Back to GetFilings.com

Table of Contents

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-Q

QUARTERLY REPORT PURSUANT TO SECTION 13 OR 15(d)

OF THE SECURITIES EXCHANGE ACT OF 1934

For the quarterly period ended March 31, 2003

Commission File Number: 000-26223

TUMBLEWEED COMMUNICATIONS CORP.

(Exact name of registrant as specified in its charter)

700 SAGINAW DRIVE

REDWOOD CITY, CA 94063

(Address of principal executive offices, including zip code)

(650) 216-2000

(Registrant’s telephone number, including area code)

Indicate by check mark whether the registrant (1) has filed all reports required by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days.    Yes  x    No  ¨

Indicate by check mark whether the registrant is an accelerated filer (as defined in Rule 12b-2 of the Act).    Yes  ¨    No  x

The number of shares of common stock outstanding as of April 30, 2003 was 30,508,926.

Table of Contents

SPECIAL NOTE ON FORWARD-LOOKING STATEMENTS

This Quarterly Report on Form 10-Q contains forward-looking statements within the meaning of Section 27A of the Securities Act of 1933 and Section 21E of the Securities Exchange Act of 1934, which are subject to the “safe harbor” created by those sections. The forward-looking statements are based on our current expectations and projections about future events, including, but not limited to, implementing our business strategy; attracting and retaining customers; obtaining and expanding market acceptance of the products and services we offer; forecasts of Internet usage and the size and growth of relevant markets; rapid technological changes in our industry and relevant markets; our stock repurchase program; consummation of the pending merger with Valicert; benefits of the pending merger with Valicert; the future business, financial condition and results of operations of the combined company and competition in our market. Discussions containing such forward-looking statements may be found in “Management’s Discussion and Analysis of Financial Condition and Results of Operations.” In some cases, you can identify forward-looking statements by terminology such as “may,” “will,” “should,” “could,” “predicts,” “projects,” “potential,” “continue,” “expects,” “anticipates,” “future,” “intends,” “plans,” “believes,” “estimates,” or the negative of these terms and other comparable terminology; including, but not limited to, the following:

These forward-looking statements are only predictions, not historical facts. These forward-looking statements involve certain risks and uncertainties, as well as assumptions, that could cause actual results, levels of activity, performance, achievements and events to differ materially from those stated, anticipated or implied by such forward-looking statements. The factors that could contribute to such differences include those discussed under the caption “Risks And Uncertainties That You Should Consider Before Investing In Tumbleweed” in section entitled “Management’s Discussion and Analysis of Financial Condition and Results of Operations” contained herein, as well as those discussed in our Form 10-K and other filings with the Securities and Exchange Commission. You should consider the risks factors and uncertainties under the caption “Risks and Uncertainties That You Should Consider Before Investing in Tumbleweed,” among other things, in evaluating Tumbleweed’s prospects and future financial performance. Before making a decision to invest in Tumbleweed, you should be aware that the occurrence of the events described in the risk factors could harm the business, results of operations and financial condition of Tumbleweed. These forward-looking statements are made as of the date of this Quarterly Report on Form 10-Q. Tumbleweed disclaims any obligation to update or alter these forward-looking statements, whether as a result of new information, future events or otherwise, or any obligation to explain the reasons why actual results may differ.

Table of Contents

TUMBLEWEED COMMUNICATIONS CORP.

INDEX

TRADEMARKS

Our registered trademarks include Tumbleweed^®, Tumbleweed Communications^®, Secure Envelope^®, Secure Inbox^®, Tumbleweed IME Integrated Messaging Exchange^®, WorldSecure^® and Worldtalk^®. Additional trademarks belonging to us include Tumbleweed Secure Guardian^™, Tumbleweed Secure Policy Gateway^™, Tumbleweed Secure Staging Server^™, Tumbleweed Staging Server^™, Tumbleweed Secure Mail^™, Tumbleweed Secure Redirect^™, Tumbleweed Secure Public Network^™, Tumbleweed SPN^™, Tumbleweed Secure Archive^™, Tumbleweed Secure Web^™, Tumbleweed Secure CRM^™, Tumbleweed Secure Messenger^™, Tumbleweed Secure Statements^™, Tumbleweed My Copy^™, Tumbleweed L2i^™, Tumbleweed IME Developer^™, Tumbleweed IME Personalize^™, WorldSecure/Mail^™ and Tumbleweed IME Alert^™.

