Description

4Q09 Update:

I researched this idea December / January 2009 and wanted to post it before getting the full quarterly details.

Investment thesis remains intact despite slight weakness in the stock after earnings.  Analysts focused on lack of continued margin improvement (partially due to one-time items) and lack of Q1 guidance.  That said, the base domain name business continued to grow (+7% y/y) and should benefit from a seasonally strong 1Q10.  SSL certificate pricing continued to decline (due to faster growth in lower priced certificates, not due to continued discounting or customers migrating to cheaper certificates.  No further update on the CFIT lawsuit.  The company repurchased $250m of stock in the quarter.

Note on enterprise value calculation: I am using the 12/31/09 basic share count of 183.3m adjusted for 0.9 potentially dilutive shares (4Q09 8-K).  I am using $1.477b in cash and $1.25b in debt, treating the converts at par.  These converts are 3.25% converts due 2037 without hard puts and convert at $34.37, trading at ~81 for a ~4.5% yield.  For simplicity I have treated them as debt without conversion even though my target price of $35 would imply conversion.

Executive Summary

Verisign is a fallen angel of the dot com era and recently completed a $750m divestiture of non-core operations to focus on its domain name registry, SSL certificate and identity / authentication businesses.

Verisign's domain name business operates the master registry for the .com and .net top level domains ("TLDs") and receives a fee for every registered .com and .net domain; it is essentially a monopoly regulated by the Internet Corporation for Assigned Names and Numbers ("ICANN").  Verisign manages a global database of ~95m .com and .net domains to a very strict SLA (100% uptime for 11 years), and generates significant cash flow with tremendous operating leverage.  Despite a pending antitrust lawsuit launched by the Council for ICANN Transparency (CFIT), Verisign announced 12/09 that they would increase .com rate from $6.86 to $7.34 and the .net rate from $4.23 to $4.65 effective 7/10.

Verisign is the #1 provider of Secure Socket Layer ("SSL") certificates enabling website authentication and traffic encryption.  There is competition (e.g. EMC's RSA division), but Verisign has the largest market share (installed base of 1.1m+, 93% of Fortune 500) and brand recognition (90%+).

Verisign also operates an identity / authentication business which, while small, has tremendous upside.

The reconstituted Verisign is a market leader within attractive end markets and offers long-term organic growth of 10%+, high free cash flow with significant operating leverage, and enjoys high barriers to entry.

Based on my analysis, I believe VRSN is an attractive investment over the longer-term (18+ months) with a price target of $35, representing 11x '11E EBITDA and 20x '11E earnings.  In particular, I believe this mispricing exists due to three reasons:

1.       Lack of clarity around the true growth and earnings power of the reconstituted business: Verisign does not have a track record of operating the domain name and SSL businesses as a standalone operation and historic financials have been distorted by acquisitions of less attractive businesses.  As a result, the market is likely to discount the stability and growth of Verisign's earnings power until the new management team can establish a track record.  Consensus does not give new management too much credit and is worried about recent management turnover.  The domain name business is essentially a legal monopoly and Verisign is the #1, premium quality player in the SSL market.  I believe the core business should be able to grow the top line organically at ~10% and earnings even faster due to operational leverage.

2.       Legal overhang from CFIT antitrust lawsuit: The 9^th U.S. CCA reversed the 6/09 decision to dismiss CFIT's antitrust lawsuit against Verisign; which remains outstanding.  The lawsuit had already been dismissed twice before, and it is unlikely that a lawsuit will stand for a number of reasons.  Firstly, the plaintiff is not a well-respected group of multiple companies within the industry (CFIT's website does not function and research ties it to Rob Hall's Momentous.ca).  Secondly, I don't believe there is another company capable of replacing Verisign and its proprietary ATLAS system (Verisign handles >35x the traffic of #2 Afilias and #3 Neustar and has 100% uptime).  Thirdly, switching costs are prohibitive given the risk of the .com infrastructure not working.  Fourth, domain name costs are not prohibitively (i.e. as a proportion of total costs required to host a website).  Lastly, due to technical legal reasons (ICANN is not an economic actor) the .com contract can't be ruled as anticompetitive.  The likely worst case is that Verisign will not be allowed to increasing prices for a designated time period.  Verisign's decision to increase prices while the lawsuit remains pending may be taken as a sign of their confidence in having the lawsuit dismissed.

