16 -
o currency exchange rate fluctuations and other general economic factors;
o our effectiveness at integrating acquisitions with existing operations; and
o timing of acquisitions and related costs.
Accordingly, we believe that quarter-to-quarter comparisons of our results of operations are not necessarily meaningful. You should not rely on the results of one fiscal quarter as an indication of our future performance.
Our revenues are difficult to predict.
We derive our revenue primarily from sales of our products and services to our OEM customers. Our sales vary in frequency, and OEM customers may or may not purchase our products and services in the future. In addition, our customers may defer the purchase of, or cease using, our products and services at any time, and certain license agreements may be terminated by the customer at any time. Our customer contracts typically provide for base license fees or technology access fees and/or royalties based on a per unit or per usage charge or a percentage of revenue from licensees' products containing our technology, and a number of our large contracts provide that we will not earn additional royalty revenues from those contracts until these customers' shipments exceed certain thresholds specified in the contracts. As a result, our revenues are not recurring from period to period, which makes them more difficult to predict. In addition, estimating future revenue is difficult because we generally ship our products soon after an order is received and, as such, we do not have a significant backlog. Our expense levels are based, in part, on our expectations of future revenues and are largely fixed in the short term. We may not be able to adjust spending in a timely manner to compensate for any unexpected shortfall in revenues.
We may be unable to protect our intellectual property rights, which would materially adversely affect our business.
We rely on one or more of the following to protect our proprietary rights: patents, trademarks, copyrights, trade secrets, confidentiality procedures, and contractual provisions. Despite our efforts to protect our proprietary rights, unauthorized parties may attempt to copy and may succeed in copying aspects of our product designs and products, or obtain and use information we regard as proprietary. Preventing the unauthorized use of our proprietary technology may be difficult because it may be difficult to discover such use. Stopping unauthorized use of our proprietary technology may be difficult, time-consuming and costly. In addition, the laws of some countries in which our products are licensed do not protect our products and services and related intellectual property to the same extent as the laws of Canada, the United States and the European Union. While we believe that at least some of our products are covered by one or more of our patents and these patents are valid, a court may not agree if the matter is litigated. There can be no assurance that we will be successful in protecting our proprietary rights and, if we are not, our business, financial condition and operating results could be materially adversely affected.
Enforcement of intellectual property rights is time consuming and costly and entails the possibility that some or all of our intellectual property rights may be invalid or unenforceable or subject to adverse claims of ownership. None of our patents has faced a challenge in the courts or in front of an administrative body. There is always the possibility that some or all of our patents could be found invalid or unenforceable. Likewise, no one has challenged our trade secrets or copyrights, but there is a possibility that some or all of the rights we believe that we have could be adversely affected by litigation.
We are engaged in joint development projects with certain companies. One of these projects has resulted in the issuance of jointly owned patents. There is always a risk that the companies with which we are working could decide not to commercialize the joint technology and that we may be unable to commercialize joint technology without their consent and/or involvement.
We are members of organizations which set standards. As such, we may be required to license patents that we own which are necessary for practice of the standard. Further, to provide products that are compliant with standards that have been adopted or will be adopted in the future, we may have to license patents owned by others. Such licensing requirements may adversely affect the value of our products.
- 17 -
If the sales of our customers' products decline, our royalty revenue would also decline.
Our licenses to our OEM customers generally provide that royalty payments are not due to us until such time as the licensee both incorporates our technology into its products and ships those products for sale to third parties. Accordingly, our royalty license revenue is linked to our OEM customers' sales, and if those customers' product shipments decline, then our royalty license revenue would also decline.
We depend on sales of our principal products.
We currently derive substantially all our revenue from sales of our cryptographic toolkits and protocol information security toolkits. As a result, any factor adversely affecting sales of these products would have a material adverse effect on our business, financial condition and operating results. Our future financial performance will depend in part on the successful development, introduction and customer acceptance of new and enhanced versions of our cryptographic toolkits and protocol information security toolkits. There can be no assurance that we will continue to be successful in marketing our products or any new or enhanced versions of our products.
Our recently announced products and services may generate little or no revenue.
We recently announced our PKI tools products and our certificate authority service. We cannot accurately predict the future level of acceptance, if any, of these new products by our customers and we may not be able to generate anticipated, or any, revenue from these products.
If we cannot successfully control our product defects and our product liability, our business, financial condition and operating results would be materially adversely affected.
Our products are highly complex and, from time to time, may contain design defects that are difficult to detect and correct. Errors, failures or bugs may be found in our products after commencement of commercial shipments. Even if these errors are discovered, we may not be able to correct such errors in a timely manner or at all. The occurrence of errors and failures in our products could result in adverse publicity and the loss of, or delay in achieving, market acceptance of our products, and correcting such errors and failures in our products could require significant expenditure of capital by us. Our products are integrated into our customers' products. The sale and support of these products may entail the risk of product liability or warranty claims based on damage to such equipment. In addition, the failure of our products to perform to customer expectations could give rise to warranty claims. The consequences of such errors, failures and claims could have a material adverse effect on our business, financial condition and operating results.
The lengthy sales and implementation cycles of our products and services could materially adversely affect us.
We market many of our products and services directly to OEMs. The sale to, and implementation by, OEMs of our products and services typically involve a lengthy education process and a significant technical evaluation and commitment of capital and other resources by them. This process is also subject to the risk of delays associated with their internal budgeting and other procedures for approving capital expenditures, deploying new technologies within their networks and testing and accepting new technologies that affect key operations. As a result, the sales and implementation cycles associated with many of our products and services are generally lengthy, and we may not succeed in closing transactions on a timely basis, or at all. If orders expected for a specific customer for a particular period are not realized, our business, financial condition and operating results could be materially adversely affected.
We anticipate increased operating expenses, which would materially adversely affect our business, financial condition and operating results if we do not correspondingly increase our revenue.
We expect to increase our operating expenses significantly as we:
o expand our sales and marketing operations and develop new distribution channels;
o enhance existing or build additional software development centers;
- 18 -
o enhance our operational and financial systems;
o broaden our customer support capabilities; and
o fund greater levels of research and development.
If we do not significantly increase our revenue to meet these increased operating expenses, our business, financial condition and operating results would be materially adversely affected.
We have only a limited operating history, which makes it difficult to evaluate an investment in our common shares.
We have only a limited operating history. In particular, in 1997 we shipped our first commercial toolkit and entered the U.S. market. Accordingly, our business operations are subject to all the risks inherent in the establishment and maintenance of a new business enterprise, such as competition and viable operations management. Most of our competitors and their products have greater market recognition and acceptance than we or our products do. Our ability to market our products profitably is currently unproven. We may never be able to achieve and sustain profitable operations.
Acquisitions could harm our financial condition and operations.
We acquired Consensus Development Corporation and Uptronics Incorporated in fiscal 1999 and we acquired Trustpoint in fiscal 2000. We may acquire additional businesses, technologies, product lines or services in the future. Acquisitions involve a number of risks, including:
o the difficulty of assimilating the operations and personnel of the acquired business;
o the potential disruption of our business;
o our inability to integrate, train, retain and motivate key personnel of the acquired business;
o the diversion of our management from our day-to-day operations;
o our inability to incorporate acquired technologies successfully into our products and services;
o the additional expense associated with completing an acquisition and amortizing any acquired intangible assets;
o increased demands for liquidity;
o the potential impairment of relationships with our employees, customers and strategic partners; and
o the inability to maintain uniform standards, controls, procedures and policies.
In addition, we may not be able to maintain the levels of operating efficiency that any acquired companies had achieved or might have achieved separately. Successful integration of each of their operations would depend upon our ability to manage those operations and to eliminate redundant and excess costs. As a result of difficulties associated with combining operations, we may not be able to achieve the cost savings and other benefits that we would hope to achieve with these acquisitions.
Given that our management will have to devote time and attention to integrate the technology, operations and personnel of the businesses we acquire, we may not be able to serve our current customers properly or attract new customers. Also, our management faces the difficult and potentially time consuming challenge of implementing uniform standards, controls, procedures and policies throughout our various offices. Any difficulties in this process could disrupt our ongoing business, distract our management, result in the loss of key personnel or customers, increase our expenses and otherwise materially adversely affect our business, financial condition and operating results.
- 19 -
In the event of any future acquisitions, we could issue equity shares, which would dilute our existing shareholders' equity interests, incur debt or assume liabilities. We cannot assure you that we would be able to obtain any additional financing on satisfactory terms, or at all, and this failure would have a material adverse effect on our business, financial condition and operating results. Additional indebtedness would make us more vulnerable to economic downturns and may limit our ability to withstand competitive pressures. The terms of any additional indebtedness may include restrictive financial and operating covenants, which would limit our ability to compete and expand.
Our business strategy also includes strategic investments and joint ventures with other companies. These transactions are subject to many of the same risks identified above for acquisitions.
We depend on key personnel for our future success and we have no protection if they leave us.
Our success is largely dependent on the performance of our key employees, particularly Scott A. Vanstone, our Chief Cryptographer. Most of our key technical and senior management personnel are not bound by employment agreements. Loss of the services of any of these key employees could have a material adverse effect on our business, financial condition and operating results. We do not maintain key person life insurance policies on any of our employees.
We may not be able to attract or retain qualified personnel.
Competition for qualified personnel in the digital information security industry is intense, and finding and retaining qualified and experienced personnel in the San Francisco Bay Area is difficult. We believe there are only a limited number of individuals with the requisite skills to serve in many of our key positions, and it is becoming increasingly difficult to hire and retain these persons. Competitors and others have in the past and may attempt in the future to recruit our employees. A major part of our compensation to our key employees is in the form of stock option grants. A prolonged depression in our share price could make it difficult for us to retain employees and recruit additional qualified personnel. For example, to address this concern, in fiscal 1999, we repriced certain outstanding employee stock options, as described in Note 7 to our consolidated financial statements included elsewhere in this Form 10-K. In addition, the volatility and current market price of our common shares may make it difficult to attract and retain personnel.
If we are unable to manage our growth, our business would be disrupted.
We have experienced a period of significant growth in our sales and personnel that has placed strain upon our management systems and resources. Our sales increased from $4.0 million in fiscal 1999 to $12.0 million in fiscal 2000. During the same period, the number of our employees increased from 102 to 165. We intend to continue to grow in the foreseeable future and to pursue existing and potential market opportunities, including acquisitions. Our growth has placed, and will continue to place, significant demands on our management and operational resources, particularly with respect to:
o recruiting and retaining skilled technical, marketing and management personnel in an environment where there is intense competition for skilled personnel;
o managing a larger, more complex international organization;
o expanding our facilities and other infrastructure in a timely manner to accommodate a significantly larger global workforce;
o maintaining and expanding a cutting edge research and development staff;
o expanding our sales and marketing efforts;
o providing adequate training and supervision to maintain our high quality standards;
o expanding our treasury and accounting functions to meet the demands of a growing company;
- 20 -
o strengthening our financial and management controls in a manner appropriate for a larger enterprise; and
o preserving our culture, values and entrepreneurial environment.
Our management has limited experience managing a business of our size and, in order to manage our growth effectively, we must concurrently develop more sophisticated operational systems, procedures and controls. If we fail to develop these systems, procedures and controls on a timely basis, our business, financial condition and operating results could be materially adversely affected.
If we do not successfully transition our financial, accounting and treasury systems from Canada to California on a timely basis, our business could be materially adversely affected.
Since November 30, 1999, we have appointed a new Chief Executive Officer and a new Chief Financial Officer, both of whom are located in our Hayward, California office rather than our Mississauga, Ontario office. We intend to move our internal financial, accounting and treasury functions from Mississauga to Hayward. There is a risk that these changes could cause significant disruption in our company and adversely affect these critical functions. If that were to occur, our business, financial condition and operating results could be materially adversely affected.
If we fail to develop and maintain our strategic relationships, our business would be materially adversely affected.
One of our business strategies has been to enter into strategic or other collaborative relationships with many of our OEM customers to develop new technologies and leverage their sales and marketing organizations. We may need to enter into additional relationships to execute our business plan. We may not be able to enter into additional, or maintain our existing, strategic relationships on commercially reasonable terms. In such case, we may have to devote substantially more resources to the development of new technology and the distribution, sales and marketing of our digital information security products and services than we would otherwise. Failure of one or more of our strategic relationships could materially adversely affect our business, financial condition and operating results.
We do not insure against all potential losses and we could be seriously harmed and our reputation damaged by unexpected liabilities.