Table of Contents

PART I—FINANCIAL INFORMATION

ITEM 1— FINANCIAL STATEMENTS

TUMBLEWEED COMMUNICATIONS CORP. AND SUBSIDIARIES

Condensed Consolidated Balance Sheets

(in thousands)

See accompanying Notes to Condensed Consolidated Financial Statements

3

Table of Contents

TUMBLEWEED COMMUNICATIONS CORP. AND SUBSIDIARIES

Condensed Consolidated Statements of Operations

(in thousands, except per share data)

(unaudited)

See accompanying Notes to Condensed Consolidated Financial Statements

4

Table of Contents

TUMBLEWEED COMMUNICATIONS CORP. AND SUBSIDIARIES

Condensed Consolidated Statements of Cash Flows

(in thousands)

(unaudited)

See accompanying Notes to Condensed Consolidated Financial Statements

5

Table of Contents

TUMBLEWEED COMMUNICATIONS CORP. AND SUBSIDIARIES

Notes to Condensed Consolidated Financial Statements

(1) Organization

The condensed consolidated financial statements included herein have been prepared by Tumbleweed Communications Corp. (“Tumbleweed” or “we”) without audit, pursuant to the rules and regulations of the Securities and Exchange Commission (“SEC”). Certain information and footnote disclosures normally included in financial statements prepared in accordance with generally accepted accounting principles have been condensed or omitted pursuant to such rules and regulations. However, we believe that the disclosures are adequate to make the information presented not misleading. These condensed consolidated financial statements should be read in conjunction with our audited financial statements and notes thereto included in our Annual Report on Form 10-K for the fiscal year ended December 31, 2002, filed with the SEC on March 20, 2003, including any amendments to our Annual Report filed with the SEC.

The unaudited condensed consolidated financial statements included herein reflect all adjustments (which include normal, recurring adjustments) which are, in the opinion of management, necessary to state fairly the financial position of Tumbleweed and its subsidiaries as of March 31, 2003, and the results of operations and cash flows for the three months ended March 31, 2003 and 2002. The results for the three months ended March 31, 2003 and 2002 are not necessarily indicative of the results expected for the full fiscal year.

The accompanying consolidated condensed financial statements include the accounts of Tumbleweed and its subsidiaries. All significant intercompany accounts and transactions have been eliminated in consolidation.

(2) Stock-Based Compensation

We account for our stock-based compensation arrangements for employees using the intrinsic value method pursuant to Accounting Principles Board Opinion (APB) 25, Accounting for Stock Issued to Employees. As such, compensation expense is recorded for fixed plan stock options when the fair value of the underlying common stock on the date of grant exceeds the stock option exercise price or the purchase price for issuance or sales of common stock. Expense associated with stock-based compensation is being amortized on an accelerated basis over the vesting period of the individual award consistent with the method described in Financial Accounting Standards Board (“FASB”) Interpretation 28. In the three months ended March 31, 2003 and 2002, respectively, we recorded no deferred stock compensation expense for the difference at the grant date between the exercise price and the fair value of the common stock underlying the options granted. Amortization of deferred stock compensation expense of approximately $34,000 and $262,000 was recognized in the three months ended March 31, 2003 and 2002, respectively. Options granted to consultants and other non-employees are considered compensatory and are accounted for at fair value pursuant to Statement of Financial Accounting Standards (“SFAS”) 123, Accounting for Stock-Based Compensation.

