Lumen Technologies (LUMN) Risk Factors

The technology and communications industry has been and continues to be impacted by significant technological changes, which are enabling an increasing variety of companies to compete with us. Many of these technological changes are (i) displacing or reducing demand for certain of our services, (ii) enabling the development of competitive products or services, (iii) enabling customers to reduce or bypass use of our networks or (iv) reducing our profit margins. For example, as service providers continue to invest in 5G and low earth orbit satellite networks and services, their services could reduce demand for our network services. Increasingly, customers are demanding more technologically advanced products that suit their evolving needs, including traditional and generative AI services. As we note below, several of our competitors have dedicated substantially more resources to their development. If we fail to develop competitive AI services, our business and financial performance could be adversely impacted. To remain competitive, we will need to accurately predict and respond to changes in technology, to continue developing products and services attractive to our customers, to timely provision our products and services, to maintain and expand our network to enable it to support customer demands for greater transmission capacity and speeds, and to discontinue outdated products and services on a cost-effective basis. Our ability to do so could be restricted by various factors, including limitations of our existing network, technology, capital or personnel. If we fail at that, we could lose customers or fail to attract new ones.

Our vulnerability to cyber-attacks is heightened by several features of our operations, including (i) our material reliance on our owned and leased networks to conduct our operations, (ii) our transmission of large amounts of data over our systems and (iii) our processing and storage of sensitive customer data. As further described in Item 1C of this annual report, cyber-attacks on our systems may stem from a variety of sources and take many forms. Cyber-attacks can put at risk personally identifiable customer data or protected health information, thereby implicating stringent domestic and foreign data protection laws. These threats may also arise from failure or intrusions of systems owned, operated or controlled by other unaffiliated operators, upon whom we are materially reliant to operate our business. Various other factors could intensify these risks, including, (i) our maintenance of information in digital form stored on servers connected to the Internet, (ii) our use of open and software-defined networks, (iii) the challenges of operating and maintaining our complex multi-continent network composed of legacy and acquired properties, which is more difficult to safeguard than newer fully-integrated networks, (iv) growth in the size and sophistication of our customers and their service requirements, (v) increased use of our network due to greater demand for data services, (vi) our increased incidence of employees working from remote locations and (vii) the increased difficulty of defending against attacks that use AI-generated social engineering, increasingly malicious code and increasingly sophisticated phishing techniques. As a critical infrastructure service provider, we and our customers are constant targets of cyber-attacks. The number of these attacks against us increased in 2023. Despite our efforts to prevent these events, some of these attacks have resulted in security incidents. On March 27, 2023, we filed with the U.S. Securities and Exchange Commission a Current Report on Form 8-K announcing two cybersecurity incidents, including one that involved a sophisticated threat actor that had accessed our internal information technology systems. Since filing that report, we have taken the measures described therein to assess, contain and remediate both incidents, including working with outside forensic firms. Based on information known to us at this time, we continue to believe that these incidents have neither had nor are likely to have a material adverse impact on our ability to serve our customers or our business, operations or financial results. We believe the importance of our network to global internet data flows will continue to make it a target to a wide range of threat actors, including nation state actors and other advanced persistent threat actors. Moreover, the risk of incidents is likely to continue to increase due to several factors, including (i) the increasing sophistication of cyber-attacks, (ii) the wider accessibility of cyber-attack tools and (iii) growing threats from Chinese, Russian and other state actors due to heightened geopolitical tensions. It should also be noted that defenses against cyber-attacks currently available to us and others are unlikely to prevent intrusions by a highly-determined, highly-sophisticated threat actor. Consequently, you should assume that we will continue to experience cyber incidents in the future. Thus far, none of our past security incidents have had a material adverse effect on us, and we continue to take steps designed to limit our cyber risks. Nonetheless, we cannot assure you that future cyber incidents or events will not ultimately have a material adverse impact on our ability to serve our customers or our business, operations or financial results. Although we maintain insurance coverage that may, subject to policy terms and conditions (including self-insured deductibles, coverage restrictions and monetary coverage caps), cover certain aspects of our cyber risks, such insurance coverage may be unavailable or insufficient to cover our losses. Cyber-attacks could (i) disrupt the proper functioning of our networks and systems, which could in turn disrupt the operations of our customers, (ii) result in the destruction, loss, theft, misappropriation or release of proprietary, confidential, sensitive, classified or otherwise valuable information of ours, our employees, our customers or our customers' end users, (iii) require us to notify customers, regulatory agencies or the public of data incidents, (iv) damage our reputation or result in a loss of business, (v) require us to provide credits for future service to our customers or to offer expensive incentives to retain customers, (vi) subject us to claims by our customers or regulators for damages, fines, penalties, license or permit revocations or other remedies, (vii) result in the loss of industry certifications or (viii) require significant management attention or financial resources to remedy the resulting damages or to change our systems. Any or all of the foregoing developments could have a material adverse impact on us.

