What Nominet must learn from the CyGlass debacle

In 2020, Nominet spent £4.9 million of its members’ money buying cybersecurity company CyGlass as part of a new acquisition strategy led by then CEO Russell Haworth.

Former Nominet CEO Russell Haworth

Nominet set up a new headquarters in the US in Silicon Valley and built up a reserve of £110 million with the idea of starting a global cyber security business.

When Haworth and his two senior executives closed the deal, CyGlass – which is based on the other side of the country in Boston – had assets of just £154,000 with debts more than double at £328,000.

Despite the hefty price tag, Nominet celebrated the deal by paying out bonuses: £258,000 to CyGlass and £535,000 to its own executives.

CyGlass’ revenue for the first year was £26,000; a tenth of the size of the bonuses it had just received. The simple truth was that no one wanted the company’s services. Nominet, a non-profit organisation with no experience of the US market, no grounding in cybersecurity outside the DNS, no American staff, and no history of venture capitalism had picked a dud.

Nevertheless, Nominet continued to plough millions of pounds into the business, funded out of the .uk registry, and continued to insist the business was a good bet. When Haworth was eventually forced to resign, and Nominet’s chair was sacked, a decision was made to sell CyGlass. No one wanted it. Last month, Nominet sold it back to its management team for £1.

Opacity

Nominet is a member organisation, which means it is supposed to be accountable to its members. Haworth’s plan to spend £4.9 million on Nominet’s first acquisition of CyGlass caused an argument within the Board. At least one member was vigorously opposed to the purchase. The resulting minutes, which combined two different Board meetings in September and November and didn’t include Board Committee meetings, made no mention of the argument however. Nor did they mention the purchase, the amount paid, or even CyGlass.

This was the sum total of the information provided to members:

Cyber Solutions – the Board conducted a review of the three-year strategy presented by the executive.

M&A Committee – the Committee discussed the progress the Executive have made towards its strategic mergers and acquisition objectives

The first that members heard about the purchase was in a press release. And then the next month, the sum total of the information they received from their organisation about the purchase of CyGlass and Nominet’s new global cyber security acquisition strategy, was the following:

CyGlass – Ed Jackowiak, MD CyGlass, reported to the Board on the progress achieved since the acquisition in February of the US-based cyber security company.

It would be many months until members were informed that nearly £5 million of their money had been wasted.

Things can only get better?

When Nominet announced its new chair, a year ago last month, Andy Green promised a new era in which the organisation would “engage sufficiently with members about the scope and direction of the company.” He promised to be more transparent and keep members informed about what Nominet was doing in their name.

When it comes to CyGlass and Nominet’s multi-million-pound misstep, however, little has changed.

In its 2021 accounts, in which new chair Green promised Nominet was “committed to a more open and collaborative relationship with members”, the details provided around CyGlass were troubling.

We don’t know if the millions invested in CyGlass helped it break its £26,000 revenue record in its second year because Nominet didn’t disclose details. It did however include confident predictions (see pages 67 and 68) for CyGlass’ future revenue, which it reports were going to go up 345.4 per cent in 2022, before dropping down to 1.9 per cent in 2029. Here is a graph of those figures to aid understanding.

There was also this explanatory text for the CyGlass acquisition and how Nominet was handling its financial impact:

Impairment testing of goodwill
For the purpose of annual impairment testing, goodwill is allocated to the cash-generating unit (CGU) expected to benefit from the business combination in which the goodwill arose. Goodwill has been allocated in full to the CyGlass CGU.

Basis for calculation of recoverable amount
The Group has prepared, and formally approved, an eight-year plan for the CyGlass CGU. The detailed plan makes estimates for revenue and gross profit expectations. The recoverable amount of the CyGlass CGU was determined as £5,165k based on these value-in-use calculations and an impairment charge of £418k has been recognised as a result.

This is, to put it bluntly, financial gibberish.

It is purposefully nonsensical, voodoo economics. And it should never have been allowed into a formal report. The fact that Nominet went to the trouble to create a made-up eight-year projected future revenue percentage growth table based on nothing should, in and of itself, be a cause for alarm.

Nominet was also unwilling to accept or admit the obvious – that it had made a significant mistake in purchasing CyGlass, that the organisation had failed to do sufficient due diligence or market research before committing funds, there were insufficient financial safeguards in place, and Nominet had no business acting like a Silicon Valley VC when it has no experience funding and supporting a start-up.

Rather than admit to these faults and be honest with itself and its members, however, the written explanation for the CyGlass debacle is as deceptive as the financial one, implying (without evidence) that CyGlass was on the cusp of success:

As an early stage business, CyGlass required significant investment to support future growth… As well as slower than anticipated growth, unfavourable market sentiment around technology investments was a contributing factor…

[CyGlass] has won a number of new customers and expanded its channel distribution network. However, with the Covid environment, the growth in revenue during FY21 has been slower than targeted… Subsequent to the year end, the CyGlass business is starting to show promising signs of revenue growth. However, as the Chair has outlined in his statement, we intend to sell CyGlass as part of Nominet’s reform agenda.


Why does this matter and what should happen now?

Those who don’t learn from their mistakes are doomed to repeat them.

While the organisation has admitted that it lost roughly £18m buying and supporting CyGlass, there’s been very little effort to dig into why Nominet made such a terrible investment, why it continued to invest many millions more, why the organisation wasn’t honest with its members, and what systems are in place to prevent something similar from happening again.

Even Simon Blackler, who successfully forced Nominet to confront its failures through the Public Benefit campaign and now sits on the Board has made it plain that he does not intend to look deeper into the problem.

While I agree with Simon that an official inquiry is not the answer, I don’t agree that it should be swept under the carpet. It is worth considering what Nominet should have done last month when it finally announced the end of its connection with CyGlass, why it didn’t, and what that means about where the organisation is, and needs to go, in its reform efforts.

Here’s what should have happened:

  • Nominet should have acknowledged that CyGlass was a flawed acquisition and should not have occurred
  • It should have planned ahead and used the sale to announce a new Nominet acquisition policy that clarifies its position over commercial ventures
  • It should have published the minutes of previous Board discussions that have previously been withheld under “commercial confidentiality” reasons to demonstrate that Nominet is acting professionally and conscientiously on its members’ behalf
  • It should have assured members that there are additional financial controls in place that will prevent the payout of large sums and bonuses connected to an acquisition
  • It should have provided some form of “lessons learnt” document and considered apologising to rebuild trust with members on this critical issue

The fact that Nominet failed to do any of these is a worrying sign that the organisation is still not able to admit to its mistakes or properly address its own internal flaws.

Here is what needs to happen going forward if Nominet is to properly reform itself and so avoid sleepwalking into another fierce internal conflict in a few years’ time:

  • Take and provide comprehensive Board minutes that indicate the degree of thought and consideration that go into making decisions
  • Publish minutes of Board Committee meetings, not just Board meetings
  • Publish staff reports, redacted for commercial sensitivities where necessary, to demonstrate transparency and accountability
  • Overhaul communications, consider how members will receive news and prepare honest answers to obvious questions in advance
  • Hold member-engagement sessions around events such as this rather than generic Zoom meetings at short notice
  • Be prepared to admit fault and to ask for forgiveness

CyGlass was a costly failure for Nominet; it could also be a valuable lesson.