Had compensation expense for our stock-based compensation plan been determined consistent with the fair value approach set forth in SFAS 123, our net losses for the three months ended March 31, 2003 and 2002, respectively, would have been as follows (in thousands, except per share amounts):

6

Table of Contents

For purposes of computing pro forma net loss, the fair value of each option grant and stock purchases under our employee stock purchase plan is estimated on the date of grant using a Black-Scholes option pricing model. Our employee stock purchase plan was discontinued in 2002. The assumptions used to value the option grants and purchase rights are stated as follows:

(3) Net Loss Per Share

Basic and diluted net loss per common share are presented in conformity with SFAS 128, Earnings Per Share, for all periods presented. In accordance with SFAS 128, basic net loss per common share has been computed using the weighted average number of shares of common stock outstanding during the period, less shares subject to repurchase.

The following table presents the calculation of basic and diluted net loss per share (in thousands, except per share amounts):

7

Table of Contents

We exclude potentially dilutive securities from our diluted net loss per share computation when their effect would be antidilutive to net loss per share amounts. The following potential common shares were excluded from our net loss per share computation (in thousands):

(4) Goodwill Impairment

We adopted the provisions of SFAS 142, Goodwill and Other Intangible Assets, on January 1, 2002. In connection with SFAS 142’s transitional goodwill impairment evaluation, we assessed whether there was an indication that goodwill recorded in connection with our acquisition of Tumbleweed Communications KK, our majority-owned subsidiary in Japan, was impaired as of the date of adoption. To accomplish this, we determined the carrying value of our reporting unit by assigning our assets and liabilities, including the existing goodwill and intangible assets, to our reporting unit as of the date of adoption. As our Tumbleweed Communications KK reporting unit’s carrying amount exceeded its fair value, indicating that Tumbleweed Communications KK’s goodwill might be impaired, we performed the second step of the transitional impairment test. In the second step, we compared the implied fair value of Tumbleweed Communications KK’s goodwill, determined by allocating Tumbleweed Communications KK’s fair value to all of its assets (recognized and unrecognized) and liabilities to its carrying amount, both of which were measured as of the date of adoption. A transitional impairment loss of $974,000 was recognized as the cumulative effect of a change in accounting principle in our consolidated statement of operations for the three months ended March 31, 2002.

During the six months ended June 30, 2002, Tumbleweed Communications KK experienced a sustained decline in operations. As a result, we reevaluated our future prospects in Japan and decided to transition to an indirect sales distribution model in Japan. As of June 30, 2002, we determined that our goodwill was impaired and wrote-off the $5.7 million remainder of the goodwill balance. During the three months ended September 30, 2002, we began the liquidation of Tumbleweed Communications KK. As a result of the liquidation of Tumbleweed Communications KK, during the three months ended September 30, 2002, we recorded an operating expense of $377,000 related to the write-off of the remaining net assets of Tumbleweed Communications KK and our eighty percent equity position in Tumbleweed Communications KK. Tumbleweed Communications KK ceased operations in August 2002 and formally declared bankruptcy in December 2002.

(5) Comprehensive Loss

Comprehensive loss includes our net loss as well as foreign currency translation adjustments, recorded net of tax. Comprehensive loss for the three months ending March 31, 2003 and 2002, respectively, is as follows (in thousands):

8

Table of Contents

(6) Segment Information

As defined by SFAS 131, Disclosure About Segments of an Enterprise and Related Information, our chief operating decision-maker is our Chief Executive Officer (“CEO”). Our CEO reviews financial information presented on a consolidated basis accompanied by disaggregated information about revenue by geographic region for purposes of making operating decisions and assessing financial performance. The consolidated financial information reviewed by our CEO is the information presented in the accompanying consolidated statement of operations. Therefore, we operate in a single operating segment.

Revenue information regarding operations in the different geographic regions is as follows (in thousands):

Substantially all of our long-lived assets are located in the United States.