Many of our products provide benefits to our clients' businesses that are difficult to quantify. Any failure in a client's system could adversely affect our reputation and result in a claim for substantial damages against us, regardless of our responsibility for such failure. Although we generally attempt to limit our contractual liability for damages arising from negligent acts, errors, mistakes or omissions in rendering our services, we have not been, and cannot assure you that we will be, able to do so in all cases or that any limitations of liability set forth in our agreements will be enforceable in all instances or will otherwise protect us from liability for damages. In addition, our failure to meet client expectations or to deliver error free services may result in adverse publicity for us and damage to our reputation.
We maintain general liability insurance coverage, including coverage for errors or omissions. However, we cannot assure you that:
o insurance coverage will be available to us in sufficient amounts to cover one or more significant claims that are successfully asserted against us;
o insurance coverage will continue to be available to us in the future on reasonable terms, including reasonable premium, deductible and co-insurance requirements; or
o our insurer will not disclaim coverage of any future claim.
Our business, financial condition and operating results could be materially adversely affected if any of these developments were to occur.
- 21 -
Our share price is, and likely will continue to be, volatile.
We expect that the market price of our common shares may fluctuate substantially as a result of variations in our quarterly operating results. These fluctuations may be exaggerated if the trading volume of our common shares is low. In addition, due to the technology-intensive and emerging nature of our business, the market price of our common shares may fall dramatically in response to a variety of factors, including:
o announcements of technological or competitive developments;
o acquisitions or entry into strategic alliances by us or our competitors;
o the gain or loss of a significant customer or strategic relationship;
o changes in estimates of our financial performance or changes in recommendations by securities analysts regarding us, our industry or our customers' industries; and
o general market or economic conditions.
This risk may be heightened because our industry is new and evolving, characterized by rapid technological change and susceptible to the introduction of new competing technologies or competitors.
In addition, equity securities of many technology companies have experienced significant price and volume fluctuations. These price and volume fluctuations often have been unrelated to the operating performance of the affected companies. Volatility in the market price of our common shares could result in securities class action litigation. This type of litigation, regardless of the outcome, could result in substantial costs to us and a diversion of our management's attention and resources.
In May, 2000, we listed and began trading on the Nasdaq National Market. We cannot predict the extent to which investor interest in our common shares will continue to support a trading market in the United States or how liquid that market might become. As discussed earlier, our financial results are difficult to predict and could fluctuate significantly.
System interruptions and security breaches could materially adversely affect our business.
We plan to construct what we believe will be a secure data center. We will depend on the uninterrupted operation of that data center. We will need to protect this center and our other systems from loss, damage or interruption caused by fire, power loss, telecommunications failure or other events beyond our control. In addition, most of our systems and the data center may be located, and most of our customer information may be stored, in the San Francisco, California area, which is susceptible to earthquakes. Any damage or failure that causes interruptions in our data center and our other computer and communications systems could materially adversely affect our business, financial condition and operating results.
Our success also depends upon the scalability of our systems. Our systems have not been tested at the usage volumes that we expect will be required in the future. Thus, a substantial increase in demand for our products and services could cause interruptions in our systems. Any such interruptions could affect our ability to deliver our services and our business, financial condition and operating results.
Although we periodically perform, and retain accredited third parties to perform, evaluations of our operational controls, practices and procedures, we may not be able to remain in compliance with our internal standards or those set by these third parties. If we fail to maintain these standards, we may have to expend significant time and money to return to compliance and our business, financial condition and operating results could be materially adversely affected.
We will retain certain confidential customer information in our planned data center. It is important to our business that our facilities and infrastructure remain secure and be perceived by the marketplace to be secure. Despite our security measures, our infrastructure may be vulnerable to physical break-ins, computer viruses, attacks by hackers or similar disruptive problems. It is possible that we may have to expend additional financial and other
- 22 -
resources to address these problems. Any physical or electronic break-ins or other security breaches or compromises of the information stored at our planned data center may jeopardize the security of information stored on our premises or in the computer systems and networks of our customers. In such an event, we could face significant liability and customers could be reluctant to use our products and services. Such an occurrence could also result in adverse publicity and adversely affect the market's perception of our products and services, which would materially adversely affect our business, financial condition and operating results.
We do not expect to be able to use our Canadian tax credits and loss carry forwards fully before they expire over the next several years.
As of April 30, 2000, we had $0.6 million in Canadian investment tax credits and $32.4 million in Canadian loss carry forwards. These Canadian tax credits can be used to offset only our Canadian tax liabilities in the ten years following incurrence. The Canadian loss carry forwards can be used to offset only our Canadian taxable income in the seven years following incurrence. Given that approximately 91% of our revenue was generated in the United States in fiscal 2000, we may not be able to use all our Canadian tax credits or loss carry forwards before they expire over the next several years.
We have limited financial resources and will likely require additional financing that may not be available.
Our financial resources are substantially smaller than the financial resources of our current principal and potential competitors. We will likely require additional equity or debt financing in the future. There can be no assurance that we will be able to obtain the additional financial resources required to successfully compete in our markets on satisfactory terms or at all. Failure to obtain such financing could result in the delay or abandonment of some or all of our plans for development, which could have a material adverse effect on our business, financial condition and operating results.
Risks Related to the Digital Information Security Industry
Public-key cryptography technology is subject to the risk that it will be successfully attacked or decoded.
Our digital information security products and services are largely based on public-key cryptography technology. With public-key cryptography technology, a user has both a public key and a private key. The security afforded by this technology depends on the integrity of a user's private key and on it not being stolen or otherwise compromised. The integrity of private keys also depends in part on the application of certain mathematical principles such as factoring and elliptic curve discrete logarithms. This integrity is predicated on the assumption that solving problems based on these principles is difficult. Should a relatively easy solution to these problems be developed, then the security of encryption products using public-key cryptography technology would be reduced or eliminated. Furthermore, any significant advance in techniques for attacking cryptographic systems could also render some or all of our products and services obsolete or unmarketable. Even if no breakthroughs in methods of attacking cryptographic systems are made, factoring problems or elliptic curve discrete logarithm problems can theoretically be solved by computer systems significantly faster and more powerful than those currently available. In the past, there have been public announcements of the successful decoding of certain cryptographic messages and of the potential misappropriation of private keys. Such publicity could also adversely affect the public perception as to the safety of public-key cryptography technology. Furthermore, an actual or perceived breach of security at one of our customers, whether or not due to our products, could result in adverse publicity for us and damage to our reputation. Such adverse public perception or any of these other risks, if they actually occur, could materially adversely affect our business, financial condition and operating results. See "Business--Cryptographic Systems and Elliptic Curve Cryptography."
Product development and technological change could materially adversely affect us.
The digital information security industry is an emerging industry that is characterized by rapid technological change and frequent new product introductions. Accordingly, we believe that our future success depends upon our ability to enhance our current products and develop and introduce new products offering enhanced performance and functionality at competitive prices. In addition, technological innovation in the marketplace, such as in the areas of mobile processing power or, wireless bandwidth, or the development of new cryptosystems, may reduce the comparative benefits of our products and could materially adversely affect our business, financial
- 23 -
condition and operating results. Our inability, for technological or other reasons, to enhance, develop and introduce products in a timely manner in response to changing market conditions, industrial standards, customer requirements or competitive offerings could result in our products becoming obsolete, or could otherwise have a material adverse effect on our business, financial condition and operating results. Our ability to compete successfully will depend in large measure on our ability to maintain a technically competent research and development staff and to adapt to technological changes and advances in the industry, including providing for the continued compatibility of our products with evolving industry standards and protocols.
We face intense competition that could materially adversely affect us.
We operate in a dynamic and evolving industry that is highly competitive. We anticipate that the quality, functionality and breadth of our competitors' product offerings will improve. Most of our competitors have greater name recognition, larger customer bases and significantly greater financial, technical, marketing, public relations, sales, distribution and other resources than we do. We compete in a new and rapidly evolving market and there can be no assurance that we will be able to compete effectively with such companies. In addition, we could face competition from our OEMs in the event that some or all of them develop and distribute their own systems. We also could be materially adversely affected if there were a significant movement towards the acceptance of open source solutions that compete with our products.
We expect that additional competition will develop, both from existing businesses in the digital information security industry and from new entrants, as demand for digital information products and services expands and as the market for these products and services becomes more established. We may not be able to compete successfully and competitive pressures may harm our business. Our largest competitors include RSA Security, which licenses the de facto Internet security standard, VeriSign, Baltimore and Entrust.
The technology and wireless industry may fail to grow significantly, which would materially adversely affect our growth.
There can be no assurance that the market for our existing products and services will continue to grow, that firms within the industry will adopt our products and services, or that we will be successful in independently establishing markets for our products and services. If the various markets in which our, and our OEM customers', products and services compete fail to grow, or grow more slowly than we currently anticipate, or if we are unable to establish markets for our new products and services, our revenue and net income may be lower than expected.
Disputes over intellectual property rights are common in our industry and, if we become involved in such a dispute, we could be materially adversely affected.
The industry in which we compete has many participants who own, or claim to own, intellectual property. We indemnify our licensees against third-party intellectual property claims based on our technology. Claims relating to intellectual property by any third-party business, individual or university, whether or not with merit, could be time-consuming to evaluate, result in costly litigation, cause product shipment delays for products or the cessation of the use and sale of products or services, or require us to enter into licensing agreements that may require the payment of a license fee and/or royalties to the owner of the intellectual property. Such licensing agreements, if required, may not be available on royalty or other licensing terms acceptable to us. Any of these situations would materially adversely affect our business, financial condition and operating results. We also currently license third party technology for use in our products and services. These third party technology licenses may not continue to be available on commercially reasonable terms or may not be available at all. Our business could be materially harmed if we lose the rights to certain technology.
We could be materially adversely affected by government regulation.
The digital information security industry is governed by regulations that could have a material adverse effect on our business. The export of strong cryptographic equipment and software, including many of our products, is regulated by both the U.S. and Canadian governments. Governments could seek to impose taxes on companies that engage in electronic commerce or which are involved in other markets where we sell our products and services. It is also possible that laws could be enacted covering issues such as user privacy, pricing, content and quality of products and services in these markets. Such regulations, taxes and laws could materially adversely affect our sales
- 24 -
and our OEM customers' sales. Foreign governments could adopt regulations that are detrimental to our interests. For example, the Chinese government has recently implemented legislation that requires all companies exporting to or operating in China to provide sensitive information to the government about their encryption software and users. This legislation also includes provisions (which very recently may have been effectively reversed) requiring that all electronic products in China use encryption software developed in China. This legislation and similar intrusive regulations by other countries could cause us to compromise our source code protection, minimize our intellectual property protection, negatively impact our plans for global expansion and consequently materially adversely affect our business, financial condition and operating results.
Risks Related to Our Corporate Charter; Limitations on Dividends
We have a shareholder rights plan that could delay or prevent an acquisition of us even if an acquisition would be beneficial to our shareholders.
We have adopted a shareholder rights plan. The provisions of this plan could make it more difficult for a third party to acquire a majority of our outstanding voting shares, the effect of which may be to deprive our shareholders of a control premium that might otherwise be realized in connection with an acquisition of us.
The anti-takeover effect of certain of our charter provisions could delay or prevent an acquisition of us even if an acquisition would be beneficial to our shareholders.
Our authorized capital consists of an unlimited number of common shares and an unlimited number of preference shares issuable in one or more series. Our board of directors has the authority to issue preference shares and determine the price, designation, rights, preferences, privileges, restrictions and conditions, including voting and dividend rights, of these shares without any further vote or action by shareholders. The rights of the holders of common shares will be subject to, and may be adversely affected by, the rights of holders of any preference shares that may be issued in the future. The issuance of preference shares, while providing desirable flexibility in connection with possible acquisitions and other corporate purposes, or the issuance of additional common shares could make it more difficult for a third party to acquire a majority of our outstanding voting shares, the effect of which may be to deprive our shareholders of a control premium that might otherwise be realized in connection with an acquisition of our Company.
We do not currently intend to pay any cash dividends on our common shares in the foreseeable future.
We have never paid or declared any cash dividends on our common shares and we currently intend to retain any future earnings to finance the development and expansion of our business. We do not anticipate paying any cash dividends on our common shares in the foreseeable future. In addition, any dividends paid to residents of the United States would be subject to Canadian withholding tax, generally at the rate of 15%.
Item 2.
Item 2. PROPERTIES
We maintain our U.S. corporate offices and worldwide sales and marketing, finance, custom design and systems integration and administration operations at leased premises totaling approximately 111,000 square feet at 25801 and 25821 Industrial Boulevard, Hayward, California. The lease for this facility expires February 28, 2006. We also lease approximately 30,300 square feet of office space at 5520 Explorer Drive, Mississauga, Ontario, which contains our Canadian administrative offices, customer support, cryptographic research, engineering and custom design and systems integration functions. The lease for this facility expires December 15, 2009. We also lease short-term, executive suite office space in Reston, Virginia which services the Washington, D.C. area. The total annual base rent for all three facilities is currently approximately $1,733,000.
