Gogo (GOGO) Risk Factors

We are subject to the FCPA, the Bribery Act and other anti-corruption, anti-bribery and anti-money laundering laws in various jurisdictions around the world. The FCPA, the Bribery Act and similar applicable laws generally prohibit companies, their officers, directors, employees and third-party intermediaries, business partners and agents from making improper payments or providing other improper things of value to government officials or other persons. We and our third-party intermediaries may have direct or indirect interactions with officials and employees of government agencies or state-owned or affiliated entities and other third parties where we may be held liable for the corrupt or other illegal activities of these third-party business partners and intermediaries, our employees, representatives, contractors, resellers and agents, even if we do not explicitly authorize such activities. While we have policies and procedures and internal controls to address compliance with such laws, we cannot assure you that all of our employees and agents will not take actions in violation of our policies and applicable law, for which we may be ultimately held responsible. To the extent that we learn that any of our employees, third-party intermediaries, agents, or business partners do not adhere to our policies, procedures, or internal controls, we are committed to taking appropriate remedial action. In the event that we believe or have reason to believe that our directors, officers, employees, third-party intermediaries, agents, or business partners have or may have violated such laws, we may be required to investigate or have outside counsel investigate the relevant facts and circumstances. Detecting, investigating and resolving actual or alleged violations can be extensive and require a significant diversion of time, resources and attention from senior management. Any violation of the FCPA, the Bribery Act, or other applicable anti-bribery, anti-corruption laws and anti-money laundering laws could result in whistleblower complaints, adverse media coverage, investigations, loss of export privileges, severe criminal or civil sanctions, fines and penalties, all of which may have a material adverse effect on our business, financial condition and results of operations.

In the ordinary course of our business, we or our third-party providers collect, process and store sensitive data, including personal information of our employees and customers. The secure processing, maintenance and transmission of this information (and other sensitive data such as our proprietary business information and that of our customers and suppliers) is critical to our operations and business strategy. Despite our security measures, our information technology and infrastructure may be vulnerable to attacks by hackers or may be compromised due to employee error, malfeasance, hardware or software defects or other disruptions. Further, our in-cabin network operates as an open, unsecured Wi-Fi hotspot, and non-encrypted transmissions users send over this network may be vulnerable to access by other users on the same plane. We depend on the security of the network infrastructure and products of our third-party providers of telecommunications, cloud computing, customer support and other vendors. Unauthorized use of our, or our third-party service providers', networks, computer systems and services could potentially jeopardize the security of confidential information, including personal information of passengers using our service. Data security threats are constantly evolving and may be difficult to anticipate or to detect for long periods of time, and may include ransomware attacks, network intrusion, data extortion, malware, phishing and other social engineering, business email compromise and insider threats, among others. We and our third-party service providers have in the past been subject to breaches and attempts to gain unauthorized access to our information technology systems or sensitive or confidential data, or to disrupt our operations, and we and our third-party service providers have in the past not always been able to anticipate or prevent such breaches or attempts. To date, none of these breaches or attempts has, individually or in the aggregate, resulted in a security incident with a material effect on our operations or our financial condition, results of operations, liquidity, or cash flows. However, these breaches could have a material impact in the future, and there can be no assurance that any security measures we, or third parties, take will be effective in anticipating or preventing these activities, given the constantly changing nature of the threats. Any such security incidents, unauthorized access or disclosure, or other loss of information could result in legal claims or proceedings and liability under our contracts with certain customers, which generally require us to indemnify the customer for passenger and other third-party claims arising from data security breaches. In addition, such incidents may disrupt our operations and the services we provide to customers, result in the loss of value of trade secrets, require expensive efforts to investigate, remediate or resolve, damage our reputation, and cause a loss of revenue, reputational harm or a loss of confidence in our products and services, all of which may have a material adverse effect on our business prospects, financial condition and results of operations. We may also maintain cyber liability