(7) Contingencies

On July 7, 2000, three complaints were filed by David H. Zimmer, Congressional Securities, Inc. and others against Interface Systems, Inc. (a company Tumbleweed acquired in 2000) and various additional defendants, including Interface’s prior president and chief executive officer, Robert A. Nero. Plaintiffs’ complaint currently seeks compensatory damages for losses resulting from not selling their Interface stock from March 14, 2000 to the end of March 2000 and for losses from purchases of Interface stock from March 14, 2000 through April 12, 2000. In March 2003, the court dismissed all claims against Interface and dismissed all claims against Mr. Nero, except a breach of fiduciary duty claim to the extent that claim arises from Michigan common law. In April 2003, Mr. Nero filed an answer and a counterclaim against Mr. Zimmer and Congressional Securities, Inc. seeking contribution and indemnity. Because Mr. Nero and Interface are parties to an indemnification agreement, Interface may incur vicarious liability if and to the extent that the court awards damages against Mr. Nero in this lawsuit. The accompanying financial statements do not include a reserve for any costs for damages, if any, that might result from this uncertainty as a loss is not probable or estimable. An adverse outcome could significantly harm Tumbleweed’s business and operating results.

In September 2002, we received a letter from Entrust, Inc. indicating that we may be interested in licensing the technology covered by U.S. Patent No. 6,393,568, Encryption and Decryption System and Method with Content Analysis Provision, issued to Entrust. In October 2002, we sent a letter to Entrust indicating that Entrust may be interested in licensing the technology covered by four patents issued to Tumbleweed. In February 2003, we received a letter from Entrust indicating that we may have an interest in three additional patents issued to Entrust.

We believe we do not infringe any valid Entrust patent. Moreover, in April 2003, Tumbleweed filed with the U.S. Patent and Trademark Office a request for interference with Entrust Patent No. 6,393,568. If we were to conclude based on additional information that some element of our processes are or might be covered by a valid Entrust patent, we might seek to negotiate and obtain a license from Entrust. If we were unwilling or unable to obtain a license from Entrust, we would remain subject to potential liability for patent infringement. Although we will contest any lawsuit by Entrust vigorously, we cannot make assurances that we will prevail if Entrust were to sue us for infringement of any of the Entrust patents. If any portions of our products were found to be infringing a valid Entrust patent, then we would likely be unable to continue to offer those portions of our products found to be infringing. We could also then be required to pay damages for past infringing use, possibly attorneys’ fees, and possibly treble damages. This could have a material adverse effect on our business prospects, financial condition, results of operations, and cash flows. An estimate cannot be made of the amount of any potential loss related to the Entrust patent, and therefore the accompanying consolidated financial statements do not include a reserve for any potential loss.

9

Table of Contents

All legal costs incurred as a result of these legal proceedings and claim are charged to expense as incurred.

Tumbleweed indemnifies its customers from third party claims of intellectual property infringement relating to the use of its products. Historically, costs related to these guarantees have not been significant and Tumbleweed is unable to estimate the potential impact of these guarantees on its future results of operations.

(8) Recent Accounting Pronouncements

In June 2001, the FASB issued SFAS 143, Accounting for Asset Retirement Obligations, which addresses financial accounting and reporting for obligations associated with the retirement of tangible long-lived assets and the associated asset retirement costs. The standard applies to legal obligations associated with the retirement of long-lived assets that result from the acquisition, construction, development, or normal use of the asset. SFAS 143 requires that the fair value of a liability for an asset retirement obligation be recognized in the period in which it is incurred if a reasonable estimate of fair value can be made. We adopted the provisions of SFAS 143 as of January 1, 2003. The adoption of SFAS 143 did not have a material impact on our financial position or results of operations.

In June 2002, the FASB issued SFAS 146, Accounting for Costs Associated with Exit or Disposal Activities, which addresses financial accounting and reporting for costs associated with an exit or disposal activity. SFAS 146 nullifies Emerging Issues Task Force (EITF) Issue 94-3, Liability Recognition for Certain Employee Termination Benefits and Other Costs to Exit an Activity (including Certain Costs Incurred in a Restructuring). SFAS 146 requires that a liability be recognized for those costs only when the liability is incurred, that is, when it meets the definition of a liability in the FASB’s conceptual framework. In contrast, under EITF Issue 94-3, a company recognized a liability for an exit cost when it committed to an exit plan. SFAS 146 also established fair value as the objective for initial measurement of liabilities related to exit or disposal activities. SFAS 146 is effective for exit or disposal activities initiated after December 31, 2002.