Item 3.
Item 3. LEGAL PROCEEDINGS
We are currently not subject to any material litigation. We have received a letter on behalf of Carnegie Mellon University asserting that it owns the trademark "CERT", and that it believes our use of the stock symbol "CERT" on the Nasdaq National Market will cause confusion with and/or dilute its trademark. Although we intend
- 25 -
to defend our use of the stock symbol "CERT" vigorously, there can be no assurance that we will be successful in doing so, or that this dispute with the university will not have a material adverse impact on us.
We have also received a letter on behalf of Geoworks, Inc. asserting that it holds a patent on certain aspects of technology which are part of the WAP standard, and that it believes that our WTLS Plus toolkit implements such technology. After an internal investigation, it is our belief that we do not implement any validly patented technology. We have also become aware of a letter circulated on behalf of a Mr. Bruce Dickens asserting that he holds a patent on certain aspects of technology which are implemented within certain aspects of the Secure Sockets Layer standard. After an internal investigation, it is our belief that we do not implement any validly patented technology. Although we intend to vigorously defend any litigation that may arise on these matters, there can be no assurance that we will be successful in doing so, or that such disputes will not have a material adverse impact on us. In addition, we recently became aware of a letter on behalf of a Mr. Leon Stambler asserting that he holds a patent on certain aspects of technology which are implemented within the Secure Sockets Layer standard. This latter matter is currently undergoing internal review of the technological and legal issues to determine an appropriate response, therefore there can be no assurance that such asserted patent will not have a material adverse impact upon us.
Item 4.
Item 4. SUBMISSION OF MATTERS TO A VOTE OF SECURITY HOLDERS
- 26 -
PART II
Item 5.
Item 5. MARKET FOR THE COMPANY'S COMMON SHARES AND RELATED SHAREHOLDER MATTERS
On July 12, 2000, we completed a two-for-one split of our outstanding common shares. As of June 30, 2000, there were 25,649,054 common shares issued and outstanding. Except as otherwise indicated, all of the prices in the preceding table, and elsewhere in this document and all of the common share numbers in this document, reflect this split. On July 20, 2000, the last reported sale price of the common shares on the Nasdaq National Market was $34.38 (Cdn. $50.70) and on the Toronto Stock Exchange was Cdn.$50.50 ($34.24).
Use of Proceeds from Public Offering
On May 3, 2000, we completed the public offering of 2,500,000 common shares in the United States and Canada at a per share price of U.S.$23.15, for an aggregate offering price of U.S.$57,875,000. The shares were offered pursuant to a Form Registration Statement filed with the U.S. Securities and Exchange Commission under Registration No. 333-11586, and began trading on the Nasdaq National Market on May 2, 2000. Our placement agent for the offering was FleetBoston Robertson Stephens, Inc. After deducting underwriting discounts and commissions and offering expenses, our net proceeds from the offering were approximately U.S.$51,500,000.
On May 5, 2000, we used a portion of the proceeds of the offering to repay a $10 million loan obtained from Sand Hill Capital II, LP in April, 2000. We intend to use the remaining net proceeds from that offering for the expansion of our sales and marketing activities, including hiring additional sales personnel and opening new sales offices in Europe and the Asia Pacific region, the development and enhancement of our products and services, working capital and general corporate purposes.
We may also use a portion of the net proceeds of that offering to fund strategic investments or acquisitions. While we have from time to time had preliminary discussions regarding potential investments and acquisitions in the ordinary course of our business, we do not currently have any agreements to make any such investment or acquisition.
- 27 -
Except as indicated above, we have not yet determined the amount of the net proceeds to be used specifically for the purposes specified above. Pending such uses, we expect to invest the net proceeds in short-term, interest-bearing, investment grade securities.
Sales of Unregistered Securities
On January 26, 2000, in connection with our acquisition of Trustpoint of Mountain View, California, we issued 201,120 common shares to the former owners of Trustpoint. We also converted outstanding stock options of Trustpoint into options to acquire 98,884 of our common shares.
During the fiscal year ended April 30, 2000, the following common shares were issued pursuant to the exercise of stock options:
------------------------ ---------------------- ---------------------- Month Number of Shares Exercise price ------------------------ ---------------------- ---------------------- June 7,666 $1.72 ------------------------ ---------------------- ---------------------- August 7,136 $1.09 ------------------------ ---------------------- ---------------------- October 62,812 $3.65 ------------------------ ---------------------- ---------------------- November 127,948 $4.58 ------------------------ ---------------------- ---------------------- December 361,272 $5.02 ------------------------ ---------------------- ---------------------- January 89,824 $3.72 ------------------------ ---------------------- ---------------------- February 55,612 $3.57 ------------------------ ---------------------- ---------------------- March 127,190 $4.79 ------------------------ ---------------------- ---------------------- April 10,540 $2.42 ------------------------ ---------------------- ----------------------
The exercise price shown above is the weighted-average price based on the shares issued in the month. The exchange rate is based on the average rate for the fiscal quarter.
To the extent sales described above occurred outside the United States, they were not required to be registered under United States securities laws. Those issuance of the above-described securities occurring within the United States were deemed to be exempt from registration under the U.S. Securities Act of 1933 either in reliance on Section 4(2) of the U.S. Securities Act of 1933 as transactions by an issuer not involving any public offering, or in reliance upon Rule 701 promulgated under the U.S. Securities Act of 1933 and in reliance on related state "blue sky" law exemptions as transactions pursuant to compensatory benefit plans and contracts relating to compensation.
Dividend Policy
We have never declared or paid any cash dividends on any of our common shares. We currently intend to retain earnings to finance the growth and development of our business and, therefore, we do not anticipate paying any cash dividends in the foreseeable future. Our dividend policy will be reviewed from time to time by our board of directors in the context of our earnings, financial condition and other relevant factors.
Holders of Common Shares
As of June 30, 2000, there were approximately 136 record owners of our common shares. This number of shareholders does not include shareholders whose shares are held in trust by other entities. The actual number of beneficial owners of our common shares is greater than the number of holders of record.
- 28 -
Item 6.
Item 6. SELECTED CONSOLIDATED FINANCIAL DATA
Item 7.
Item 7. MANAGEMENT'S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS
Overview
We are an encryption technology company specializing in security solutions for mobile computing and wireless data markets, including mobile eCommerce, or mCommerce. Our solutions often use less processing power and bandwidth than conventional encryption technologies, and are therefore more suitable for many mobile and wireless environments. Our OEM customers incorporate our patented technology into their applications for handheld computers, mobile phones, two-way pagers and other Internet information appliances. As these devices communicate increasingly sensitive and valuable information, we believe the demand for stronger security will increase.
- 29 -
Our product line includes cryptographic and information security protocol toolkits. We have announced for availability later this year public-key infrastructure, or PKI, products and certificate authority, or CA, services. In addition to licensing our security products, we provide consulting and systems integration services to assist our customers in designing and implementing efficient security solutions. Our customers include 724 Solutions, Aether Systems, BellSouth Wireless Data, Motorola, Palm, Inc., PUMATECH, Inc. and QUALCOMM.
We were founded in 1985 and are governed by the laws of the Yukon Territory, Canada. We determined that commencing May 1, 1999 our functional currency was the U.S. dollar and, accordingly, we began measuring and reporting our results of operations in U.S. dollars from that date. We changed our functional currency as we derive a majority of our revenues and incur a significant portion of our expenses in U.S. dollars.
The following discussion and analysis relates to our financial statements that have been prepared in accordance with U.S. GAAP.
Sources of Revenue and Revenue Recognition Policy
We derive our revenues from a variety of sources, which we generally classify as software licensing, consulting and systems integration and hardware. We earn software licensing revenues from one-time base license fees or technology access fees, royalties based upon per unit or per usage charges or a percentage of the revenue from licensees' products containing our technology and annual maintenance and support fees. In addition, a small amount of our revenue comes from annual license fees under licenses entered into by Consensus Development Corporation, or Consensus, prior to our acquisition of Consensus. Our license agreements may permit the licensee to sublicense without us receiving any revenue from the sub-licensees. Consulting and systems integration revenue is derived from the performance of contracted services to licensees and can be based upon a time-and-materials framework or a fixed contract for a complete solution. Hardware revenues comprise sales of products manufactured by third parties to our specifications, and components procured by third parties and resold by us.
We generally negotiate sales contracts with our customers and we generally do not use standardized contracts. However, each of our contracts (other than our contracts for consulting and systems integration or hardware sales) includes provisions for us to receive an up-front license fee and royalties. Our royalties for mobile and wireless devices generally range from $1.00 to $5.00 per unit, with other amounts if the royalties are calculated on a per user or usage basis or as a percentage of revenue.
In the fiscal year ended April 30, 2000, our software licensing revenue, consulting and systems integration revenue and hardware revenue represented approximately 77%, 16% and 7%, respectively, of our total revenue. In the same period, approximately 91% of our total revenue was derived from sales in the United States, while 4% of our total revenue was derived from sales in Canada.
In the fiscal year ended April 30, 1999, our software licensing revenue, consulting and systems integration and hardware revenue represented approximately 66%, 24% and 10%, respectively, of our total revenue. In the same period, approximately 76% of our total revenue was derived from sales in the United States, while 15% and 9% of our total revenue were derived from sales in Canada and Europe, respectively.
We recognize software licensing revenue in accordance with all applicable accounting regulations including the American Institute of Certified Public Accountants Statement of Position ("SOP") 97-2, "Software Revenue Recognition", as amended. Following the requirements of SOP 97-2, we recognize license revenues when all the following conditions are met:
o we have signed a non-cancelable license agreement with the customer;
o we have delivered the software product to the customer;
o the amount of the fees to be paid by the customer are fixed or determinable; and
o we believe that collection of these fees is probable.
- 30 -
Maintenance and support services revenue is recognized ratably over the period, usually one-year. Revenue derived from consulting and systems integration are recognized upon performance of the related services.
In the fiscal year ended April 30, 2000, over 97% of our revenue was generated in U.S. dollars. In the same period, approximately 33% of our expenses were incurred in Canadian dollars, and the balance was incurred in U.S. dollars and other currencies.
We expect that a majority of our revenue will continue to be generated in U.S. dollars for the foreseeable future and that a portion of our expenses, including labor costs as well as capital and operating expenditures, will continue to be denominated in Canadian dollars. If the Canadian dollar appreciates against the U.S. dollar, our results of operations could be materially adversely affected.
Costs and Expenses
Our costs and expenses consist of selling and marketing, research and development, depreciation and amortization, general and administrative, purchased in-process research and development, consulting and systems integration and cost of hardware sold. Our selling and marketing expenses consist primarily of employee salaries and commissions, and include related travel, public relations and corporate communications costs and trade shows, marketing programs and market research. Research and development expenses consist primarily of employee salaries, sponsorship of cryptographic research activities at various universities, participation in various cryptographic, wireless and eCommerce standards associations and related travel and other costs. Depreciation and amortization represents the allocation to income of the cost of fixed assets and intangibles over their estimated useful lives. General and administrative expenses consist primarily of salaries and other personnel-related expenses for executive, financial and administrative personnel. Purchased in-process research and development expenses represent the value of in-process projects under development acquired in a business combination for which technological feasibility has not been established. Consulting and systems integration expenses consist primarily of salaries and travel. Our cost of hardware sold consists primarily of the component cost of our hardware products manufactured by third parties to our specifications as well as the procured costs of third-party hardware.
In anticipation of business growth, we expect to incur significantly higher selling and marketing, research and development, and general and administrative expenses and capital expenditures in subsequent periods. We may not continue to grow at a pace that will support these costs and expenditures. To the extent that our revenue does not increase at a rate commensurate with these additional costs and expenditures, our results of operations and liquidity would be materially adversely affected.
Net Losses
We have incurred significant annual and quarterly net losses and losses from our operations since our inception, and we expect to incur significant net losses and operating losses on both an annual and quarterly basis for at least the next few years as we grow our business by hiring additional personnel and increase marketing and capital expenditures. Furthermore, given the rapidly evolving nature of our business and fluctuations in the timing of our sales, our operating results are difficult to forecast and, accordingly, our historical financial results may not be meaningful assessments of our future business operations or prospects. We believe that other factors will be more significant indicators of our future business operations or prospects, including the pace of deployment of mCommerce products and services, the acceptance of ECC as a cryptographic standard and the extent and timing of our royalty revenues.