insurance that covers certain damages caused by cyber incidents. However, there is no guarantee that adequate insurance will continue to be available at rates that we believe are reasonable or that the costs of responding to and recovering from a cyber incident will be covered by insurance or recoverable in rates. Additionally, as discussed in more detail in the section titled "Business-Licenses and Regulation-Privacy and Data Security-Related Regulations," we are subject to certain state laws, federal and non-U.S. laws that impose data breach notification requirements, specific data security obligations, or other consumer privacy-related requirements. Our failure to comply with any of these rules or regulations, or an allegation or finding that we failed to comply, could result in litigation, investigations or regulatory enforcement actions, fines or penalties, which may have a material adverse effect on our business, financial condition and results of operations. These legal requirements are complex, varied, rapidly evolving and often subject to interpretation, and there is a risk that, despite our efforts to comply, we may be found to be out of compliance with one or more of these requirements. Fines issued for non-compliance with such requirements may be substantial, including fines issued under the GDPR which can be as high as 4% of global revenue, and an adverse finding by a regulator or court may result in costly and onerous requirements being placed on the Company, a prohibition on engaging in certain aspects of our business or damage to our reputation. Certain data protection laws that apply to the Company establish a private right of action. In addition, non-compliance with certain of these requirements could lead to investigations, regulatory enforcement actions, class actions or other private litigation based on theories that may include breach of contract or negligence, among others. Such litigation could result in material costs to the Company. We cannot be sure that a regulator would deem our security measures to be appropriate given the lack of prescriptive measures in certain data protection laws. Without more specific guidance, we cannot know whether our chosen security safeguards are adequate according to each applicable data protection law. Even in cases where the applicable requirements are explicit, we cannot be certain that safeguards designed to meet those requirements will be interpreted by a regulator or court as adequate or that those safeguards are operating in accordance with the requirements at all times. Even security measures that are appropriate, reasonable, and/or in accordance with applicable legal requirements may not be able to fully protect our or our partners' information technology systems and the data contained in those systems. Moreover, interpretations or changes to new or existing data protection laws may impose on us responsibility for our employees and third parties that assist with aspects of our data processing. As a result, our employees' or third parties' intentional, unintentional, or inadvertent actions may increase our vulnerability or expose us to security threats, such as phishing attacks, and we may remain responsible for a successful phishing or other social engineering attack despite the quality and otherwise legal sufficiency of our technical security measures. In addition, compliance with complex variations in privacy and data security laws may require modifications to current business practices, including significant technology efforts that require long implementation timelines, increased costs and dedicated resources. We depend on the security of the network infrastructure and products of our third-party providers of communications, cloud computing, customer support and other vendors. Despite our efforts, those third parties may maintain inadequate safeguards to protect data they maintain for us or services on which we depend, or they may experience a cybersecurity incident or data breach despite safeguards that appear adequate. We also rely on hardware and software developed by third parties. Such hardware and software could contain security vulnerabilities or backdoors introduced by the vendor or an unauthorized third party, which could jeopardize the security of our systems, data and networks. Such incidents or breaches could expose us to regulatory and litigation risk, operational disruption and reputational harm and adversely affect our business.

Open-source software is software made widely and freely available to the public in human-readable source code form, usually with liberal rights to modify and improve such software. Some open-source licenses require as a condition of use that proprietary software that is combined with licensed open-source software and distributed must be released to the public in source code form and under the terms of the open-source license. Accordingly, depending on the manner in which such licenses were interpreted and applied, we could face restrictions on our ability to commercialize certain of our products and we could be required to: (i) release the source code of certain of our proprietary software to the public, including competitors, if the open-source software was linked in a manner that would require such release of our proprietary software source code; (ii) seek licenses from third parties for replacement software; and/or (iii) re-engineer our software in order to continue offering our products. Such consequences may materially adversely affect our business.