In November 2002, the EITF reached a consensus on Issue 00-21 (EITF 00-21), Revenue Arrangements with Multiple Deliverables. EITF 00-21 addresses certain aspects of the accounting by a vendor for arrangements under which the vendor will perform multiple revenue-generating activities. We are required to adopt the provisions of EITF 00-21 as of January 1, 2004. We do not expect the adoption of EITF 00-21 to have a material impact on our financial position or results of operations.

In November 2002, the FASB issued FASB Interpretation (FIN) 45, Guarantor’s Accounting and Disclosure Requirements for Guarantees, Including Indirect Guarantees of Indebtedness of Others, which clarifies disclosure and recognition/measurement requirements related to certain guarantees. The disclosure requirements are effective for financial statements issued after December 15, 2002 and the recognition/measurement requirements are effective on a prospective basis for guarantees issued or modified after December 31, 2002. We adopted the disclosure provisions of FIN 45 effective December 31, 2002, and the recognition/measurement requirements of FIN 45 did not have an impact on our financial position or results of operations for the three months ended March 31, 2003.

In December 2002, the FASB issued SFAS 148, Accounting for Stock-Based Compensation—Transition and Disclosure. SFAS 148 amends SFAS 123, Accounting for Stock-Based Compensation, to provide alternative methods of transition to SFAS 123’s fair value method of accounting for stock-based employee compensation. SFAS 148 also amends the disclosure provisions of SFAS 123 and APB Opinion 28, Interim Financial Reporting, to require disclosure of the effects of an entity’s accounting policy with respect to stock-based employee compensation on reported net income and earnings per share in annual and interim financial statements. While SFAS 148 does not amend SFAS 123 to require companies to account for employee stock options using the fair value method, the disclosure provisions of SFAS 148 are applicable to all companies with stock-based employee compensation, regardless of whether they account for that compensation using the fair value method of SFAS 123 or the intrinsic value method of APB Opinion 25. As allowed by SFAS 123, we have elected to continue to utilize the accounting method prescribed by APB Opinion 25 and have adopted the disclosure requirements of SFAS 123 and SFAS 148 as of December 31, 2002.

10

Table of Contents

ITEM 2— MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS

The following discussion should be read in conjunction with the consolidated condensed financial statements and the accompanying notes this Quarterly Report on Form 10-Q and Tumbleweed’s Annual Report on Form 10-K for 2002 filed with the SEC, as well as Management’s Discussion and Analysis of Financial Condition and Results of Operations included therein. The following discussion contains forward-looking statements that reflect our plans, estimates and beliefs. Our actual results could differ materially from those discussed in the forward-looking statements. Factors that could cause or contribute to these differences include, but are not limited to, those discussed below and those listed under “Risks and Uncertainties That You Should Consider Before Investing In Tumbleweed”.

Overview

Tumbleweed Communications Corp. (“Tumbleweed” or “we”) is a leading provider of secure messaging applications for businesses and government organizations using the Internet. Tumbleweed enables businesses to share sensitive information via e-mail with customers, business partners and suppliers, transforming e-mail into a tool for enhancing communication and increasing productivity. Using Tumbleweed products, customers can stop spam and other harmful code before it enters the network, regulate e-mail communication traffic to ensure policy compliance, and secure and automate communications with customers, suppliers and partners. By deploying our e-mail firewall and secure messaging solutions, businesses improve their ability to enhance customer service, automate traditional paper and voice-based processes, enable secure collaboration with partners, comply with government and company policies to limit liability, enhance employee productivity, and prevent network disruption.

