Summary

  • Nominet announced a commercial cybersecurity division on 5 December 2018, acquired the US company CyGlass in February 2020 for $6m (£4.9m), opened a sale process in October 2021 and approved a closure in April 2022.
  • Its own accounts state the CyGlass episode cost £18m, and the assets went to a buyout by former CyGlass employees for notional proceeds of $1.
  • Named officers and dated signatures appear at every stage. No reviewed document shows the board resolution or the member vote that would have authorised either direction.

A national registry has one job that nobody can substitute: keeping a country's domain names resolving. Nominet also decided, for a while, to sell enterprise cybersecurity. The interesting part is not that the venture failed. Plenty fail. The interesting part is how completely the company documented the failure and how thinly it documented the permission.

The launch and the people who signed for it

On 5 December 2018 Nominet announced the launch of Nominet Cyber Security, a division built to support international expansion with product development, sales, research and industry advisers. The principal commercial product was the NTX platform, aimed at enterprise and public-sector clients in the United Kingdom, EMEA and the United States. The announcement named Russell Haworth as chief executive and Simon McCalla as chief technology officer, and quoted both (Nominet, 5 December 2018).

This was not a skunkworks. The following year's annual report records a larger cyber team, a February 2019 launch in the United States with a Washington office, and the formation of a Cyber Advisory Panel to advise on cyber services and go-to-market strategy. The chief executive's statement in that report describes the company as developing and promoting a growing cyber business, and the same document identifies Haworth as chief executive and Mark Wood as chair (Annual Report 2019).

One small date deserves its own line. The 2019 report was authorised on 18 June 2019, and the production footer on the same document reads 25 June 2019. Both dates are displayed, a week apart, and neither cancels the other.

The acquisition and the price

On 20 February 2020 Nominet announced it had acquired US-based CyGlass, calling it a company first and describing CyGlass's Network Defence as a Service offering. Haworth, again as chief executive, said CyGlass complemented the company's cyber portfolio. The release also named Ed Jackowiak as CyGlass managing director and Eleanor Bradley as Nominet's managing director of Registry Solutions (Nominet, 20 February 2020).

That announcement states no consideration, no closing mechanics and no transaction-completion date. The number arrives in the accounts instead. The Annual Report and Financial Statements 2021 states that Nominet acquired the start-up business of CyGlass in February 2020 for $6m (£4.9m) (Annual Report 2021).

By July 2020 the framing had hardened into strategy. The 2020 report records the company's first acquisitions — CyGlass and the assets of UK-based XQ Cyber — as adding capabilities to a cyber portfolio aimed at enterprise markets and government customers. Its chair statement described Nominet as emerging as a global cybersecurity player and accelerating change through those first acquisitions. Mark Wood signed that report on behalf of the Board on 22 July 2020 (Annual Report 2020).

So the record at this point is unusually complete on people. A chief executive announces the division and the acquisition. A chair signs the accounts that celebrate it. What the same record does not contain is the resolution that approved the purchase.

The reversal and the sale process

The 2021 report says CyGlass developed its SaaS solution, won new customers and expanded its channel network, and remained loss-making and investment-dependent. It also says the Board had started a process to sell CyGlass as part of a reform agenda, identifies Robert Binns as a non-executive director and acting chair in the relevant statement, and carries Andrew Green CBE's signature dated 14 October 2021 (Annual Report 2021).

On 7 October 2021 the company had already published the political version. The Board, as reported, had decided to move away from the strategy of building a portfolio of complementary cyber businesses, had started a process to sell CyGlass, and had retained and committed to the Protective DNS business. The same statement identifies Andy Green as Nominet's new chair (Nominet, 7 October 2021).

The week between those two documents produces one discrepancy worth naming rather than smoothing. The web statement calls the new chair Andy Green. The accounts signed seven days later call him Andrew Green CBE. The reviewed record does not say whether that is a formal name variation or a drafting difference, so neither reading is asserted here.

Read the scope of that October announcement carefully. It announces a sale process for CyGlass. It expressly retains Protective DNS. This is not an exit from cybersecurity. It is an exit from one acquisition, announced by the chair who had just arrived and did not buy it.

Closure and the one-dollar transfer

In a Board Report dated 31 May 2022, the company records that the Board met on 26 April 2022 to consider CyGlass disposal options, that the original intention had been a sale and the business had not been sold by the end of the financial year, and that the Board decided continued funding was not in Nominet's best interests. A process to close the business began. The same report records Paul Fletcher reporting as chief executive, Ben Hill presenting finance information and Ashley La Bolle's declaration of interest, and says the company's focus had returned to core registry operations, protecting government services and public benefit (Board Report, 31 May 2022).

The 2022 accounts put arithmetic on it. The formal closure process began on 13 June 2022, the assets were acquired shortly after by a group of CyGlass employees for a nominal fee, and the overall cost of CyGlass was reported at £18m. The chair's statement says Nominet had exited the CyGlass business. Andrew Green CBE signed on 26 August 2022, and Paul Fletcher signed the chief executive statement (Annual Report 2022).

The following year's report adds the reason and the ending. The Board agreed to exit after the autumn 2021 strategic review and actively pursued a sale; the closure decision was taken in April 2022 after there was no prospect of a sale and the business had a significant burn rate; CyGlass was dissolved in March 2023; and the total cost shared with members was £18m (Annual Report 2023).

The most precise version appears in the FY24 accounts. CyGlass entered an Assignment for Benefit of Creditors process on 13 June 2022. On 24 June 2022 an assignee accepted a management buyout proposal from former CyGlass employees, and the assets and business transferred to that team for notional proceeds of $1 (FY24 Annual Report).

Two dates here are reported as the documents display them. The 2023 report's subsidiary note puts the transfer of business and assets at 13 June 2022. The FY24 report assigns 13 June to the assignment process and 24 June to the acceptance of the buyout. They are eleven days apart and both are printed.

And the venture did not end cybersecurity at Nominet. The retained business kept reporting: £12.7m of Cyber-business revenue with the CyGlass deficit reduced by £1.8m in 2022, £12.6m of Cyber revenue in FY23, then £15.267m of Cyber Business revenue against a £0.754m loss in FY24 (Annual Report 2022, Annual Report 2023, FY24 Annual Report).

What the record authorises, and what it does not

Nominet publishes more about this episode than most registry diversifications ever do. A named chief executive for the launch and the acquisition. A named chair signing the accounts that banked the strategy. A named acting chair at the turn. A named incoming chair announcing the reversal. A named chief executive reporting the closure. Named finance and board attendees. Four annual reports, a member newsletter and two news pages, each carrying a date.

The evidentiary form matters. Every source behind this account is a provider-reported excerpt and summary of a first-party Nominet document, not a verbatim transcript, and not a native file read. That limits quotation, not the fact of publication.

What is missing is narrower and more consequential. No reviewed document reproduces a board resolution, a minute or a signing instrument for the entry. None does so for the disposal. No reviewed document records a member vote or ballot authorising either. And none of the reviewed documents states that no such vote took place — the absence is in the record reviewed, not proven in the world.

That asymmetry is the finding. A company limited by guarantee, owned by its members and entrusted with a country-code registry, can convert its balance sheet into a commercial venture, absorb £18m of cost, and leave the assets with the people who ran them for a dollar, while disclosing every consequence in signed accounts and disclosing the authorisation nowhere. The bill came signed. The decision came without its instrument.

Nominet UK is tracked in the BTW directory at entity:nominet-uk-gb.