We have in the past and will in the future integrate new and evolving technologies, such as AI, into our products and services. As with many innovations, AI presents risks and challenges that could affect its adoption and, as a result, our business. Our implementation of AI in our products and services may have unintended consequences due to its inherent limitations or our failure to use it effectively. For example, AI algorithms may be flawed due to a lack of back-testing or datasets of poor quality or inappropriate bias, and analyses generated by AI may be deficient or inaccurate, subjecting us to competitive or reputational harm. Additionally, AI entails significant legal risks. The IP ownership and license rights of new technologies such as AI have not been fully addressed by U.S. courts, and the use or adoption of such technologies in our products and services may expose us to potential intellectual property claims, breach of a data or software license, website terms of service claims, claimed violations of privacy rights or other tort claims. Governmental regulation and laws related to AI may also increase the burden and cost of research and development or require increased transparency that makes it more difficult to protect our IP. For instance, on October 30, 2023, the Biden administration issued an executive order to, among other things, establish extensive new standards for AI safety and security. Other jurisdictions may decide to adopt similar or more restrictive legislation rendering the use of such technologies challenging. Social and ethical issues relating to the use of new and evolving technologies such as AI in our offerings could also harm our competitive position and brand, or create legal liability, and may cause us to incur additional research and development costs to resolve such issues. Lastly, the rapid evolution and increased adoption of AI technologies may intensify our cybersecurity risks. For more information, see "-We could be adversely affected if we or our third party suppliers or service providers suffer service interruptions or delays, technology failures, damage to equipment or system disruptions or failures arising from, among other things, force majeure events, cyberattacks or other malicious activities."

We rely on third-party suppliers for equipment components and services that we use to provide our services. Our suppliers range in size and scale from large to small and may have differing levels of access to capital and going concern profiles. Many suppliers of critical components of our equipment are single-source providers. Components for which we rely on single-source suppliers include, among others, the antennas and modems for all systems, the equipment used at our ATG cell site base stations and the ESA for our Gogo Galileo network. We plan to launch Gogo Galileo using Eutelsat OneWeb as our sole LEO satellite network provider. If we are required for any reason (including expiration of the contract, termination by one party for material breach or other termination events) to find one or more alternative suppliers, we estimate that the replacement process could take up to two years depending upon the component or service, and we may not be able to contract with such alternative suppliers on a timely basis, on commercially reasonable terms, or at all. Finding and contracting with suppliers of some components may be delayed or made more difficult by current suppliers' ownership of key intellectual property that requires alternative suppliers to either obtain rights to such intellectual property or develop new designs that do not infringe on such intellectual property. In addition, many of our components, such as the equipment used in our base stations, are highly integrated with other system components, which may further lengthen the time required for an alternative supplier to deliver a component or service that meets our system requirements. We also rely on third parties to provide the links between our data centers and our ground network. If we are not able to continue to engage suppliers with the capabilities or capacities required by our business, or if such suppliers fail to deliver quality products, parts, equipment and services in sufficient quantities or on a timely basis consistent with our inventory needs and production schedule, our business, financial condition and results of operations may be materially adversely affected. The supply of third-party components and services could be interrupted or halted by a termination of our relationships, a failure of quality control or other operational problems at such suppliers or a significant decline in their financial condition. If we are not able to continue to engage suppliers with the capabilities or capacities required by our business, or if such suppliers fail to deliver quality products, parts, equipment and services on a timely basis consistent with our schedule, our business, financial condition and results of operations may be materially adversely affected.