Tumbleweed’s suite of secure messaging applications provide solutions to important productivity, customer service and online security needs. Tumbleweed’s suite of secure messaging products consists of Tumbleweed Secure Mail, Tumbleweed Secure Archive, Tumbleweed Secure Public Network, Tumbleweed Secure Redirect, Tumbleweed Secure Messenger and Tumbleweed Secure Statements. By deploying some or all of our solutions, our customers can:

On May 15, 2000, Tumbleweed repurchased from Hikari Tsushin 5% of the outstanding stock of Tumbleweed Communications KK, for a price of approximately $645,000. As a result of this transaction, we owned a controlling interest of Tumbleweed Communications KK and began accounting for Tumbleweed Communications KK under the consolidation method effective April 1, 2000. On August 29, 2000, we repurchased an additional 25% of the outstanding shares of Tumbleweed Communications KK, increasing our ownership position to 80%. During the six months ended June 30, 2002, Tumbleweed Communications KK experienced a sustained decline in operations. As a result, we reevaluated our future prospects in Japan and decided to transition to an indirect sales distribution model in Japan. During the three months ended September 30, 2002, we began the liquidation of Tumbleweed Communications KK. Tumbleweed Communications KK ceased operations in August 2002 and formally declared bankruptcy in December 2002.

11

Table of Contents

During 2002, Tumbleweed transitioned from direct sales operations to indirect sales operations in Europe due to sustained declines in the operating results. We are winding down our direct sales operations in Europe and have signed a reseller agreement with a distributor to sell our products and provide technical support to our customers in Europe.

In August 2002, Tumbleweed’s Board of Directors approved a program to repurchase up to $10.0 million of our common stock. Although we are not required to purchase any stock under the program, we may purchase shares either in the open market or in negotiated transactions as market and business conditions warrant. The timing and amount of any shares repurchased is determined by our management based on an evaluation of market conditions and other factors. The purchases are made at current market prices or in negotiated transactions off the market and are funded using our working capital. The repurchase program extends over a twelve month period and may be suspended or discontinued at any time. In October 2002, we adopted a 10b5-1 plan, which we renewed in April 2003. This plan allows us to repurchase our stock under our repurchase program during a period in which we are in possession of material non-public information, provided we previously communicated repurchase instructions to our broker at a time when we were not in possession of such material non-public information. The 10b5-1 plan does not increase the aggregate $10.0 million amount authorized for repurchase purposes. During the year ended December 31, 2002, we repurchased 717,500 shares of our common stock for $796,000. We did not repurchase any shares of our common stock during the three months ended March 31, 2003.

Tumbleweed’s future net income and cash flow may be adversely affected by limitations on our ability to apply net operating losses for federal income tax reporting purposes against taxable income in future periods, including limitations due to ownership changes, as defined in Section 382 of the Internal Revenue Code, arising from issuance of stock.

Proposed Merger with Valicert

On February 18, 2003, Tumbleweed announced the signing of a definitive merger agreement with Valicert, Inc, or Valicert. Pending stockholder and regulatory approvals, we agreed to acquire all of the outstanding shares of Valicert in a stock-for-stock transaction. As approved by the Boards of Directors of each company, the merger calls for each share of Valicert common stock to be exchanged for 0.385 shares of Tumbleweed common stock, or approximately 9.8 million shares, which Tumbleweed expects would represent approximately 24% of Tumbleweed’s outstanding common stock as of the record date assuming no exercise of outstanding Tumbleweed and Valicert options and warrants. The transaction is expected to close in the second or third quarter of 2003, depending on regulatory review.

CRITICAL ACCOUNTING POLICIES AND ESTIMATES

Tumbleweed’s discussion and analysis of its financial condition and results of operations are based upon Tumbleweed’s consolidated financial statements, which have been prepared in accordance with accounting principles generally accepted in the United States. The preparation of these financial statements requires us to make estimates and judgments in determining the reported amounts of assets, liabilities, revenues and expenses, and related disclosure of contingent assets and liabilities. We regularly evaluate our estimates, including those related to revenue recognition, customer arrangements, collectibility of accounts receivable, valuation of assets, and contingencies and litigation. When making estimates, we consider our historical experience, our knowledge of economic and market factors and various other assumptions that we believe to be reasonable under the circumstances. Actual results may differ from these estimates under different assumptions or conditions.