We pay taxes in accordance with U.S. federal, state and local tax laws and Canadian federal, provincial and municipal tax laws. We do not expect to pay any significant corporate income taxes in Canada in the foreseeable future because we have significant Canadian tax credits and loss carry-forwards. Our effective tax rate in the fiscal years ended April 30, 2000 and 1999 was approximately 1.9% and (0.6)%, respectively.
Acquisitions
On July 29, 1998, we acquired all of the outstanding common shares of Consensus, of Berkeley, California, a supplier of applied security development tools and the manufacturer of the SSL Plus toolkit, a widely deployed toolkit for the secure sockets layer, or SSL, protocol. SSL is the dominant security protocol on the Internet,
- 31 -
specifying session-based encryption and authentication, and is used in virtually all Internet browsers and commerce servers. The acquisition was completed for cash consideration of approximately $3.0 million, plus the issuance of 1,894,622 of our common shares. We also converted outstanding stock options of Consensus to options to acquire 799,818 of our common shares. The total consideration for the acquisition was approximately $24.5 million. On November 24, 1998, we acquired all of the outstanding common stock of Uptronics Incorporated, or Uptronics, of Sunnyvale, California, a provider of cryptographic consulting and security systems integration services to OEMs for a cash consideration of approximately $0.5 million and the issuance of 431,344 of our common shares. The total consideration was approximately $2.0 million. On January 26, 2000, we acquired all the outstanding shares of common stock of Trustpoint of Mountain View, California, a developer of public-key infrastructure, or PKI, products. OEMs use PKI products to develop applications with the digital certificate service built-in. The principal benefit to us of this acquisition was that we acquired Trustpoint's software and hired Trustpoint's four employees. The acquisition was completed with the issuance of 201,120 of our common shares. We also converted outstanding stock options of Trustpoint into options to acquire 98,884 of our common shares. The total consideration for the acquisition was approximately $10.5 million. These acquisitions were accounted for by the purchase method and the results of operations were included in our consolidated statements of operations from the dates of acquisition.
Results of Operations
Our consolidated financial statements contained in this Form 10-K are reported in U.S. dollars and are presented in accordance with U.S. GAAP.
Although we have experienced substantial growth in revenues in recent periods, we have incurred substantial operating losses since our inception and we may incur substantial operating losses in the foreseeable future. As of April 30, 2000, we had an accumulated deficit of approximately $54.3 million. We expect to incur additional losses for at least the next few years, and we may never achieve profitability. We intend to invest heavily in sales and marketing and the development and enhancement of our product and service offerings.
Fiscal Year Ended April 30, 2000 Compared to Fiscal Year Ended April 30, 1999
Revenue. Revenue for fiscal 2000 was $12.0 million, a 200% increase from $4.0 million in fiscal 1999. The increase was primarily attributable to increased software licensing, which grew to approximately $9.3 million, a 247% increase over $2.7 million in fiscal 1999. The increase in software licensing revenue was primarily a result of a growing market awareness of our products and, to a lesser extent, an expanded sales force. In addition, consulting and systems integration revenue grew 105% from fiscal 1999 to 2000, to $2.0 million from $1.0 million. We added resources in this area and focused our activities on larger scale projects, thereby contributing to the increase in revenue, a trend that we believe will continue. Hardware sales grew 95% to $0.8 million for fiscal 2000, but
- 32 -
decreased as a percentage of revenue to 7% versus 10% in fiscal 1999. We anticipate that hardware sales will remain at this percentage level for the foreseeable future.
Selling and Marketing. Selling and marketing expenses were $6.6 million for the year ended April 30, 2000 versus $6.1 million for the same period in fiscal 1999. We anticipate this area to increase considerably as we add more personnel and expand into Europe and the Asia Pacific region.
Research and Development. We have capitalized certain costs associated with the filing of approximately sixty patent applications in various jurisdictions. These patent filings are in the areas of ECC, various mathematical computational methodologies, security protocols and other cryptographic inventions. Once granted, we amortize the individual patent cost over three years. We capitalize patents not yet granted at their cost less a provision for the possibility of the patent not being granted or abandoned. Our research and development expenses for fiscal 2000 increased 37% relative to fiscal 1999, to $4.4 million as a result of new product development in the public-key infrastructure area. We expect that these expenses will continue to increase in the foreseeable future as we add additional engineering resources and continue to grow our technical capabilities to support the growth of our business.
Depreciation and Amortization. Depreciation and amortization increased to $7.9 million in fiscal 2000 compared to $5.1 million in fiscal 1999. The primary reason for the increase was that our results for fiscal 2000 included full-year amortization expenses relating to our acquisitions of Consensus and Uptronics and partial year amortization expense relating to our acquisition of TrustPoint while our results for fiscal 1999 included only partial year amortization expenses relating to our acquisitions of Consensus and Uptronics. We acquired Consensus and Uptronics during fiscal 1999 and TrustPoint during fiscal 2000.
General and Administrative. General and administrative expenses increased 66% in fiscal 2000 to $7.1 million from $4.3 million for fiscal 1999. The primary reason for this increase was the increase in our infrastructure in California.
Purchased In-process Research and Development. For fiscal 2000, we recorded a charge for purchased in-process research and development as a result of our acquisition of Trustpoint. In connection with this acquisition, we used third-party appraisers' estimates to determine the value of in-process projects under development for which technological feasibility had not been established. The total value of these projects at the time of the acquisition was determined to be approximately $0.5 million and was expensed in fiscal 2000. The value of the projects was determined by estimating the costs to develop the in-process technology into commercially feasible products, estimating the net cash flows which we believed would result from the products and discounting these net cash flows back to their present value.
Consulting and Systems Integration. Consulting and systems integration expenses were $2.1 million for fiscal 2000, a 254% increase over $0.6 million for fiscal 1999. This was primarily a result of incurring the full year of expenses associated with our consulting and systems integration group acquired from Uptronics, only five months of which were recorded in the previous year. In addition, we increased the number of engineers in this group in order to keep up with the growing demand from our customers. We expect that this trend will continue as we continue to add resources to this group.
Cost of Hardware Sold. Cost of hardware sold increased 363% in fiscal 2000 to approximately $0.6 million from $0.1 million in fiscal 1999. This increase is primarily due to higher hardware sales. This increase is also attributable to a shift in product mix with a greater proportion of hardware sales being generated by sales of higher cost third party procured hardware.
Interest and Other Income (Expense). For fiscal 2000, interest expense was $0.4 million compared to interest income of $1.0 million for fiscal 1999. This decrease was a result of a reduction in the amount of marketable securities invested during the year as funds were applied to meet our cash requirements. This decrease also consists of currency adjustments, primarily Canadian to U.S. dollars.
Income Taxes. Income tax expense was $0.3 million for fiscal 2000 compared to a recovery of $0.1 million in fiscal 1999, which arose due to the receipt of Scientific Research and Experimental Development Tax Credits in
- 33 -
Canada. Income taxes were solely a result of our operations in the United States, including those of Consensus and Uptronics. We have significant tax credits and tax loss carry-forwards in Canada.
Net Loss. Our net loss increased 16% in fiscal 2000 to $17.9 million ($0.80 per share basic and diluted) compared to $15.4 million ($0.73 per share basic and diluted) in the previous fiscal year. This increase was predominately attributable to the amortization of acquisition-related intangibles. The loss before interest income, depreciation and amortization, and taxes amounted to $9.3 million in fiscal 2000 ($0.42 per share basic and diluted), an 18% decrease over $11.4 million ($0.55 per share basic and diluted) for fiscal 1999.
Fiscal Year Ended April 30, 1999 Compared to Fiscal Year Ended April 30, 1998
Revenue. Revenue for fiscal 1999 was $4.0 million, a 228% increase from approximately $1.2 million in fiscal 1998. The increase was primarily attributable to increases in software licensing and consulting and systems integration revenue. Software licensing revenue increased to $2.7 million in fiscal 1999 from $0.5 million in fiscal 1998, a 397% increase. Significant software licensing revenue growth was evident in both the ECC-based Security Builder product as well as the SSL Plus product acquired through the Consensus acquisition. In addition, we completed and released SSL Plus 3.0, a new version of SSL Plus which uses the elliptic curve algorithm in addition to the RSA algorithm.
During fiscal 1999, we adjusted our business strategy to provide a wider range of security products and services to OEM customers. This shift in strategy is evident in the growth of our consulting and systems integration revenue, which grew to $1.0 million in fiscal 1999 from less than $0.1 million the previous fiscal year. Revenue from hardware sales declined in fiscal 1999 to $0.4 million from $0.6 million the previous fiscal year.
Selling and Marketing. During fiscal 1999, we continued to expand our sales and marketing operation based in California, both internally and through the acquisitions of Consensus and Uptronics. As a result of the growth of this operation, selling and marketing expenses increased 24% to $6.1 million in fiscal 1999 from $4.9 million in fiscal 1998.
Research and Development. Research and development costs decreased 15% in fiscal 1999 to approximately $3.2 million, from $3.8 million in the previous fiscal year. This decline was due to a decrease in headcount and a decreased use of technical contractors.
Depreciation and Amortization. In connection with the acquisitions of Consensus and Uptronics, we acquired intangibles of $26.3 million, and amortized $4.1 million of this amount in fiscal 1999. As a result, our depreciation and amortization expense was $5.1 million in fiscal 1999 compared to $0.6 million in fiscal 1998.
General and Administrative. In fiscal 1999, general and administrative expenses increased 55% to $4.3 million versus $2.8 million in the previous fiscal year. The primary reason for this increase was the addition of administrative headcount to support our growing operations in California, along with associated payroll taxes, benefits and overheads.
Purchased In-process Research and Development. For the year ended April 30, 1999, we recorded a charge for purchased in-process research and development as a result of our acquisition of Consensus. In connection with the acquisition, we used third-party appraisers' estimates to determine the value of in-process projects under development for which technological feasibility had not been established. The total value of these projects at the time of the acquisition was determined to be $1.2 million and was expensed in the year ended April 30, 1999. The value of the projects was determined by estimating the costs to develop the in-process technology into commercially feasible products, estimating the net cash flows we believed would result from the products and discounting these net cash flows back to their present value. The products were substantially completed during fiscal 2000. However, if they are not successfully completed, there could be a negative impact on our operating results. There was no purchased in-process research and development charge in 1998 as the Company did not make any acquisitions in that period.
Consulting and Systems Integration. The consulting and systems integration group resulted from the acquisition of Uptronics during the year.
- 34 -
Cost of Hardware Sold. Cost of hardware sold declined 64% in fiscal 1999 to $0.1 million from $0.3 million the previous year. This reduction was primarily due to lower hardware sales and lower unit costs in the Certifax business.
Interest Income (Expense). In fiscal 1999, interest income was approximately $1.0 million, unchanged from fiscal 1998.
Income Taxes. Income tax recovery was $0.1 million in fiscal 1999 compared to an expense of $0.2 million in fiscal 1998. The recovery occurred due to the receipt of Scientific Research and Experimental Development Tax Credits in Canada. Income taxes were solely a result of our operations in the United States. We have significant tax credits and tax loss carry-forwards in Canada.
Prior to our listing on The Toronto Stock Exchange, we were eligible for refundable Scientific Research and Experimental Development Tax Credits in Canada. Due to the uncertainty surrounding the reimbursement of these tax credits by various taxation authorities, we accrued a lesser tax credit than the amount which we claimed in filing our income tax returns. During fiscal 1999, we received $0.5 million of these refundable tax credits in excess of amounts which we had accrued in previous years, and we took this amount into income during fiscal 1999. Our income tax expenses are net of Scientific Research and Experimental Development Tax Credits in Canada.
Net Loss. Our net loss increased 48% in fiscal 1999 to $15.4 million ($0.73 per share basic and diluted) compared to $10.4 million ($0.57 per share basic and diluted) in the previous fiscal year. This increase was predominantly attributable to the amortization of acquisition-related intangibles, which amounted to $4.1 million in fiscal 1999 compared to zero in fiscal 1998. The loss before interest income, depreciation and amortization, and taxes amounted to $11.4 million in fiscal 1999 ($0.55 per share basic and diluted), an 8% increase over $10.6 million ($0.58 per share basic and diluted) for fiscal 1998.
Financial Condition, Liquidity and Capital Resources
From our inception until December, 1995, we financed our operations primarily through private placements. In December, 1995, we completed our initial public offering in Canada, which raised net proceeds of $6.0 million. In fiscal 1997, we raised $13.1 million through a private placement of our equity securities. In fiscal 1998, we raised $30.5 million through two private placements of our equity securities.