3.       Concerns around pricing pressure on SSL certificates:  Over the last few quarters, there has been increased competition and pricing pressure in the low-end of the SSL certificate market.  Verisign's ASP has fallen to $234 (-7.5% y/y) as Verisign's GeoTrust and Thawte brands have outsold premium branded SSL certificates.  Most investors expect this pricing trend to accelerate as SSL certificates are seen as just another cost item.  My view is that pricing will stabilize as the economy recovers, with companies willing to pay a premium for an SSL certificate that more customers know and trust, given that SSL certificates remain a small portion of the total costs of running an e-commerce business.  Conitinued decline in pricing will not be because customers migrate to lower priced certificates or due to discounting but rather because the lower priced segment continues to grow as penetration increases at smaller customers.

Downside risks include: a protracted CFIT lawsuit and / or adverse judgment, continued price erosion in SSL business, inability of new management to execute on a focused core.

Company Overview

Verisign was founded in 1995 as a spin-off from RSA Security (now owned by EMC) focused on the certificate authentication space.  The company went on to acquire 40+ businesses over the 1998 - 2007 time frame for $23b+ and reached a peak market capitalization of almost $38b in 2000.  Verisign is headquartered in Mountain View, CA with global operations.

In 11/07, Verisign announced a large divestiture program over 40+ acquired businesses in order to focus on its core domain name and registry businesses.  This divestiture program was completed in 2009 and resulted in proceeds of $750m.  Verisign also took the opportunity to restructure its operations and consolidate facilities and datacenters, resulting in a headcount reduction from 5,500 to 2,600 as of 3Q09, and a long-term target of 2,000.

Verisign has a strong technical track record with 100% network uptime over the past 11 years, possesses 200+ patents on internet security and infrastructure and is estimated to process 35x the average daily transaction volume of its closest competitor with a peak of 50b+ daily queries.

Verisign's historical financial results have been distorted by numerous acquisitions, but Verisign has managed to meet or exceed guidance in the last 8 quarters and has repurchased $2.5b of stock since 2007.  Verisign now operates a focused business targeting non-GAAP operating margins of 39 - 39.5%.  Verisign's debt consists of $1.25b in 3.25% convertible bonds maturing 8/37, and a $500m revolving credit facility that is currently undrawn.  As of 3Q09, $905m is remaining under the 2008 share repurchase program.

Domain Name Registration (FY09E Revenues: $603m, 59% of total)

Of the 184m total domain names registered, .com is the largest top level domain ("TLD") accounting for ~44% of all domains, followed by .cn (China), .de (Germany) and .net.  Verisign is the exclusive registrar for the .com and .net top level domains, making it by far the largest for-profit registry operator globally; #2 Afilias manages ~15m and #3 Neustar manages 4m.

The .com domain name registration was initially overseen by the U.S. Department of Defense until 1993, when it was privatized in a co-operative agreement with Network Solutions.  In 1995, a $50 annual fee was instated for domain name registration.  ICANN was formed in 1998 as a non-profit organization under the U.S. Department of Commerce ("DoC") to oversee a number of internet related tasks, including the assignment of domain names and IP addresses.  In 1999, ICANN oversaw the introduction of competition into the registrar business and separated Network Solutions to separate its registry (operating the master database) and registrar (selling domain names to businesses and consumers) operations.  Verisign acquired the entire Network Solutions in 6/00 for $21b, before divesting its registrar operations to Pivotal Private Equity 11/03 (later sold to General Atlantic 3/07 for ~$800m).  In 9/06, ICANN signed a new contract with the DoC that moved ICANN closer to independent management of the internet's identifier infrastructure with less U.S. regulatory oversight.

Verisign kept the registry business and renewed the original .com contract in 2001.