Our international operations are subject to U.S. and non-U.S. laws and regulations regarding operations in international jurisdictions in which we provide services, either directly or indirectly through our contractual arrangements with other carriers. These numerous and sometimes conflicting laws and regulations include anti-corruption laws, anti-competition laws, trade restrictions, economic sanctions, tax laws, immigration laws, environmental laws, privacy laws and accounting requirements. Many of these laws are complex and change frequently. There is a risk that these laws or regulations may materially restrict our ability to deliver services in various international jurisdictions or expose us to the risk of fines, penalties or license revocations if we are determined to have violated applicable laws or regulations. Additionally, these laws or regulations may potentially impact our customers and result in foregone business or penalties to us if we fail to comply with any applicable sanctions or restrictions on our activities. Many non-U.S. laws and regulations relating to communications services are more restrictive than U.S. laws and regulations. We are subject to the GDPR of the European Union and the United Kingdom, as well as various other laws governing privacy rights, data protection and cybersecurity laws in other regions. These laws and regulations continue to proliferate and evolve, are becoming more complex and increasingly conflict among the various countries in which we operate, which has resulted in greater compliance risk and cost for us. Moreover, many countries are still in the early stages of providing for and adapting to a liberalized telecommunications market, which could make it more difficult for us to obtain licenses and conduct our operations. In addition to these international regulatory risks, some of the other risks inherent in conducting business internationally include: economic, social and political instability, with the attendant risks of terrorism, kidnapping, extortion, civic unrest, potential seizure or nationalization of assets; currency and exchange controls, repatriation restrictions and fluctuations in currency exchange rates, problems collecting accounts receivable; the difficulty or inability in certain jurisdictions to enforce contract or intellectual property rights; reliance on certain third parties with whom we lack extensive experience; supply chain challenges; and challenges in securing and maintaining the necessary physical and telecommunications infrastructure. Our operations and financial results could be impacted by changes in multilateral conventions, treaties, tariffs or other arrangements between or among sovereign nations, including most recently Brexit.

A substantial number of our domestic facilities are located in coastal states, which subjects them to the risks associated with severe tropical storms, hurricanes and tornadoes, and many other of our facilities are subject to the risk of earthquakes, floods, fires, tornadoes or other similar casualty events. From time to time these events (including Hurricane Ian in 2022 in Florida) have disrupted our operations, and similar future events could cause substantial damages, including downed transmission lines, flooded facilities, power outages, fuel shortages, network delays or failures, damaged or destroyed property and equipment, and work interruptions. Due to substantial deductibles, coverage limits and exclusions, and limited availability, we have typically recovered only a portion of our losses through insurance. Our system redundancy and other measures we take to protect our infrastructure and operations from the impacts of such events may be ineffective or inadequate to sustain our operations following such events. Any of these occurrences could result in lost revenues from business interruption, damage to our reputation and reduced profits. Climate change may increase the frequency or severity of natural disasters and other extreme weather events in the future, which would increase our exposure to the above-cited risks and could disrupt our supply chain from our key suppliers and vendors.