In fiscal 1999, our operations used $9.3 million of cash, the acquisitions of Consensus and Uptronics used $4.4 million in cash, and our investment in fixed assets and patents used $1.9 million in cash. These expenditures were offset by cash proceeds from investing activities of $16.1 million as a result of the sales and maturities of marketable securities. Total cash increase for the year was $0.8 million, and cash and cash equivalents and marketable securities at April 30, 1999 were $14.1 million.
In fiscal 2000, our operations used $11.7 million of cash. Our investment in fixed assets and patents used $4.3 million in cash. These expenditures were offset by cash proceeds from investing activities of $10.1 million as a result of investing in marketable securities.
In May, 2000, we completed a public offering of 2,500,000 common shares in the United States and Canada. Our net proceeds from the offering were $51.5 million. On April 27, 2000, we borrowed $10 million from Sand Hill Capital II, LP, or Sand Hill, at the U.S. prime rate of interest plus 3%. As partial consideration for making advances to us under this credit facility, we granted Sand Hill warrants to purchase 30,000 of our common shares with an exercise price of Cdn. $38.13 per share for a period of five years from the date of grant. We repaid the loan and interest on May 5, 2000, using a portion of the proceeds received from our public offering, and terminated this facility. Total cash increase for the year was $9.1 million, and cash and cash equivalents and marketable securities at April 30, 2000 were $13.1 million.
We lease all of our office premises and certain furniture and equipment under operating leases which require, in the aggregate, minimum payments of $2.1 million in fiscal 2001. The leases for our offices in the United States and Canada expire in 2006 and 2009, respectively. Our equipment leases expire in 2009.
- 35 -
We believe that, in the future, it may be advisable to augment our cash in order to fund our activities. Therefore, we will consider raising cash whenever market conditions are favorable. Such capital may be raised through additional public or private financing, as well as collaborative relationships, borrowings and other available sources.
Our future capital requirements will be substantial and will depend on, and could increase as a result of, many factors, including: costs associated with facility expansion and the build-up of our Mobile Trust Certificate Authority service; progress of our research and development programs; whether we acquire interests in products currently held by third parties; the time and costs involved in obtaining regulatory approvals; costs involved in filing, prosecuting and enforcing patent claims; competing technological and market developments; our success in entering into collaborative agreements; and administrative and legal expenses. However, we believe our cash and cash equivalents and marketable securities position at April 30, 2000, with the addition of the proceeds from our May, 2000 public offering referred to above, is sufficient to meet our short-term liquidity needs. There can be no assurance that additional or sufficient financing will be available, or, if available, that it will be available on acceptable terms. If we raise additional funds by issuing additional equity securities, dilution to then existing shareholders may result. If adequate funds are not available, we may be required to significantly curtail one or more of our research and development programs or commercialization efforts or obtain funds through arrangement with collaborative partners or others on less favorable terms than might otherwise be available.
Recent Accounting Pronouncements
In June, 1998, the FASB issued Statement of Financial Accounting Standards (SFAS) No. 133, Accounting for Derivative Instruments and Hedging Activities. SFAS No. 133 establishes new accounting and reporting standards for derivative financial instruments and for hedging activities. SFAS No. 133 requires the Company to measure all derivatives at fair value and to recognize them on the balance sheet as an asset or liability, depending on the Company's rights or obligations under the applicable derivative contract. In June, 1999, the FASB issued SFAS No. 137, which deferred the effective date of adoption of SFAS No. 133 for one year. The Company will adopt SFAS No. 133 no later than the first quarter of fiscal year 2002. Adoption of the new method of accounting for derivatives and hedging activities is not expected to have a material impact on the Company's financial position.
In December 1999, the Securities and Exchange Commission (SEC) issued Staff Accounting Bulletin No. 101 (SAB 101), "Revenue Recognition", which provides guidance on the recognition, presentation and disclosure of revenue in financial statements filed with SEC. SAB 101 outlines the basic criteria that must be met in order to recognize revenue and provides guidance for disclosures related to revenue recognition policies. In June 2000, the SEC issued SAB 101B, "Second Amendment: Revenue Recognition in Financial Statements" which extends the effective date of SAB 101 to the fourth fiscal quarter of fiscal years commencing after December 15, 1999. Although, the company has not fully assessed the implications of SAB 101, management does not believe the adoption of the statement will have a significant impact on the Company's consolidated financial position, results of operations or cash flows"
In March 2000, the FASB issued Interpretation No. 44, Accounting for Certain Transactions involving Stock Compensation, an interpretation of APB Opinion No. 25, which among other things would, require variable-award accounting for repriced options from the date the option is repriced until the date of exercise. This interpretation is effective July 1, 2000, but certain conclusions in this Interpretation cover specific events that occur after either December 15, 1998, or January 12, 2000. On March 17, 1999, we repriced certain options to purchase 382,914 shares of common stock. Because these options were repriced after December 15, 1998, they are covered by the Interpretation. Accordingly, these options would be accounted for as variable until the date they are exercised, forfeited or expire unexercised. The portion of the options' intrinsic value at July 1, 2000 that is attributable to the remaining vesting period will be recognized over the future period. However, if the stock price subsequently declines below the stock price at July 1, 2000, compensation cost would be reduced proportionately. Additional compensation cost would be measured for the full amount of any increases in stock price after the effective date and will be recognized over the remaining vesting period. Any adjustment to the compensation cost for further changes in stock price after the options vest will be recognized immediately.
- 36 -
Item 7A.
Item 7A. QUANTITATIVE AND QUALITATIVE DISCLOSURE ABOUT MARKET RISK
Foreign Exchange Risk
Currency fluctuations may materially adversely affect us. A substantial portion of our operating expenses are paid in currencies other than U.S. dollars. Fluctuations in the exchange rate between the U.S. dollar and such other currencies may have a material adverse effect on our business, financial condition and operating results. In particular, we may be materially adversely affected by a significant strengthening of the Canadian dollar against the U.S. dollar. Operating expenses incurred in fiscal 2000 in currencies other than the U.S. dollar represented approximately 33% of our total operating expenses.
Interest Rate Risk
We hold a significant portion of our cash in interest-bearing instruments and are exposed to the risk of changing interest rates and its effect on future earnings. Generally, if interest rates decrease, our interest income would also decrease. We do not use any derivative instruments to reduce our exposure to interest rate fluctuations.
Item 8.
Item 8. FINANCIAL STATEMENTS AND SUPPLEMENTARY DATA
The response to this item is submitted as a separate section of this Form 10-K. See Part IV, Item 14 of this Form 10-K.
Item 9.
Item 9. CHANGES IN AND DISAGREEMENTS WITH ACCOUNTANTS ON ACCOUNTING AND FINANCIAL DISCLOSURE
None.
PART III
Item 10.
Item 10. DIRECTORS AND EXECUTIVE OFFICERS OF THE COMPANY
We do not have an executive committee. We are required to have an audit committee. The term of office for each of the above directors will expire at the time of our next annual meeting. Each of our directors and executive officers has been engaged in his present principal occupation for the previous five years, except as indicated in the following summaries of the background of each individual:
Richard P. Dalmazzi was appointed as our President, Chief Executive Officer and Director in November, 1999. From September, 1998 to November, 1999, Mr. Dalmazzi served as our President. From July, 1997 to September, 1998, he was our Executive Vice President of Sales and Marketing. From October, 1995 to December, 1996, he was Senior Vice President of Digital Arts and Sciences Corporation, a developer of an image database engine for the Internet. From February, 1995 to September, 1995, he was President and COO of Strategic Communications Corp., a developer of a wireless data communications service for the financial services industry. From August, 1992 to January, 1995, he was Vice President and General Manager, OEM Division of Geoworks Corporation, a developer of embedded operating systems for the Internet appliance market. From September, 1978 to August, 1992, Mr. Dalmazzi held various positions with IBM.
Scott A. Vanstone, Ph.D., assisted in founding us in March, 1985 and was appointed our Chief Cryptographer in January, 1995. Dr. Vanstone is also a professor of Mathematics and Computer Science, an Executive Director of the Centre of Applied Cryptography, and the holder of the NSERC/Pitney Bowes Senior Chair of Applied Cryptography at the University of Waterloo.
Richard M. Depew was appointed our Executive Vice President, Field Operations in February, 2000. From July, 1998 to February, 2000, Mr. Depew served as our Vice President, Worldwide Sales. Prior to joining Certicom, Mr. Depew was Vice President of Sales at Litronic, Inc. from December, 1995 to July 1998. Prior to this, Mr. Depew was Chief Executive Officer of LION Software, Inc.
Richard D. Brounstein was appointed our Senior Vice President, Finance, Chief Financial Officer and Secretary in February, 2000. Prior to joining Certicom, Mr. Brounstein served as Vice President Finance and Chief Financial Officer of VidaMed, Inc. from May, 1997 to January, 2000. From August, 1989 to February, 1997, Mr. Brounstein served as Vice President Finance & Administration and Chief Financial Officer of MedaSonics Inc.
Robert L. Williams was appointed our Senior Vice President, Product Development in November, 1999. From January, 1999 to November, 1999 he served as interim President of Nexsys-Commtech Inc. Mr. Williams served as Vice President of Operations for Mobile Computing Corporation from September, 1990 to December, 1998.
Timothy M. Dierks was appointed our Chief Technology Officer in November, 1999. From October, 1998 through November, 1999, he served as our Vice President of Engineering. From July, 1998 to October, 1998, Mr. Dierks served as our Vice President of Product Architecture. Prior to joining us, Mr. Dierks served as Vice President of Consensus Development Corporation from January, 1996 to July, 1998. Mr. Dierks filled several technical and management roles from November, 1991 to January, 1996 with Apple Computer Inc.
Stewart C. Noyce has served as our Vice President, Marketing since November, 1998. Prior to joining us, Mr. Noyce served as a Principal at TruNorth Consulting from June, 1997 to October, 1998. From October, 1996 to May, 1997, he was Director, Product Management at Phone.com. From November, 1992 to May, 1996, he was Director, Product Management at Geoworks Corporation.
- 38 -
Philip C. Deck has served as our Chairman since January, 1996. From September, 1998 to November, 1999, Mr. Deck also served as our Chief Executive Officer. From February, 1997 to September, 1998, he served as our Chairman, President and Chief Executive Officer. From January, 1996 to February, 1997, Mr. Deck served as our Chairman. From April, 1994 to January, 1996, Mr. Deck was our President and Chief Executive Officer.
Bernard W. Crotty has served on our board since October 16, 1996. Mr. Crotty was Counsel with Gibson, Dunn & Crutcher LLP, in Los Angeles from April, 1998 to March, 2000. From February, 1994 to April 1, 1998, he was a partner with McCarthy Tetrault, Barristers & Solicitors in Toronto, Ontario.
William T. Dodds has been a member of our board since February 10, 1997. Mr. Dodds is Vice President of The Woodbridge Co. Limited. From September, 1996 to the present, Mr. Dodds has been a member of the board of directors of Axxent Inc., a company listed on the Toronto Stock Exchange since November, 1999.
Erling E. Rasmussen has served on our board since August 25, 1997. He is the Corporate Vice President and Director of Technology Motorola, Inc.'s Systems Solutions Group.
Louis E. Ryan has been a member of our board since October 16, 1996. Mr. Ryan is the President of Clicknet Software Inc. From July, 1996 to January, 1997, Mr. Ryan was the President of CKS New Media Inc. Previously, Mr. Ryan was the Executive Vice President of Worldwide Sales and a co-founder of Delrina Corporation, now a division of Symantec Corporation.
William J. Stewart has been a member of our board since October 16, 1996. Mr. Stewart served as President of Asia Pacific Ventures Technology Partners since 1989. He has been a General Partner of Asia Pacific Ventures since 1994.
- 39 -
Item 11.
Item 11. EXECUTIVE COMPENSATION
- 40 -
Option Grants During the Fiscal Year Ended April 30, 2000
Aggregated Option Exercises During the Fiscal Year Ended April 30, 2000 and Fiscal Year-End Option Values
Employment Contracts
Philip C. Deck performs his duties as Chairman of our Company in our Mississauga, Ontario office pursuant to an Employment Agreement as of November 30, 1999 which expires on May 15, 2003. In the event that any person acquires more than 50% of our outstanding voting securities, then all of Mr. Deck's options and other rights to acquire our securities shall vest immediately.
Richard P. Dalmazzi performs his duties as our President and Chief Executive Officer in our Hayward, California office pursuant to an Employment Contract made as of November 30, 1999. This agreement terminates on April 30, 2001, but is automatically renewable for successive periods of one year following April 30 in each year starting in 2001 unless either party has given at least 180 days' written notice to the other that such agreement is to terminate at the end of the term in question. In the event that Mr. Dalmazzi's employment is terminated by us, other than for cause, Mr. Dalmazzi is entitled to be paid the amount of his salary for the unexpired term of the agreement. In the event there is a change of control and Mr. Dalmazzi's employment is terminated without cause, or Mr. Dalmazzi voluntarily terminates his employment with good reason, then all of Mr. Dalmazzi's options and other rights to acquire securities shall vest immediately.