Revenue from equipment sales accounted for approximately 20%, 27% and 23% of our revenue from continuing operations for the fiscal years ended December 31, 2023, 2022 and 2021, respectively. More than 90% of our equipment revenue in each such fiscal year was generated from contracts with OEMs and after-market dealers. Almost all of our contracts with OEMs and dealers are terminable at will by either party on short notice. If one or more key OEMs or dealers terminates its relationship with us for any reason or our contract expires and is not renewed, our business and results of operations may be materially and adversely affected. In addition, pursuant to many of our contracts with our OEM distribution partners, we have agreed to deliver equipment and/or services, including equipment and services not yet in production, for a fixed price and, accordingly, take the risk of any cost overruns or delays in the completion of the design and manufacturing of the product. Certain of our contracts with our OEMs also include provisions that, under specified circumstances, entitle them to the benefit of certain more favorable provisions than included in other equipment contracts, including with respect to pricing. These provisions, some of which have retroactive effect, may limit the benefits we realize from contracts containing such provisions. Our inability to identify and offer improved terms to a distribution partner or customer in accordance with such a provision could negatively affect our relationship with that distribution partner or customer or give rise to a claim that we are in breach of such contract. Many of our distribution partners have also not committed to purchase any minimum quantity of our equipment. In certain cases, we must anticipate the future volume of orders based upon non-binding production schedules provided by OEMs, historical purchasing patterns and informal discussions with customers and dealers as to their anticipated future requirements. Cancellations, reductions or delays by OEMs and dealers may have a material adverse effect on our business, financial condition and results of operations. Some of our dealers are experiencing continuing issues with labor shortages, which has impacted their ability to install our equipment, leading to a longer period of time between shipment and activation of our equipment. If our dealers are unable to eliminate or mitigate these labor shortages, our business, financial condition and results of operations may be materially adversely affected. Our distribution partners may be materially adversely impacted by economic downturns and market disruptions. See "-Adverse economic conditions, including economic slowdowns, may have a material adverse effect on our business." In anticipation of changing economic conditions, OEMs in particular may be more conservative in their production, which may reduce our market opportunities. Further, unfavorable market conditions could cause one or more of our OEMs or dealers to file for bankruptcy, which may have a material adverse effect on our business, financial condition and results of operations.

The market for our services is characterized by evolving technology, changes in customer and passenger needs and performance expectations, and frequent new service and product introductions. Our success will depend, in part, on our and our suppliers' ability to continue to enhance existing technology and services or develop new technology and services on a timely and cost-effective basis. If we or our suppliers fail to adapt quickly enough to changing technology, customer requirements and/or regulatory requirements, our business and results of operations may be materially adversely affected. We expect to have to invest significant capital to keep pace with innovation and changing technology, and if the amount of such investment exceeds our plans or the amount of investment permitted under the 2021 Credit Agreement (as defined below), it may have a material adverse effect on our results of operations. As is common in industries like ours, changing technology may result in obsolescence as we implement new technologies and products and retire old technologies and products. As we encounter such obsolescence, we need to ensure that we have a sufficient supply of parts, products and equipment compatible with our existing technology, as well as access to maintenance, repair and other critical support services, until the transition is completed. Certain suppliers may determine to stop manufacturing and supplying end-of-life parts, products and equipment, or may stop providing related services, prior to completion of our transition. In the event that we are unable to obtain sufficient inventory from existing suppliers we would be required to engage new suppliers who have access to the intellectual property required to manufacture and support components that meet our specifications, and we may be unable to contract with such suppliers on commercially reasonable terms, or at all. We have implemented policies and procedures intended to ensure that we timely anticipate technology and product transitions and have access to sufficient inventory and services, but if such policies prove ineffective and we are unable to continue to engage suppliers with the capabilities or capacities required by our business to effect a transition, or if such suppliers fail to deliver quality products, parts, equipment and services in sufficient quantities or on a timely basis consistent with our schedule, our business, financial condition and results of operations may be materially adversely affected. In addition, following our retirement of end-of-life technologies and products, we may find that we have either obsolete or excess inventory on hand and might have to write off unusable inventory, which could have a material adverse effect on our results of operations.