Tumbleweed believes that the following critical accounting policies represent areas where significant judgments and estimates have been used in the preparation of our consolidated financial statements.

Revenue Recognition

Tumbleweed derives its revenue from two sources (i) product and intellectual property, or IP, revenue, which includes license and transaction fees, patent license agreement fees, the sale of distribution rights, and hosting arrangements; and (ii) services revenue, which includes support and maintenance, consulting, and training fees. As described below, significant management judgments and estimates must be made and used in connection with the revenue recognized in any accounting period. Material differences may result in the amount and timing of our revenue for any period if our management made different judgments or utilized different estimates.

12

Table of Contents

Tumbleweed typically offers its software products under a perpetual license model. In addition, we offer or have offered our products under a transaction-based model, under which fees were based on the volume of transactions or contractual minimum volumes; patent license agreements, whereby licensees gain access to one or more of our patents for the duration of the patent(s) in exchange for a licensing and/or transaction fee; distribution rights; and hosting arrangements which require customers to pay a one-time fee for the right to use our software and services over a limited time.

Tumbleweed applies the provisions of Statement of Position (SOP) 97-2, Software Revenue Recognition, and SOP 98-9, Modification of SOP 97-2, Software Revenue Recognition with Respect to Certain Arrangements, which generally requires revenue recognized from software arrangements to be allocated to each element of the arrangement based on the relative fair values of the elements, such as software products, consulting, training, installation, or post-contract customer support. Fair values are based upon vendor specific objective evidence. If such evidence does not exist for delivered elements, we record revenue using the residual method. If such evidence does not exist for undelivered elements, all revenue from the arrangement is deferred until such time that evidence of fair value does exist, or until all elements of the arrangement are delivered, or revenue is recorded ratably if the only undelivered element is support and maintenance.

Tumbleweed recognizes revenue from perpetual licenses upon shipment when the following criteria are met: persuasive evidence of an arrangement exists, based on an executed contract and non-binding purchase order; the product has been delivered, generally to a common carrier or by electronic distribution; the fee is fixed and determinable; and collection of the resulting receivable is probable.

Transaction revenue is recognized based on payment schedules or transaction reports from Tumbleweed’s customers. A number of our contracts include minimum transaction volume requirements. In these cases, the minimum guaranteed revenue is recognized when fees are due and payable during those months where transaction volume does not exceed the designated minimums.

Tumbleweed recognizes revenue from patent license agreements and from the sale of distribution rights when (i) the patent license or distribution agreement is executed, (ii) the amounts due are fixed, determinable, and billable, and (iii) collection of the resulting receivable is probable.

Hosting arrangements require customers to pay a one-time fee for the right to use Tumbleweed software and services. We recognize revenue from hosting arrangements ratably over the service period because the customer does not have the right to take the software. We discontinued our hosting effort during the three months ended September 30, 2002.

Customers generally purchase at least one-year of support and maintenance together with each perpetual license. Support and maintenance is sold as a percentage of the list price of the software product. Renewals of support and maintenance in future years are also sold as a percentage of the software product’s list price. Under a support and maintenance agreement, customers receive on-going support and, in some instances, the right to receive future updates and upgrades of our products during the term of the agreement. Revenue from support and maintenance is recognized ratably over the period the support is provided.

Installation by Tumbleweed of our products is not considered essential to the functionality of our products, as these services do not alter the products’ capabilities, do not require any specialized skills, and may be performed by the customer or any third parties. Services revenue is related to installation and is generally recognized on a time and materials basis, except for when specific acceptance criteria exists. When customer specific acceptance criteria exist, we recognize revenue upon customer acceptance.