The current .com contract was signed in 11/06, lasts through 11/12 and allows Verisign to charge raise prices by up to 7% in four of the six years.  The agreement has a 'presumptive right of renewal' that automatically renews the contract on existing terms for another 6 years assuming both Verisign and ICANN meet their contractual obligations.

There is some controversy surrounding this contract, which was signed as part of a settlement between Verisign and ICANN and was never competitively bid.  Verisign had sued ICANN alleging that ICANN had unfairly delayed the approval of services such as wait-list, internationalized domain names and site finder which impacted Verisign's ability to offer new services.

The current .net contract was signed in 6/05.  It was put out to a competitive bid with five parties bidding and Verisign winning.  Verisign's bid was supported by numerous IT and telecom companies including Microsoft, IBM, Sun Microsystems and MCI who all asserted Verisign's 100% uptime record was crucial to maintaining the critical .net infrastructure.  It allows Verisign to charge $3.50 per .net domain and to raise prices by up to 10% in 4 of the 6 years. 

End customers (consumers and businesses) do not directly register domains with Verisign; they typically register domains through registrars; typically internet service providers ("ISPs") such as AOL and web-hosting companies such as Yahoo!, Web.com, Network Solutions, Register.com, Hostway and GoDaddy.  Hosting companies especially compete fiercely for customers, and often offer domain name registration as a loss leader for free to try to upsell other services such as web hosting and online marketing.

Domain names can be renewed for 1-10 years; Verisign's current renewal rates are >70% and previously renewed names are becoming a larger % of renewals.  It is worth noting that domain name registration is relatively defensive - it is one of the lowest and most fundamental costs of maintaining an online presence.  Additionally, even when Google and ICANN enacted new rules against cyber squatting in early 2008, domain name registration continued to grow.

Operating the registry for domain names requires a significant amount of expertise and infrastructure investment.  Verisign's global database of ~95m domain names updates in < 15 seconds, and is run across 13 large resolution sites around the world, with many smaller regional internet resolution sites ("RIRS").  More importantly, the database is highly scalable; Verisign estimates that they have the capacity to handle 4T+ daily DNS queries vs. the current 50b peak.  To achieve this, Verisign developed Advanced Transaction Lookup and Signaling System ("ATLAS"), a proprietary system which handles DNS traffic faster and more efficiently than any other commercial solution.

In 11/05, CFIT filed an antitrust lawsuit against Verisign in California under Sections 1 and 2 of the 1890 Sherman Act, the Cartwright Act, and the California Business and Professional Code alleging that:

1. The 2006 .com contract was renewed without a formal, competitive bidding process and contains provisions that restricts future competitive bidding
2. The 7% annual price increases are above markets
3. Verisign engaged in illegal, predatory practices to reach the 2006 .com agreement
4. The 2006 .com agreement permits Verisign to unfairly control expiration of domain names

CFIT is a non-profit corporation that is composed of DNS stakeholders, including domain name registrars and owners of domain names (registrants).  Little is known about CFIT and their website is inactive (http://www.cfit.org).  A 2005 Register article alleges that CFIT was created by Rob Hall, who started one of Canada's first ISPs, founded the Canadian Internet Regulatory Authority ("CIRA") and now leads Momentous.ca.  The article also mentions that the companies supporting CFIT and CFIT directors are all affiliated with Momentous.ca, and that the motivation is to lower Momentous' cost of acquiring new domain names.  Other than the credibility of CFIT, I believe that the lawsuit will ultimately be dismissed for a number of reasons, even though the .com contract was awarded in a non-competitive bid:

