Yahoo 2014 Annual Report Download - page 27

country be maintained in their country. Having to maintain local data centers in individual countries
could increase our operating costs significantly. The interpretation and application of privacy, data
protection and data retention laws and regulations are often uncertain and in flux in the U.S. and
internationally. These laws may be interpreted and applied inconsistently from country to country
and inconsistently with our current policies and practices, complicating long-range business planning
decisions. If privacy, data protection or data retention laws are interpreted and applied in a manner
that is inconsistent with our current policies and practices we may be fined or ordered to change our
business practices in a manner that adversely impacts our operating results. Complying with these
varying international requirements could cause us to incur substantial costs or require us to change
our business practices in a manner adverse to our business and operating results.
Interruptions, delays, or failures in the provision of our services could damage our reputation and
harm our operating results.
Delays or disruptions to our service, or the loss or compromise of data, could result from a variety of
causes, including the following:
• Our operations are susceptible to outages and interruptions due to fire, flood, earthquake,
tsunami, other natural disasters, power loss, equipment or telecommunications failures, cyber
attacks, terrorist attacks, political or social unrest, and other events over which we have little or
no control. We do not have multiple site capacity for all of our services and some of our systems
are not fully redundant in the event of delays or disruptions to service, so some data or systems
may not be fully recoverable after such events.
• The systems through which we provide our products and services are highly technical, complex,
and interdependent. Design errors might exist in these systems, or might be introduced when we
make modifications, which might cause service malfunctions or require services to be taken
offline while corrective responses are developed.
• Despite our implementation of network security measures, our servers are vulnerable to
computer viruses, malware, worms, hacking, physical and electronic break-ins, router disruption,
sabotage or espionage, and other disruptions from unauthorized access and tampering, as well as
coordinated denial-of-service attacks. We may not be in a position to promptly address attacks
or to implement adequate preventative measures if we are unable to immediately detect such
attacks. Such events could result in large expenditures to investigate or remediate, to recover
data, to repair or replace networks or information systems, including changes to security
measures, to deploy additional personnel, to defend litigation or to protect against similar future
events, and may cause damage to our reputation or loss of revenue.
• We rely on third-party providers over which we have little or no control for our principal Internet
connections and co-location of a significant portion of our data servers, as well as for our
payment processing capabilities and key components or features of certain of our products and
services. Any disruption of the services they provide us or any failure of these third-party
providers to handle higher volumes of use could, in turn, cause delays or disruptions in our
services and loss of revenue. In addition, if our agreements with these third-party providers are
terminated for any reason, we might not have a readily available alternative.
Prolonged delays or disruptions to our service could result in a loss of users, damage to our brands,
legal costs or liability, and harm to our operating results.
23