Scott A. Vanstone performs his duties as our Chief Cryptographer in our Mississauga, Ontario office pursuant to a Services Agreement as of May 1, 1999. This agreement terminates on April 30, 2004, but may be renewed for successive periods of one year by mutual consent of the parties. Either party may terminate the agreement on April 30 of any year by giving at least 90 days' written notice to the other that the agreement is to terminate at the end of the term in question. In addition, in the event of a take-over bid, an amalgamation, a plan of arrangement or other form of business transition pursuant to which holders of our common shares cease to own at least 33% of the voting securities of our Company or the surviving entity resulting from such transaction, we have agreed to issue to Mr. Vanstone 100,000 common shares. These shares, if issued to Mr. Vanstone, will vest over a three-year period commencing twelve months after completion of the transaction giving rise to their issuance.
Richard D. Brounstein performs his duties as our Senior Vice President Finance, Chief Financial Officer and Secretary in our Hayward, California office pursuant to an employment contract as of February 7, 2000. This agreement is for no fixed term, but is terminable at the option of either party at any time. In the event that Mr. Brounstein's contract is terminated by us, other than for cause, or Mr. Brounstein voluntarily terminates his employment with good reason after a change of control of our Company, Mr. Brounstein is entitled (i) to be paid nine months' salary; (ii) to receive nine months acceleration of vesting of all unvested stock options; (iii) to receive nine months' continued health insurance benefits; and (iv) to receive up to $10,000 in outplacement services. In the event there is a change of control of our Company and Mr. Brounstein's employment is terminated without cause, or Mr. Brounstein voluntarily terminates his employment with good reason, then 50% of Mr. Brounstein's options and other rights to acquire securities shall vest immediately.
- 42 -
Compensation of Directors
Each of our directors who is not a full-time employee of our Company or one of our affiliates or a nominee of a shareholder who has requested and received a right to representation on our board of directors and who has not previously received remuneration, is remunerated (exclusive of, and in addition to payments on account of travelling and other out-of-pocket expenses) at the rate of $10,000 per annum plus an additional $1,000 for each meeting of the board of directors attended. In addition, each director so entitled to receive remuneration is granted options vesting so as to permit the purchase of 20,000 common shares each year having a per share exercise price based on the closing market price on the last trading day prior to the date the option was granted. Directors so entitled to receive remuneration are also granted options in relation to an additional 10,000 common shares in respect of each committee of the board of directors of which they are a member or for which they perform the functions based on the foregoing market price or the payment of $2,500 per committee in lieu thereof. Such options vest over a period of one year. Bernard W. Crotty, a director of our Company, was formerly Counsel with Gibson, Dunn & Crutcher LLP, a law firm which performed legal services for us over the course of our fiscal year ended April 30, 2000. From time to time, Mr. Crotty personally provides legal services to us for which he is compensated.
Employee Benefit Plans
We have three stock option plans and one stock purchase plan pursuant to which our common shares may be issued. As of April 30, 2000, options to acquire 5,155,300 common shares at an average exercise price of $12.36 per share were outstanding.
As of April 30, 2000, there were outstanding options to acquire 222,648 shares of our common stock that were granted pursuant to our original stock option plan (the "Original Plan"). Options to acquire a total of 151,604 of these shares were granted to our executive officers and directors. The options issued under the Original Plan have a term of five years and become exercisable at a rate of 33% during each twelve-month period following the first anniversary from the date of grant of the option. These options become immediately exercisable in the event that any person acquires 90% of the common shares. In connection with the listing of our common shares on the TSE on June 17, 1997, we agreed with such stock exchange that we would not grant any further options under the Original Plan.
The Certicom Corp. 1997 Stock Option Plan (the "1997 Plan") permits stock options to be granted which have a term of not greater than five years. The options issued under the 1997 Plan become exercisable at a rate of one quarter of the total amount granted on the first anniversary of a grant and a further 2.0833% each month after the initial one-year period. No more than 6,000,000 common shares may be issued under the 1997 Plan. During the fiscal year ended April 30, 2000, we granted options under the 1997 Plan to acquire a total of 1,230,000 common shares to our executive officers at an average price of $14.87 per common share. Additionally, pursuant to the 1997 Plan, we granted options to acquire 1,553,866 common shares to individuals other than executive officers.
On April 27, 2000, our shareholders adopted the Certicom Corp. 2000 United States Stock Plan (the "2000 Plan") and the Certicom Corp. Employee Stock Purchase Plan (the "Stock Purchase Plan"). Under the 2000 Plan, options may be granted to our directors, officers, employees and consultants who are United States residents on the date of the grant. Unless otherwise determined by the plan administrator, options issued under the 2000 Plan become exercisable at a rate of one quarter of the total amount granted on the first anniversary of a grant and a further 2.0833% each month after the initial one-year period. An option may have a term up to 10 years. No more than 2,000,000 common shares may be issued under the 1997 Plan. Under the terms of the 2000 Plan, we are also permitted to grant stock purchase rights. As of April 30, 2000, there were no options outstanding under the 2000 Plan.
The Stock Purchase Plan permits eligible employees who participate in the plan to acquire our common shares at the lesser of 85% of the fair market value of the common shares on the first business day of each offering period or 85% of the fair market value of the common shares on the last business day of a purchase period. An offering period is a 12-month period that begins on July 1 and January 1 of each year. Each offering period consists of two purchase periods which end on the following June 30 and December 31. The first offering period under the Stock Purchase Plan began on July 1, 2000. Up to 1,000,000 common shares may be issued under the Stock Purchase Plan.
- 43 -
Shareholder Rights Plan
Our directors and shareholders have approved a shareholder rights plan. The terms of the shareholder rights plan are such that a take-over bid must be made for all of our common shares and must be open for 60 days after the bid is made. If at least 50% of the common shares held by persons independent of the bidder are deposited or tendered pursuant to the bid, and not withdrawn, the bidder may take up and pay for such shares. The bid must then remain open for a further period of 10 clear business days on the same terms.
In the event a take-over bid is made that does not adhere with the above terms, the rights attaching to each common share will separate from the common shares and become exercisable eight trading days after the earlier of: (a) a person having acquired 20% or more of the common shares, or (b) the commencement or announcement in respect of a take-over bid to acquire 20% or more of the common shares. After separation, rights will be evidenced by rights certificates which are transferable and will be traded separately from the common shares.
The rights, when exercisable, permit the holder to purchase, for the exercise price of the rights, common shares having a value (based on the then prevailing market price) equal to twice such exercise price (i.e., at a 50% discount). The exercise price of the rights will be equal to five times the prevailing market price at the time the rights separated from the common shares. Rights that are beneficially owned by the person making the take-over bid which does not adhere to the above terms shall become null and void.
The term of the shareholder rights plan is ten years, subject to reconfirmation by shareholders at every third annual meeting of our shareholders.
- 44 -
Item 12.
Item 12. SECURITY OWNERSHIP OF CERTAIN BENEFICIAL OWNERS AND MANAGEMENT
The following table sets forth certain information regarding the beneficial ownership of our common shares as of April 30, 2000. To our knowledge, no person beneficially owns 5% or more of our common shares. The information is provided with respect to:
o each of our directors;
o each of our Named Executive Officers; and
o all of our directors, Named Executive Officers and other executive officer as a group (14 persons).
- 45 -
Item 13.
Item 13. CERTAIN RELATIONSHIPS AND RELATED TRANSACTIONS
None.
PART IV
Item 14.
Item 14. EXHIBITS, FINANCIAL STATEMENTS SCHEDULES, AND REPORTS ON FORM 8-K
1. Consolidated Financial Statements
2. Consolidated Financial Statement Schedules
Schedule II--Valuation and Qualifying Accounts and Reserves
3. Reports on Form 8-K
None.
4. Exhibits
Index to Exhibits
Exhibit Number Description - -------------- -----------
3.1 Restated Articles of Continuance of the Company
3.2 By-laws of the Company
4.1 Specimen Certificate for Common Shares of the Company (incorporated by reference to the Company's Registration Statement on Form 8-A, dated March 14, 2000)
10.1 Lease Agreement, dated October 30, 1998, by and between The Multi-Employer Property Trust and Certicom Corp., as amended by First Amendment to Lease Agreement, dated November 17, 1998, as further amended by Second Amendment to Lease Agreement, dated April 1, 2000
10.2 Lease Agreement, dated March 29, 1999, by and between The Airport Corporate Centre Office Park, Inc. and Certicom Corp., as amended by First Amendment to Lease Agreement, dated April 25, 2000
10.3 Lease Agreement, dated December 7, 1998, by and between Alliance Reston, L.P., d/b/a Alliance Business Centers, and Certicom Corp., as amended by First Amendment, dated June 2, 1999, as further amended by Second Amendment, dated May 18,
- 46 -
10.4 Certicom Corp. Stock Option Plan (incorporated by reference to the Company's Registration Statement filed on Form S-8, dated May 2, 2000)
10.5 1997 Employee Stock Purchase Plan (incorporated by reference to the Company's Registration Statement filed on Form S-8, dated May 2, 2000)
10.6 Certicom Corp. 2000 United States Stock Plan (incorporated by reference to the Company's Registration Statement filed on Form S-8, dated May 17, 2000)
10.7 Certicom Corp. 2000 Employee Stock Purchase Plan (incorporated by reference to the Company's Registration Statement filed on Form S-8, dated May 17, 2000)
10.8 Employment Agreement, dated November 20, 1999, between Certicom Corp. and Richard P. Dalmazzi
10.9 Employment Agreement, dated May 1, 1999, between Certicom Corp. and Dr. Scott A. Vanstone
10.10 Employment Agreement, dated February 7, 2000, between Certicom Corp. and Richard D. Brounstein
21.1 List of Subsidiaries
22.1 Published Report Regarding Matters Submitted to Vote of Security Holders
23.1 Independent Auditors' Consent
24.1 Power of Attorney (included on page 48 of this Form 10-K)
27.1 Financial Data Schedule
- 47 -
SIGNATURES
Pursuant to the requirements of Section 13 or 15(d) of the Securities Exchange Act of 1934, the Company has duly caused this report to be signed on its behalf by the undersigned, thereunto duly authorized, on this 31st day of July, 2000.
Certicom Corp.
By:/s/ Richard P. Dalmazzi --------------------------- Richard P. Dalmazzi President, Chief Executive Officer
Each person whose signature appears below constitutes and appoints Richard P. Dalmazzi and Richard D. Brounstein as his true and lawful attorneys-in-fact and agents, with full power of substitution for him in any and all capacities, to sign any and all amendments (including post-effective amendments) to this Form 10-K, and to file the same, with all exhibits thereto, and other documents in connection therewith, with the Securities and Exchange Commission, granting unto said attorneys-in-fact and agents, full power and authority to do and perform each and every act and thing requisite and necessary to be done in connection therewith, as fully to all intents and purposes as he might or could do in person.
- 48 -
CERTICOM CORP. AND SUBSIDIARIES
Consolidated Financial Statements as of April 30, 1999 and 2000 and for the Years Ended April 30, 1998, 1999 and 2000 and Independent Auditors' Report
INDEPENDENT AUDITORS' REPORT
To the Board of Directors and Shareholders of Certicom Corp.
We have audited the accompanying consolidated balance sheets of Certicom Corp. and its subsidiaries as at April 30, 2000 and 1999 and the related consolidated statements of operations, shareholders' equity and cash flows for each of the three years in the period ended April 30, 2000. Our audits also included the financial statement schedules listed in the index at item 14. These consolidated financial statements and financial statement schedules are the responsibility of the Company's management. Our responsibility is to express an opinion on these financial statements and financial statement schedules based on our audits.
We conducted our audits in accordance with auditing standards generally accepted in the United States of America. Those standards require that we plan and perform an audit to obtain reasonable assurance whether the financial statements are free of material misstatement. An audit includes examining, on a test basis, evidence supporting the amounts and disclosures in the financial statements. An audit also includes assessing the accounting principles used and significant estimates made by management, as well as evaluating the overall financial statement presentation. We believe that our audits provide a reasonable basis for our opinion.
In our opinion, such consolidated financial statements present fairly, in all material respects, the financial position of Certicom Corp. and its subsidiaries as at April 30, 2000 and 1999, and the results of their operations and their cash flows for each of the three years in the period ended April 30, 2000 in conformity with accounting principles generally accepted in the United States of America. Also, in our opinion, such financial statement schedules, when considered in relation to the basic consolidated financial statements taken as a whole, present fairly in all material respects the information set forth therein.