Our ability to conduct our operations could have a material adverse impact on us if certain of our arrangements with third parties were terminated, including those further described below. Reliance on other communications providers. To offer certain services in certain of our markets, we must either purchase services or lease network capacity from, or interconnect our network with, the infrastructure of other communications carriers or cloud companies who typically compete against us in those markets. Our reliance on these supply or interconnection arrangements limits our control over the delivery and quality of our services. In addition, we are exposed to the risk that other companies may be unwilling or unable to continue or renew these arrangements in the future. Those risks are heightened when the other company is a competitor who may benefit from terminating the agreement or imposing price increases. Additionally, several companies rely on our network to transmit their data or voice traffic. Their reliance on our network exposes us to the risk that they may transfer all or a portion of this traffic from our network to alternative networks owned, constructed or leased by them, thereby reducing our revenue. Certain of our hyperscaler customers have built infrastructure that has reduced their reliance on us. Reliance on key suppliers and vendors. We depend on a limited number of suppliers and vendors to provide us, directly or through other suppliers, with equipment and services relating to our network infrastructure, including fiber optic cable, software, optronics, transmission electronics, digital switches, routing equipment, customer premise equipment, and related components. We also rely on software and service vendors or other parties to assist us with operating, maintaining and administering our business, including billing, security, provisioning and general operations. Our operations could be adversely affected if any of these vendors experience business interruptions, security incidents, litigation or other issues that interfere with their ability to deliver their products or services on a timely basis. Reliance on key licensors. We rely on key technologies licensed from third parties to deliver certain of our products and services. Our agreements with these licensors may expire or be terminated, and some of the licenses may not be available to us in the future on terms acceptable to us or at all. Moreover, if we incorporate licensed technology into our network, we may have limited flexibility to deploy different technologies from alternative licensors. Reliance on key customer contracts. We have several complex high-value national and global customer contracts. These contracts are frequently impacted by a variety of factors that could reduce or eliminate the profitability of these contracts. Moreover, we would be adversely impacted if we fail to renew major contracts upon their expiration. Reliance on landowners. We rely on rights-of-way, colocation agreements, franchises and other authorizations granted by governmental bodies, railway companies, utilities, carriers and other third parties to locate a portion of our network equipment over, on or under their respective properties. A significant number of these authorizations are scheduled to lapse over the next five to ten years, unless we are able to extend or renew them. Further, some of our operations are subject to licensing and franchising requirements imposed by municipalities or other governmental authorities. Our operations could be adversely affected if any of these authorizations are cancelled, or otherwise terminate or lapse, or if the landowner requests price increases. Similarly, our buildout plans can be delayed if we cannot receive necessary landowner authorizations or governmental permits. We cannot assure you we will be able to successfully extend these arrangements when their terms expire, or to enter into new arrangements that may be necessary to implement our network expansion opportunities.