• The CFIT lawsuit has already failed three times; the original lawsuit filed in 11/05 was dismissed in 2/06, the first amendment filed 3/06 was dismissed 12/06 and the second amendment (which removed ICANN as a defendant and focused on the .com contract) filed 12/06 was originally dismissed 5/07 for failure to state a claim, before being reversed in 6/09.
• It is unclear if there is another party who can credibly operate the .com and .net registry.  Neustar (.us and .biz) and Afilias (.info) might be able to provide the same SLA; but the risk of a non-seamless transition (i.e. the internet not working) would likely prohibit a competitive bid
• Domain registration costs to end-customers are not prohibitively high.  As previously mentioned, competition has led web hosting providers to offer free domain name registration as a loss-leader to try to sell hosting, online marketing and other services.  Furthermore, domain name registration is very small portion of the costs required to run an e-commerce operation (e.g. vs. costs of fulfillment, costs of an outsourced ecommerce provider such as GSI Commerce and Digital River, costs of online payment)
• ICANN is part of the U.S. Department of Commerce ("DoC"), and DoC representatives (i.e. the U.S. federal government) approved the .com contract.  VeriSign argues that ICANN is not an economic actor; activities between a regulatory body and an economic entity cannot constitute antitrust violations under Section 1 of the Sherman Act and, in turn, cannot be construed as anticompetitive.
• The terms of the .com contract are very similar to the terms of the .net contract which was competitively bid and ratified by the DoC, including a 6-year term, price increases in 4 of the 6 years, and the right to presumptive renewal.  However, it is worth noting that the .com price at the beginning of the contract was $6.00 vs. $3.50 for the .net contract, and that under the current contract structure, the prices will only converge in 2035.

Verisign's domain business has a number of growth opportunities.  In addition to the growth in .com and .net domains, Verisign also operates the registry for gTLD's .name and .jobs and cTLD's .cc and .tv and can continue to grow the number of TLDs it manages.  I believe this segment should grow the top line >10%, with operating leverage driving greater profit growth.

SSL Certificates Business (FY09E Revenues: $280.1m, 27% of total)

Verisign is the #1 provider of SSL certificates which are critical to enabling e-commerce.  An SSL certificate is purchased by a business to protect a server hosting a website.  When an e-commerce customer visits a website with a Verisign SSL, they are able to shop safely knowing that the website really is who they claim to be and that any payment information submitted on the site is 'secure'.

Verisign is the established market leader and claims 93% of the Fortune 500, 97% of the top 100 banks and 90% of the top 50 online retailers as Verisign SSL customers.  Verisign secures 1m+ web servers globally and has issued 4m SSL certificates to date, processing 1B+ certificate status lookups daily

Additionally, it widely recognized by consumers with 90%+ of internet users recognizing Verisign's seal. 

Verisign offers a range of SSL certificates across different pricing points, including Verisign's branded premium 'Secure Site Pro' and 'Secure Site' certificates, and lower-priced GeoTrust and thawte certificates.  Verisign sells certificates for 1-3 years, with the average being 15 months as customers prefer tie certificates to web server upgrade cycles.

Throughout the economic downturn, SSL pricing has fallen as Verisign's GeoTrust and thawte certificates outsold Verisign's premium branded certificates, leading many analysts to believe that the SSL certificate market is highly commoditized and seen as just another cost item. 

I believe that there was a step change in pricing as new, lower priced certificates were made available, and that the downturn forced customers to 'trade down' to reduce costs and reduce their server footprint.  As the economy recovers, I expect SSL certificate pricing to stabilize for the following reasons:

• Customers increasingly aware of the risk of online fraud and place a premium on reputable, well-protected e-commerce sites. As a result, SSL certificates are increasingly viewed as a differentiator vs. a pure cost item
• SSL certificates are a relatively low portion of the total costs required to run an e-commerce business. Costs of an outsourced platform like GSI Commerce or internally-owned fulfillment and back-office systems are significantly higher

Additionally, secular e-commerce trends will help drive volume growth in the SSL certificate market.  E-commerce currently accounts for ~4.5% of non-retail sales (ex travel) suggesting a tremendous market opportunity.  Verisign reports that sites with the Verisign seal have measured a 10-36% sales uptick.

Verisign currently estimates the addressable market to be $400m, serving 1m transaction customers and sees this expanding to $1b serving 20m customers by 2012

Identity / Authentication Services (FY09E Revenues: $143m, 13.9% of total)

Verisign's IAS is the smallest remaining business.  This segment is focused on 'strong authentication' which uses multiple forms of identification to allow enterprises to deploy secure remote access and secure business applications.  Other forms of authentication include Public Key Infrastructure ("PKI") and digital tokens with one-time passwords.