Accounting principles generally accepted in Canada vary in certain significant respects from accounting principals generally accepted in the United States of America. We expect to report separately to the shareholders of the Company on financial statements for the same period prepared in accordance with accounting principals generally accepted in Canada.
/s/ DELOITTE & TOUCHE LLP - ------------------------- Chartered Accountants
Toronto, Canada June 13, 2000
CERTICOM CORP. AND SUBSIDIARIES
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS Years Ended April 30, 1998, 1999 and 2000
1. Description of Business and Significant Accounting Policies
Description of Business
Certicom Corp. and its wholly-owned subsidiaries (the "Company") are suppliers of digital information security products and services to original equipment manufacturers (OEMs) of information technology products. The Company's products and services include cryptographic technology and security protocol licensing, cryptographic consulting, information security architecture and design, and the sale of security hardware products such as smart cards and PC cards.
Significant Accounting Policies
Generally Accepted Accounting Principles - These consolidated financial statements have been prepared in accordance with accounting principles generally accepted in the United States of America ("generally accepted accounting principles").
Principles of Consolidation - These consolidated financial statements include the accounts of Certicom Corp. and its wholly-owned subsidiaries. All significant inter-company transactions and balances have been eliminated.
Accounting Estimates - The preparation of financial statements in conformity with generally accepted accounting principles requires management to make estimates and assumptions that affect the reported amount of assets and liabilities and disclosure of contingent assets and liabilities at the date of the financial statements and the reported amounts of revenues and expenses during the reporting period. Actual results could differ from those estimates.
Cash Equivalents - For the purposes of the consolidated statements of cash flows, cash equivalents are defined as highly liquid investments with maturities of three months or less.
Marketable Securities - The Company follows the provisions of SFAS No. 115, Accounting for Certain Investments in Debt and Equity Securities. The Statement requires the Company to record securities which management has classified as available for sale at fair market value and to record unrealized gains and losses on securities available for sale as a separate component of shareholders' equity until realized.
As the Company's management expects to sell a portion of the marketable securities in the next fiscal year in order to meet its working capital requirements, it has classified them as current assets.
Inventories are recorded at the lower of cost, on a first-in, first-out basis, and net realizable value.
Property and Equipment is recorded at cost. Depreciation and amortization is provided for over the estimated useful lives of the assets at the following annual rates:
Furniture and fixtures - Straight-line over five years Computer equipment - Straight-line over three years Software - Straight-line over two years Lab equipment - Straight-line over three years Leasehold improvements - Straight-line over the term of the lease
CERTICOM CORP. AND SUBSIDIARIES
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS Years Ended April 30, 1998, 1999 and 2000 (Continued)
Lease Inducements are amortized to income on a straight-line basis over the term of the lease.
Patents are recorded at cost and are amortized over three years on a straight-line basis.
Acquired Intangibles represent customer lists, trademarks, workforce, in process research and development, purchased technology and goodwill arising on business acquisitions and are being amortized on a straight-line basis over periods ranging from three to five years, except purchased in-process research and development without alternative future use which is expensed when acquired.
Long-Lived Assets - The Company follows the provisions of SFAS No. 121, Accounting for the Impairment of Long-Lived Assets and for Long-Lived Assets To Be Disposed Of. SFAS No. 121 prescribes the accounting treatment for long-lived assets, identifiable intangibles and goodwill related to those assets when there are indications that the carrying value of those assets may not be recoverable.
Revenue Recognition and Deferred Revenues - The Company recognizes revenue in accordance with applicable accounting regulations, including American Institute of Certified Public Accountants (AICPA) Statement of Position (SOP) 97-2, Software Revenue Recognition, as amended.
Revenue from sales of products is recognized when a contract has been executed, the product has been shipped, the sales price is fixed and determinable, and collection of the resulting receivable is probable.
Revenue earned on software arrangements involving multiple elements (i.e., software products, upgrades/enhancements, post contract customer support, installation, training etc.) is allocated to each element based on vendor specific objective evidence of relative fair value of the elements. The revenue allocated to post contract support is recognized ratably over the term of the support and revenue allocated to service elements (such as training and installation) is recognized as the services are performed. When arrangements contain multiple elements and vendor specific objective evidence exists for all undelivered elements, the Company recognizes revenue for the delivered elements using the residual method. For arrangements containing multiple elements wherein vendor specific objective evidence does not exist for all undelivered elements, revenue for the delivered and undelivered elements is deferred until vendor specific objective evidence exists or all elements have been delivered.
Research and Product Development - The Company expenses all research and development costs as they are incurred. Scientific research tax credits are recognized at the time the related costs are incurred and recovery is reasonably assured.
Stock-Based Compensation - The Company follows the provisions of APB Opinion No. 25, which requires compensation cost for stock-based employee compensation plans to be measured based on any difference on the grant date between the quoted market price of the stock and the amount an employee must pay to acquire the stock.
Foreign Currency Translation - For the period up to April 30, 1999, the functional currency of the Company was the Canadian dollar. As such, assets and liabilities of the Company were translated to U.S. dollars at the year-end exchange rates. Income and expense items were translated at the average rate of exchange prevailing during the year. The adjustment resulting from translating the financial statements is reflected as a component of comprehensive earnings.
CERTICOM CORP. AND SUBSIDIARIES
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS Years Ended April 30, 1998, 1999 and 2000 (Continued)
For the period from May 1, 1999, the Company has determined that its functional currency is the U.S. dollar as it derives a majority of its revenues and incurs a significant portion of its expenditures in U.S. dollars. As such, monetary assets and liabilities denominated in currencies other than the U.S. dollar are translated into U.S. dollars at the rate of exchange prevailing at year end while other balance sheet items are translated at historic rates. Revenue and expense items are translated at the rate of exchange in effect on the transaction dates except for depreciation and amortization which are translated at historic rates. Realized as well as unrealized foreign exchange gains and losses are included in income in the year in which they occur.
Income Taxes - The Company follows the provisions of SFAS No. 109, Accounting for Income Taxes, which requires an asset and liability approach to financial accounting for income taxes.
Basic and Diluted Net Loss per Share - The Company follows the provisions of SFAS No. 128, Earnings Per Share. Basic net loss per common share is based on the weighted average number of shares outstanding during each period. Stock options are not included in the computation of the weighted average number of shares outstanding for dilutive net loss per common share during the period as the effect would be antidilutive.
Fair Value of Financial Instruments - The carrying value of financial assets and liabilities approximate their carrying value, based on management's estimates.
Concentration of Credit Risk - Financial instruments that potentially subject the Company to concentrations of credit risk consist of cash, marketable securities and accounts receivable. Risk associated with cash are mitigated by banking and creditworthy institutions. Marketable securities consists primarily of bonds and commercial paper. Credit risk with respect to the trade receivables is spread over diverse customers who make up the Company's customer base. At April 30, 2000, one customer accounted for 17% of total accounts receivable (1999 - nil).
Certain Significant Risks and Uncertainties - The Company participates in a dynamic high-technology industry and believes that changes in any of the following areas could have a material adverse effect on the Company's future financial position, results of operations or cash flows: advances and trends in new technologies and industry standards; competitive pressures in the form of new products and services or price reductions on current products and services; changes in the overall demand for products and services offered by the Company; market acceptance of the Company's products and services; development of sales channels; changes in certain strategic relationships or customers relationships; litigation or claims against the Company based on intellectual property, patent, product, regulatory or other factors; and the Company's ability to attract and retain necessary employees to support its growth.
Recent Accounting Pronouncements - In June 1998, the Financial Accounting Standards Board (FASB) issued SFAS No. 133, Accounting for Derivative Instruments and Hedging Activities ("SFAS 133"). SFAS 133 establishes accounting and reporting standards for derivative instruments, including certain derivative instruments embedded in other contracts and for hedging activities. SFAS 133 requires that an entity recognize all derivatives as either assets or liabilities in the statement of financial position and measure those instruments at fair value. The impact of adopting SFAS 133, which is effective for all fiscal quarters of the Company's fiscal year beginning May 1, 2001, has not been determined.
CERTICOM CORP. AND SUBSIDIARIES
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS Years Ended April 30, 1998, 1999 and 2000 (Continued)
In March 2000, the Securities and Exchange Commission (SEC) issued Staff Accounting Bulletin No. 101A, Amendment: Revenue Recognition in Financial Statements. SAB 101A amends Staff Accounting Bulletin No. 101 (SAB 101), Revenue Recognition in Financial Statements, to defer the implementation date of SAB 101 for registrants with fiscal years that begin between December 16, 1999 and March 15, 2000. SAB 101 provides guidance on the recognition, presentation and disclosure of revenue in financial statements of all public registrants. Changes in the Company's revenue recognition policy resulting from the interpretation of SAB 101 would be reported as a change in accounting principle. The change in the revenue recognition policy could result in a cumulative adjustment in the quarter the Company adopts SAB 101. Although the Company has not fully assessed the implications of SAB 101, management does not believe the adoption of this statement will have a significant impact on the Company's consolidated financial position, results of operations or cash flows.
In March 2000, the FASB issued Interpretation No. 44, Accounting for Certain Transactions involving Stock Compensation, an interpretation of APB Opinion No. 25, which, among other things, would require variable-award accounting for repriced options from the date the option is repriced until the date of exercise. This interpretation is effective July 1, 2000, but certain conclusions in this Interpretation cover specific events that occur after either December 15, 1998, or January 12, 2000. On March 17, 1999, the Company repriced certain options to purchase 765,828 shares of common stock. Beginning July 1, 2000, these options will be subject to variable award accounting under the Interpretation.
Reclassifications - Certain reclassifications have been made in the 1998 and 1999 financial statement presentation to conform to the 2000 presentation. These reclassifications had no effect on net loss or stockholders' equity.
2. Acquisitions
During the years ended April 30, 2000 and 1999 the Company made the acquisitions described in the paragraphs that follow, each of which has been accounted for as a purchase. The consolidated financial statements include the operating results of each business from the date of acquisition.
The amounts allocated to purchased research and development were determined through generally accepted valuation techniques and were expensed upon acquisition because technological feasibility had not been established and no future alternative use existed.
CERTICOM CORP. AND SUBSIDIARIES
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS Years Ended April 30, 1998, 1999 and 2000 (Continued)
Acquisition of Consensus Development Corporation
The valuations of purchased in-process research and development, other acquired intangibles and purchased technology were based upon independent appraisals received from third parties. Based upon the valuation, management estimates that $1,151,000 of the purchase consideration represents purchased in-process technology that had not yet reached technological feasibility and had no future alternative use. Accordingly, this amount was immediately expensed upon consummation of the acquisition.
The purchased in-process research and development was determined by identifying the on-going research projects for which technological feasibility had not been achieved and assessing the anticipated date of completion of the research and development effort. The value of the in-process research and development was determined by estimating the costs to develop the in-process research and development into commercially feasible products, and estimating the net present value of cash flows expected to result from the product. The state of completion was determined by estimating the costs and time incurred to date relative to those costs and time to be incurred to develop the purchased in-process research and development into commercially viable products. The resulting net cash flows only from the percentage of research and development efforts complete at the date of acquisition were used to determine the value of the in-process research and development. The discount rate included a factor that took into account the uncertainty surrounding the successful development of the purchased in-process research and development projects.
Other acquired intangibles include the fair value of trademarks, customer base and workforce.
CERTICOM CORP. AND SUBSIDIARIES
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS Years Ended April 30, 1998, 1999 and 2000 (Continued)
The value assigned to purchased technology was determined by discounting the expected future cash flows of the existing developed technologies, taking into account the characteristics and applications of the product, the size of existing markets, growth rates of existing and future markets as well as an evaluation of past and anticipated product-life cycles.
Acquisition of Uptronics, Inc.
On November 24, 1998, Certicom acquired all of the outstanding common shares of Uptronics, Inc., a corporation based in Sunnyvale, California. Uptronics, Inc. provides cryptographic consulting and security systems integration services to OEMs. Details of the consideration and the fair values of the net assets acquired are as follows (U.S. dollars in thousands):
Net assets acquired: Noncash working capital (net of cash of $32).......................... $ 64 Property and equipment................................................ 28 Other acquired intangibles............................................ 556 Goodwill.............................................................. 1,318 ------ Total net assets acquired............................................... $1,966 ======
Consideration: Cash.................................................................. $ 476 Common shares (431,344 shares issued)................................. 1,321 Acquisition costs..................................................... 169 ------ Total consideration..................................................... $1,966 ======
Acquired intangibles include the fair value of workforce and customer base.