We rely heavily on communications, information systems (both internal and provided by third parties), and the internet to conduct our business. Our brand, reputation and ability to attract, retain and serve our customers depend upon the reliable performance of our ground network and in-flight systems. We have experienced interruptions in these systems in the past, and we may in the future experience service interruptions, service delays or technology or systems failures, which may be due to factors beyond our control. If we experience frequent system or network failures, our reputation, brand and customer retention could be harmed, and such failures could be material breaches of our customer contracts resulting in termination rights, penalties or claims for damages. Our operations and services depend upon the extent to which our and our suppliers' equipment is protected against damage or interruption from fire, floods, earthquakes, tornadoes, power loss, solar flares, communication failures, break-ins, acts of war or terrorism and similar events. We and our vendors, like other commercial entities, have been, and will likely continue to be, subject to a variety of forms of cyberattacks with the objective of gaining unauthorized access to our systems and data or disrupting our operations. These include, but are not limited to, cyberattacks, phishing attacks, account takeover attempts, the introduction of computer viruses or malicious code (commonly referred to as "malware"), ransomware or other extortion tactics, denial of service attacks, credential stuffing, and other computer-related penetrations. To date, none of these cyberattacks has, individually or in the aggregate, resulted in a security incident with a material effect on our operations or our financial condition, results of operations, liquidity, or cash flows. However, these cyberattacks could have a material impact in the future. Hardware, software or applications developed by us or received from third parties may contain exploitable vulnerabilities, bugs, or defects in design, maintenance or manufacture or other issues that could compromise information and cybersecurity. The risk of cyberattacks has also increased and will continue to increase in connection with Russia's invasion of Ukraine. In light of the Ukraine war and other geopolitical events and dynamics, including ongoing tensions with North Korea, Iran and other states, state-sponsored parties or their supporters may launch retaliatory cyberattacks, and may attempt to cause supply chain disruptions, or carry out other geopolitically motivated retaliatory actions that may adversely disrupt or degrade our operations and may result in data compromise. These security attacks can originate from a wide variety of sources/malicious actors, including, but not limited to, persons who constitute an insider threat, who are involved with organized crime, or who may be linked to terrorist organizations or hostile foreign governments. Those same parties may also attempt to fraudulently induce employees, customers, or other users of our systems to disclose sensitive information in order to gain access to our data or that of our customers or clients through social engineering, phishing, mobile phone malware, and other methods. There is no assurance that administrative, physical, and technical controls and other preventive actions taken to reduce the risk of cyberattacks and protect our information technology will prevent physical and electronic break-ins, cyberattacks or other security breaches to such computer systems. In some cases, such physical and electronic break-ins, cyberattacks or other security breaches may not be immediately detected. If we or our vendors fail to prevent, detect, address and mitigate such incidents, this may impede or interrupt our business operations and could adversely affect our business, financial condition and results of operations. A disaster such as a natural catastrophe, epidemic, pandemic, industrial accident, blackout, ransomware, computer virus, or other type of malware, terrorist attack, cyberattack or war, unanticipated problems with our or our vendors' disaster recovery systems (and the disaster recovery systems of such vendors' suppliers, vendors or subcontractors), could cause our computer systems to be inaccessible to our employees, distributors, vendors or customers or destroy valuable data. In addition, in the event that a significant number of our or our vendors' managers were unavailable following a disaster, our ability to effectively conduct business could be severely compromised. These interruptions also may interfere with our suppliers' ability to provide goods and services and our employees' ability to perform their job responsibilities. In addition, our flexible, hybrid work model, which allows our employees the option to work fully remote, could increase our operational risk, including, but not limited to, cybersecurity risks, and could impair our ability to manage our business. Unanticipated problems with, or failures of, our disaster recovery systems and business continuity plans could have a material impact on our ability to conduct business and on our results of operations and financial condition. The failure of our disaster recovery systems and business continuity plans could adversely impact our profitability and our business. Regulators' or others' scrutiny of cybersecurity, including new laws or regulations, could increase our compliance costs and operational burdens, especially as regulatory and legislative focus on cybersecurity matters intensifies. Regulators, customers, or others may act against us for any cybersecurity failures. Our continuous technological evaluations and enhancements, including changes designed to update our protective measures, may increase our risk of a breach or gap in our security. We may incur higher costs to comply with laws related to, or regulators' scrutiny of, our use, collection, management, or transfer of data and other privacy practices. There can be no assurance that our continuous evaluation and enhancement of our cybersecurity and information security systems will be effective in preventing or limiting the impact of future cyberattacks.