Verisign sells digital tokens and charges an installation fee, and also offers managed services.  Key products include Verisign Identity Protection Services, Fraud Detection Services, Managed PKI Services and Unified Authentication Services.

The security hardware token market was estimated at ~$500m in 2007 by IDC and is expected to grow rapidly with several secular growth trends in this segment.  Increased workforce mobility is driving enterprises to provide secure solutions, and stricter regulation within retail banking is driving increased adoption of security tokens (countries like Singapore are now requiring banks to offer security tokens for online banking).  There are several players offering solutions in this area including EMC's RSA division, VASCO, Entrust, Telcordia, Aladdin and Secure Computing.

This is an attractive end market where Verisign can leverage is strong position within infrastructure services, and focused IT security companies tend to trade at high multiples.  However, this is a new growth area for Verisign and is also highly competitive; accordingly, I view this business line as incremental upside rather than as part of my base case investment thesis.

Acquisition History

Verisign was a highly acquisitive company, making 40+ acquisitions from 1998 - 2007 for $23b+, including the $19b acquisition of Network Solutions (now the domain name registry business) in 06/00 and the $1.3b acquisition of Illuminet (the bulk of Verisign's Communication Services Group, including an SS7 network and other telecommunications services).  In 11/07, Verisign announced that it was going to divest the majority of its acquisitions to focus on its core domain name, SSL certificate and identity businesses.  Despite the economic downturn, Verisign completed its divestiture process late 2009 with the sale of its messaging business to Syniverse for $175m, its global security consulting business to AT&T for $5m and the sale of m-Cube for $18.5m.

Ownership Profile

Verisign's ownership is widely dispersed with a 99.8% float.  Insiders own <1%, but have increased their holdings 16% vs. the 2Q09 period.  It is worth mentioning that Eton Park reduced their holdings 37.5% to 3.9% of the company ($180m at today's price).

Management Overview

Verisign has undergone significant management turnover in recent history.  12-year CEO Stratton Sclavos stepped down 5/07 amidst the stock options investigation and investor dissatisfaction with an unsuccessful acquisition strategy.  He was replaced by Bill Roper, who served as interim CEO before being replaced by co-founder and board member Jim Bidzos 7/08.

The current management team was established 8/09 with the appointment of Mark McLaughlin as CEO and Brian Robins as CFO.  James Bidzos was appointed permanent Chairman after acting as interim CEO.  Both Mark and Brian were internal promotes.

Mark was previously appointed COO 1/09, rejoining the company after a two year hiatus.  He joined Verisign 12/99 after Verisign acquired Signio where he was VP of Sales and Business Development.  His other roles within Verisign included Corp Dev and running the Naming business, where he worked extensively with ICANN.

Historic Valuation and Comps

Verisign has no direct comps; the closest is probably Neustar which has manages the .us and .biz domains which are significantly smaller than Verisign's .com and .net installed base.  Neustar is also the exclusive registrar of the North American Numbering Plan Administrator ("NANPA"), which is essentially responsible for number portability.  This is a less attractive 'regulated monopoly' as number registration is a lower-growth business vs. domain names.  Additionally, I believe that Neustar's voluntary change in contract structure in early 2009 (which lowered fees) was an opportunistic move to position them to take a bigger role within IP networks.

With respect to historic multiples, Verisign trades at a discount to EV/EBITDA (13x) and P/E (27x) despite the fact that Verisign now has a more focused and higher quality business.

Analyst Consensus

Verisign is covered by a large number of brokers but coverage is not very deep.  Most brokers upgraded Verisign following the conclusion of its divestiture program.  Analyst concerns include slowing domain growth in core .com and .net domains, overhang from the CFIT lawsuit and increasing price pressure in the SSL segment.

Financial Summary

Catalyst

1) Verisign's focused core business continues to execute and Street gets comfortable with new management and new business profile

2) Resolution of CFIT lawsuit (for short term investors: I do not believe this is imminent and likely not in 2010)