CERTICOM CORP. AND SUBSIDIARIES
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS Years Ended April 30, 1998, 1999 and 2000 (Continued)
Acquisition of Trustpoint
On January 26, 2000, Certicom acquired all of the outstanding common shares of Trustpoint, a corporation based in Mountain View, California. Trustpoint is a provider of comprehensive, flexible, cross-platform public key infrastructure (PKI) products that allow Original Equipment Manufacturers (OEMs) to develop applications with built-in digital certificate services. Details of the consideration and the fair values of the net assets acquired are as follows (U.S. dollars in thousands):
Net assets acquired Noncash working capital (net of cash of $302)........................ $ (34) Property and equipment............................................... 29 Purchased in-process research and development charged to operations.. 535 Other acquired intangibles........................................... 343 Goodwill............................................................. 9,633 ------- Total net assets acquired.............................................. $10,506 ======= Consideration: Common shares (201,120 shares issued)................................ $ 7,306 Options to acquire 98,884 common shares.............................. 3,080 Acquisition costs.................................................... 120 ------- Total consideration.................................................... $10,506 =======
The valuations of purchased in-process research and development, other acquired intangibles and purchased technology were based upon appraisals received from third parties. Based upon the valuation, management estimates that $535,000 of the purchase consideration represents purchased in-process technology that had not yet reached technological feasibility and had no future alternative use. Accordingly, this amount was immediately expensed upon consummation of the acquisition. The purchased in-process research and development was determined by identifying the ongoing research projects for which technological feasibility had not been achieved and assessing the anticipated date of completion of the research and development effort. The value of the in-process research and development was determined by estimating the costs to develop the in-process research and development into commercially feasible products, and estimating the net present value of cash flows expected to result from the product. The state of completion was determined by estimating the costs and time incurred to date relative to those costs and time to be incurred to develop the purchased in-process research and development into commercially viable products. The resulting net cash flows only from the percentage of research and development efforts complete at the date of acquisition were used to determine the value of the in-process research and development. The discount rate included a factor that took into account the uncertainty surrounding the successful development of the purchased in-process research and development projects.
Acquired intangibles include the fair value of workforce, customer base, and trademarks.
Unaudited Pro Forma Financial Information
The following table represents unaudited consolidated pro forma information as if the acquisitions of Consensus and Trustpoint had occurred at the beginning of the years immediately preceding the years in which they were acquired. The pro forma data is presented for illustrative purposes only and is not necessarily indicative of the combined results of operations of future periods or the results that actually
CERTICOM CORP. AND SUBSIDIARIES
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS Years Ended April 30, 1998, 1999 and 2000 (Continued)
would have occurred had the acquisitions been in effect for the entire specified periods. The pro forma combined results include the effects of the purchase price allocation on amortization of acquired intangibles (in thousands of U.S. dollars, except per share data).
Years Ended April 30, ---------------------- 1999 2000 ---- ---- Pro forma revenue ....................................... $ 4,932 $ 12,764 Pro forma net loss ...................................... $(19,663) $(19,456) Pro forma net loss per share - basic and diluted ........ $ (0.89) $ (0.87) Number of shares used in calculation - basic and diluted. 22,034 22,404
Unaudited pro forma consolidated results after giving effect to the acquisition of Uptronics, Inc. would not have been materially different from the reported amount for either year.
3. Marketable Securities, Available for Sale
The following table summarizes the Company's investment in marketable securities (in thousands of U.S. dollars):
April 30, 1999 ----------------------------------------------- Gross Gross Carrying Unrealized Unrealized Fair Value Gains Losses Value ----- ----- ------ ----- Bonds......................... $12,561 $ 32 $ - $12,593 Other......................... 119 - 34 85 ------- ---- ---- ------- $12,680 $ 32 $ 34 $12,678 ======= ==== ==== =======
April 30, 2000 ------------------------------------- Gross Carrying Unrealized Fair Value Gains Value ----- ----- ----- Bonds ............................. $1,394 $ 4 $1,398 Commercial paper .................. 1,131 8 1,139 Other ............................. 13 - 13 ------ ------ ------ $2,538 $ 12 $2,550 ====== ====== ======
CERTICOM CORP. AND SUBSIDIARIES
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS Years Ended April 30, 1998, 1999 and 2000 (Continued)
4. Property and Equipment
Property and equipment consist of the following (U.S. dollars in thousands):
April 30, ---------------------- 1999 2000 ---- ----
Furniture and fixtures ............................. $ 767 $ 724 Computer equipment ................................. 2,087 2,717 Software ........................................... 325 1,649 Lab equipment ...................................... 24 24 Leasehold improvements ............................. 1,549 3,532 ------- ------- Total cost ......................................... 4,752 8,646 Accumulated depreciation and amortization .......... (1,915) (3,433) ------- ------- $ 2,837 $ 5,213 ======= =======
5. Note Payable
On April 27, 2000, the Company entered into an agreement with Sand Hill Capital II, LP ("Sand Hill") for a line of credit of $15,000,000 bearing interest at 12%. At year end, the Company had borrowed $10,000,000 against this line. In connection with the financing, the Company also issued 30,000 share purchase warrants which entitle Sand Hill to purchase 30,000 common shares of the Company for Cdn$38.13 until April 27, 2005. The amount borrowed was repaid in May, 2000, and the line of credit facility was terminated.
6. Common Shares
Authorized capital
As of April 30, 2000, the Company's authorized share capital consists of an:
Unlimited number of common shares, no par value Unlimited number of preference shares
In August 1999, the articles of the Company were amended and restated to (i) remove and cancel the authorized and unissued Preferred Shares, (ii) create an unlimited number of Preference Shares, issuable in series, and (iii) authorize the directors of the Company from time to time before the issue thereof to fix the number of shares and determine the designation, rights, privileges, restrictions and conditions attaching to the shares of each series of Preference Shares.
Stock Split
On July 12, 2000, the Company effected a two-for-one stock split of the outstanding shares of common stock. All share and per share amounts in these consolidated financial statements have been adjusted to give effect to the stock split.
CERTICOM CORP. AND SUBSIDIARIES
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS Years Ended April 30, 1998, 1999 and 2000 (Continued)
7. Stock Incentive Plans
Employee Stock Option Plans
The Company's 1997 Stock Option Plan (the "New Plan") is administered by a committee of the Board and was adopted on June 17, 1997. The total number of common shares reserved for issuance under the New Plan may not exceed 6,000,000. Subject to the discretion of the Board or an option committee, options granted under the New Plan have a term of 5 years from the date of grant and vest as to 25% of the common shares subject to such option one year after the date of the grant of the option, and a further 2.0833% of the common shares subject to such option each month after such initial one-year period. Options may become immediately exercisable in the discretion of the Board in the event of a takeover bid, merger, amalgamation or other reorganization and may also be exercised for specified periods following the termination or death of the option holder. Options also become immediately exercisable in the event that any person acquires ninety percent of the common shares. No option may be exercisable for more than ten years after its grant. The exercise price for options is determined on the basis of the closing price of the common shares on The Toronto Stock Exchange on the trading date immediately preceding the date of the grant of the option.
The Company's original plan (its "original plan") is administered by a committee (the "Committee") of the Board of Directors. Subject to the discretion of the Committee, options have a term of five years and vest for the purpose of exercise as to 33% during each twelve-month period following the first anniversary from the date of the grant of the option. Options become immediately exercisable in the event that any person acquires ninety percent of the common shares and may be also exercised for specified periods following the termination of employment or death of an option holder. No option may be exercisable more than ten years after its grant. The exercise price for options was determined at the discretion of the Committee. In connection with the listing of its common shares on The Toronto Stock Exchange on June 17, 1997, the Company agreed with such stock exchange that it would not grant any further options under the original plan.
On April 27, 2000, the Company's shareholders approved a new stock option plan (the "U.S. Plan") for employees who are residents of the United States. The total number of common shares reserved for issuance under the U.S. Plan may not exceed 2,000,000. Subject to the discretion of the Board or an option committee, options granted under the U.S. Plan have a term of five years from the date of grant and vest as to 25% of the common shares subject to such option one year after the date of the grant of the option, and a further 2.0833% of the common shares subject to such option each month after such initial one-year period. Options may become immediately exercisable at the discretion of the Board in the event of a take-over bid, merger, amalgamation or other reorganization and may also be exercised for specified periods following the termination or death of the option holder. No option may be exercisable for more than 10 years after its grant. The exercise price for options is determined on the basis of the closing price of the common shares on the NASDAQ National Market on the trading date immediately preceding the date of the grant of the option.
CERTICOM CORP. AND SUBSIDIARIES
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS Years Ended April 30, 1998, 1999 and 2000 (Continued)
Accounting for Stock-Based Compensation
As a result of the Company applying APB No. 25, SFAS No. 123, Accounting for Stock-Based Compensation, requires disclosure of pro forma compensation expense arising from the Company's stock compensation plans based on the fair value of the options granted. The pro forma expense is measured as the fair value of the award at the date it is granted using an option-pricing model that takes into account the exercise price and expected term of the option, the current price of the underlying stock, its expected volatility, expected dividends on the stock and the expected risk-free rate of return during the expected term of the option. The compensation cost is recognized over the service period, usually the period from the grant date to the vesting date.
CERTICOM CORP. AND SUBSIDIARIES
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS Years Ended April 30, 1998, 1999 and 2000 (Continued)
As SFAS No. 123 has not been applied to options granted prior to May 1, 1995, the resulting pro forma compensation cost may not be representative of that to be expected in future years.
During the year ended April 30, 1997 certain option grants were made at prices significantly below the market price. The excess of market price over the exercise price is being amortized over the vesting period of the related options.
Conversion of Stock Options
As described in Note 2, the Company assumed certain options in conjunction with the acquisition of Consensus and converted these to 799,818 options of the Company at a weighted average exercise price of $0.42 per share. During the years ended April 30, 2000 and 1999, 204,072 and 49,788 of such options were exercised. The amounts relating to options exercised during the year were transferred from additional paid-in capital to common shares.
Stock Option Repricing
On March 17, 1999, the Board of Directors approved the exchange of 1,106,240 options to acquire common shares for options to acquire an aggregate of 382,914 common shares having a lower exercise price of $5.44 per share equal to the quoted market price of the shares. All of these options were held by directors and/or senior officers of the Company. Beginning July 1, 2000, these options will be subject to variable-award accounting under FASB Interpretation No. 44, Accounting for Certain Transactions Involving Stock Compensation, an Interpretation of APB Opinion No. 25.
CERTICOM CORP. AND SUBSIDIARIES
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS Years Ended April 30, 1998, 1999 and 2000 (Continued)
On August 17, 1998, the Board of Directors approved the exchange of 1,737,344 options to acquire common shares for the same number of options having a lower exercise price of $4.98 per share equal to the quoted market price of the shares. All of these options were held by employees (excluding directors and/or senior officers of the Company).
8. Income Taxes
The Company has determined that realization is not more likely than not and therefore a valuation allowance has been recorded against this deferred income tax asset.
The Company has certain non-capital losses of $32,366,000 and investment tax credits of $623,000 available in Canada, which can be applied against future taxable income and future taxes payable, respectively, and which expire from 2001 to 2009.
In addition, at April 30, 2000, the Company had an unclaimed scientific and research and experimental development expenditure pool balance of approximately $1,566,000 which can be applied against future taxable income.
CERTICOM CORP. AND SUBSIDIARIES
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS Years Ended April 30, 1998, 1999 and 2000 (Continued)
9. Segmented Information
The Company operates in one reportable segment and is a developer, manufacturer and vendor of digital information security products, technologies and services within the industry segment of electronic commerce.
CERTICOM CORP. AND SUBSIDIARIES
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS Years Ended April 30, 1998, 1999 and 2000 (Continued)
11. Commitments and Contingencies
At April 30, 2000 the Company has operating leases for office and research premises and furniture and equipment with the following minimum annual rental payments (in thousands of U.S. dollars):
Years Ending April 30, ---------
2001.......................................................... $ 2,124 2002.......................................................... 2,417 2003.......................................................... 2,330 2004.......................................................... 2,370 2005.......................................................... 2,390 Thereafter.......................................................... 5,316 ------- $16,947 =======
Rental expense under operating leases amounted to $208,000 in 1998, $438,000 in 1999 and $1,520,000 in 2000.
The Company has an outstanding letter of guarantee of approximately $1,028,000 in respect of a lease for its office premises.
12. Subsequent Event
On May 3, 2000, the Company completed a public offering of 2,500,000 common shares in the United States of America and Canada for net proceeds of $51,500,000.
* * * * *