As explained in greater detail elsewhere in this annual report, (i) our domestic operations are regulated by the FCC and other federal, state and local agencies and (ii) our international operations are regulated by a wide range of various foreign and international bodies. We cannot assure you we will be successful in obtaining or retaining all regulatory licenses necessary to carry out our business in our various markets. Even if we are, the prescribed service standards and conditions imposed on us under these licenses and related laws may increase our costs, limit our operational flexibility or result in third-party claims. We are subject to numerous requirements and interpretations under various international, federal, state and local laws, rules and regulations, which are often quite detailed and occasionally in conflict with each other. Accordingly, we cannot ensure we will always be considered to be in compliance with all these requirements at any single point in time. Various governmental agencies, including state attorneys general with jurisdiction over our operations, have routinely in the past investigated our business practices either in response to customer complaints or on their own initiative, and are expected to continue to do the same in the future. Certain of these investigations have resulted in substantial fines in the past. On occasion, we have resolved such matters by entering into consent decrees, which are court orders that frequently restrict our future conduct. If breached by us, these consent decrees expose us not only to contractual remedies, but also to judicial enforcement via contempt of court proceedings, any of which could have material adverse consequences. Additionally, future investigations can potentially result in enforcement actions, litigation, fines, settlements or reputational harm, or could cause us to change our sales practices or operations. Our prior participation in the FCC's CAF II program and current participation in the FCC's RDOF program subjects us to certain financial risks. If we are not in compliance with FCC measures by the end of the CAF II and RDOF programs, we could incur substantial penalties or forfeitures, including but not limited to being suspended or disbarred from future governmental programs or contracts for a significant period of time, which could have a material adverse impact on our financial condition. We provide products or services to various federal, state and local agencies. Our failure to comply with complex governmental regulations and laws applicable to these programs, or the terms of our governmental contracts, could result in us suffering substantial negative publicity or penalties, being suspended or debarred from future governmental programs or contracts for a significant period of time and in certain instances could lead to the revocation of our FCC licenses. Moreover, certain governmental agencies frequently reserve the right to terminate their contracts for convenience or if funding is unavailable. If our governmental contracts are terminated for any reason, or if we are suspended or debarred from governmental programs or contracts, it could have a material adverse impact on our results of operations and financial condition. A variety of state, national, foreign and international laws and regulations apply to the collection, use, retention, protection, security, disclosure, transfer and other processing of personal and other data. The European Union and other international regulators, as well as some state governments, have recently enacted or enhanced data privacy legal requirements, and other governments are considering establishing similar or stronger protections. Many of these laws are complex and change frequently and often conflict with the laws in other jurisdictions. Some of our customers impose similar requirements on us that are equally or more demanding. If we fail to comply with any of these governmental or contractual requirements, we could incur potential substantial penalties and reputational damage. Adapting and responding to changing regulatory requirements has historically materially impacted our operations. We believe evolving regulatory developments and regulatory uncertainty could continue to have a material impact on our business. In particular, our business could be materially impacted if the U.S. Congress amends or eliminates current federal law limitations on the liability of private network providers, such as us, against claims related to third party content stored or transmitted on private networks, as currently proposed by certain governmental officials, legislative leaders and consumer interest groups. We could also be materially affected if currently pending proposals to increase the regulation of internet service providers or to further strengthen data privacy laws are implemented. In addition, federal and state agencies that regulate the support program payments we receive or the fees that we charge for certain of our regulated services can, and from time to time do, reduce the amounts we receive or can charge. The variability of these laws could also hamper the ability of us and our customers to plan for the future or establish long-term strategies.

There are several potentially material proceedings pending against us. Results of these legal proceedings cannot be predicted with certainty. As of any given date we could have exposure to losses under proceedings in excess of our accrued liability. For each of these reasons, any of the proceedings described in Note 18-Commitments, Contingencies and Other Items, as well as current litigation not described therein or future litigation, could have a material adverse effect on our business, reputation, financial position, operating results, the trading price of our securities and our ability to access the capital markets. We can give you no assurances as to the ultimate impact of these matters on us.

Our reputation and brands could be impacted by our public commitments to various corporate environmental, social and governance (ESG) initiatives, including our political contributions, our advocacy positions, and our goals for sustainability, inclusion and diversity. These initiatives, goals, or commitments could be difficult to achieve and costly to implement. To the extent that our required and voluntary disclosures about ESG matters increase, we could be criticized for their accuracy, adequacy, or completeness. We could fail to achieve, or be perceived to fail to achieve, our ESG-related initiatives, goals, or commitments. In addition, we could be criticized for the timing, scope or nature of these initiatives, goals, commitments, or for any revisions to them. Our actual or perceived failure to achieve our ESG-related initiatives, goals, commitments, or to meet evolving stakeholder expectations or standards could adversely impact us by resulting in legal or regulatory proceedings against us, customer or employee attrition, reputational damage, or other negative impacts on our business.

Each of our business and mass market offerings faces increasingly intense competition, with increased pressure to timely offer digitally integrated services, from a wide range of sources under evolving market conditions that have increased the number and variety of companies that compete with us. Some of our current and potential competitors: (i) offer products or services that are substitutes for our traditional wireline services, including wireless broadband, wireless voice and non-voice communication services, (ii) offer a more comprehensive range of communications products and services, (iii) operate systems that enable them to provision services easier and faster, (iv) have greater financial, provisioning, technical, engineering, research, development, marketing, customer relations or other resources, (v) conduct operations or raise capital at a lower cost, (vi) are subject to less regulation, (vii) have stronger brand names, (viii) have deeper or more long-standing relationships with key customers, or (ix) have larger operations than ours, any of which may enable them to compete more successfully for customers, strategic partners and acquisitions. In recent years, competitive pressures have commoditized pricing for some of our products and services and lowered market prices for many of our other products and services. Continued competitive pressures will likely place further downward pressure on market pricing.