BlackBerry (BB) Risk Factors

The Company's commercial success is highly dependent upon its ability to protect its proprietary technology. The Company relies on a combination of patents, copyrights, trademarks, trade secrets, confidentiality procedures and contractual provisions to protect its proprietary rights, all of which offer only limited protection. Despite the Company's efforts, the steps taken to protect its proprietary rights may not be adequate to preclude misappropriation of its proprietary information or infringement of its intellectual property rights. Detecting and protecting against the unauthorized use of the Company's products, technology proprietary rights, and intellectual property rights is expensive, difficult and, in some cases, impossible. Litigation may be necessary in the future to enforce or defend the Company's intellectual property rights and could result in substantial costs and diversion of management resources, either of which could harm the Company's business, financial condition and results of operations, and there is no assurance that the Company will be successful. Further, the laws of certain countries in which the Company's products and services are sold or licensed do not protect intellectual property rights to the same extent as the laws of Canada or the United States. With respect to patent rights, the Company cannot be certain whether any of its pending patent applications will result in the issuance of patents or whether the examination process will require the Company to narrow its claims. Furthermore, any patents issued could be challenged, invalidated or circumvented and may not provide proprietary protection or a competitive advantage. In addition, a number of the Company's competitors and other third parties have been issued patents, and may have filed patent applications or may obtain additional patents and proprietary rights, for technologies similar to those that the Company has made or may make in the future. Public awareness of new technologies often lags behind actual discoveries, making it difficult or impossible to know all relevant patent applications at any particular time. Consequently, the Company cannot be certain that it was the first to develop the technology covered by its pending patent applications or that it was the first to file patent applications for the technology. In addition, the disclosure in the Company's patent applications may not be sufficient to meet the statutory requirements for patentability in all cases. As a result, there can be no assurance that the Company's patent applications will result in patents being issued. While the Company enters into confidentiality and non-disclosure agreements with its employees, consultants, contract manufacturers, customers, potential customers and others to attempt to limit access to, and distribution of, proprietary and confidential information, it is possible that: - some or all of its confidentiality agreements will not be honored;- third parties will independently develop equivalent technology or misappropriate the Company's technology or designs;- disputes will arise with the Company's strategic partners, customers or others concerning the ownership of intellectual property;- unauthorized disclosure or use of the Company's intellectual property, including source code, know-how or trade secrets will occur; or - contractual provisions may not be enforceable. In addition, the Company expends significant resources to patent and manage the intellectual property it creates with the expectation that it will generate revenues by incorporating that intellectual property in its products or services. The Company also monetizes its patent assets through outbound licensing. Changes in the law may weaken the Company's ability to collect royalty revenue for licensing its patents. Similarly, licensees of the Company's patents may fail to satisfy their obligations to pay royalties, or may contest the scope and extent of their obligations. Finally, the royalties the Company can obtain to monetize its intellectual property may decline because of the evolution of technology, changes in the selling price of products using licensed patents, or the difficulty of discovering infringements. The consideration payable to the Company from the sale of its non-core patent portfolio in the Malikie Transaction is expected to include potential future royalty payments. The royalties, if any, that may be earned by the Company from the Malikie Transaction in any particular fiscal year or in the aggregate over the term of the royalty arrangement are difficult to predict, particularly given that any such royalties will depend entirely upon the business success of a third party. The aggregate proceeds that the Company ultimately receives from the Malikie Transaction are expected to be less than $900 million.

The Company is continuously exposed to cyber threats through the actions of outside parties, such as hacking, viruses, and other malicious software, denial of service attacks, industrial espionage and other methods designed to breach the Company's network or data security. The Company is also exposed to risk as a result of process, coding or human errors and through attempts by third parties to fraudulently induce employees to provide access to confidential or personal information. Although malicious attempts to gain unauthorized access to such information affect many companies across various industries, the Company is at a relatively greater risk of being specifically targeted because of its reputation for security and the nature of its network operations, and because the Company has been involved in the identification of organized cyber adversaries. The Company devotes significant resources to network security, encryption and authentication technologies and other measures, including security policies and procedures, vulnerability testing and awareness training, to mitigate cyber risk to its systems, endpoints and data. In addition, the Company engineers novel security and reliability features, deploys software updates to address vulnerabilities, and maintains a security infrastructure that protects the integrity of the Company's network, products and services. The Company also mitigates risk by actively monitoring external threats, reviewing best practices and implementing appropriate internal controls, including incident response plans. However, the techniques used to obtain unauthorized access or to disable or degrade service are constantly evolving and becoming more sophisticated in nature, and frequently are not recognized or identified until after they have been deployed against a target. The Company may not be able to anticipate these techniques, to implement adequate preventative measures or to identify and respond to them in a timely manner, and the Company's efforts to do so may have a material adverse impact on the Company's operating margins, the user experience or compatibility with third party products and services. Although to date the Company has not experienced any material financial or other losses relating to technology failure, cyberattacks or security breaches, there is no assurance that the Company will not experience material loss or damage in the future. If the network and product security measures implemented by the Company or its partners, including third-party data center operators, cloud service providers and product manufacturers are breached, or perceived to be breached, or if the confidentiality, integrity or availability of the Company's data, including intellectual property and legally protected personal data, is compromised, the Company could be exposed to significant litigation, service disruptions, investigation and remediation costs, regulatory sanctions, fines and contractual penalties. In addition, any such event could materially damage the Company's reputation, which is built in large measure on the security and reliability of BlackBerry products and services, and could result in the loss of investor confidence, channel partners, competitive advantages, revenues and customers, including the Company's most significant government and regulated enterprise customers. While the Company maintains cybersecurity insurance, the Company's coverage may be insufficient to cover all losses or types of claims that may arise from cyber incidents, and any incidents may result in the loss of, or increased costs of, the Company's insurance.

The Company's operations rely to a significant degree on the efficient and uninterrupted operation of complex technology systems and networks, which are in some cases integrated with those of cloud service providers and third-party data centre operators. The Company's network operations and technology systems are potentially vulnerable to damage or interruption from a variety of sources, including by fire, earthquake, power loss, telecommunications or computer systems failure, cyberattack, human error, terrorist acts, war, and the threatened or actual suspension of BlackBerry services at the request of a government for alleged non-compliance with local laws or other events. The increased number of third-party applications on the Company's network may also enhance the risk of network disruption or cyberattack for the Company. There may also be system or network interruptions if new or upgraded systems are defective or not installed properly, or if data centre operators fail to meet agreed service levels. The Company has experienced network events, including those arising from third-party applications, in the past, none of which had a material impact on us. Any future outage in a network or system or other unanticipated problem that leads to an interruption or disruption of BlackBerry services, however, could have a material adverse effect on the Company's business, results of operations and financial condition, and could adversely affect the Company's reputation.