When licenses are sold together with consulting services, license fees are recognized upon delivery, provided that the revenue recognition criteria set forth above for perpetual licenses have been met; payment of the license fees is not dependent upon the performance of the consulting and implementation services; and the services are not essential to the functionality of the software. For arrangements that do not meet the above criteria, both the product license revenues and services revenues are recognized under the percentage of completion contract method in accordance with the provisions

13

Table of Contents

of SOP 81-1, Accounting for Performance of Construction Type and Certain Production Type Contracts. Losses on fixed-dollar contracts are recognized during the period in which the loss first becomes evident. Contract losses are determined to be the amount by which the estimated total costs of the contract exceeds the total fixed dollar of the contract.

Other consulting engagements are generally on a time and materials basis, for which revenue is recognized as the services are performed. For fixed dollar consulting contracts with milestones or acceptance provisions, revenue is recognized upon completion of a milestone or acceptance, if applicable.

Training revenue is recognized as the training is provided.

Tumbleweed assesses collectibility based on a number of factors, including past transaction history with the customer and the creditworthiness of the customer. We do not request collateral from our customers. If we determine that collection of a fee is not probable, we defer the fee and recognize revenue upon receipt of cash. For contracts with extended payment terms, we recognize revenue as payments become due from the customer.

Revenue from the reseller channel is recognized upon software shipment, the execution of a distribution agreement with the reseller, and the receipt of substantive identification of the end-user customer.

Tumbleweed typically grants its customers a warranty which guarantees that its products will substantially conform to its current specifications for 60 days from the delivery date. Services to be provided under a warranty are consistent with the services performed under support and maintenance purchased by almost all of Tumbleweed’s customers. Tumbleweed provides for the estimated cost of product and service warranties based on specific warranty claims received, provided that it is probable that a liability exists, and provided the cost to repair or otherwise satisfy the claim can be reasonably estimated. The amount of the reserve recorded is equal to the costs to repair or otherwise satisfy the claim. Historically, costs related to warranty claims not covered by a support and maintenance agreement have not been significant.

Valuation of Allowance for Doubtful Accounts

Tumbleweed maintains allowances for doubtful accounts for estimated losses resulting from the inability of our customers to make required payments. A considerable amount of judgment is required when we assess the realization of receivables, including assessing the probability of collection and the current credit-worthiness of each customer. We must make estimates of the collectibility of our accounts receivables. We specifically analyze accounts receivable, including review of historical bad debts, customer concentrations, customer credit-worthiness, current economic trends, aging of the balance and estimated collectibility percentages for different aging ranges, geographic and industry mix, and changes in our customer payment terms when evaluating the adequacy of the allowance for doubtful accounts. If the financial condition of our customers were to deteriorate, resulting in an impairment of their ability to make payments, additional allowances may be required which would result in an additional general and administrative expense in the period such determination is made. Our allowance for doubtful accounts was 31% and 30% of our gross receivables as of March 31, 2003 and December 31, 2002, respectively.

Valuation of Long-Lived Assets and Goodwill

Tumbleweed assesses the impairment of identifiable intangibles, long-lived assets and goodwill whenever events or changes in circumstances indicate that the carrying value may not be recoverable. Factors we consider important, which could trigger an impairment review, include the following:

14

Table of Contents

When Tumbleweed determines that the carrying value of long-lived assets may not be recoverable upon the existence of one or more of the above indicators of impairment, and such carrying value is less than projected undiscounted cash flows attributed to the asset, we measure any impairment based on the amount by which the carrying amount of the assets exceeds the fair value of the assets.

SFAS 142 became effective on January 1, 2002 and as a result, Tumbleweed ceased amortizing approximately $6.7 million of goodwill. In connection with SFAS 142’s transitional goodwill impairment evaluation, Tumbleweed assessed whether there was an indication that goodwill recorded in connection with our acquisition of Tumbleweed Communications KK was impaired as of the date of adoption. To accomplish this, we determined the carrying value of our reporting unit by assigning our assets and liabilities, including the existing goodwill and intangible assets, to our reporting unit as of the date of adoption. As our Tumbleweed Communications KK reporting unit’s carrying amount exceeded its fair value, indicating that Tumbleweed Communications KK’s goodwill might be impaired, we performed the second step of the transitional impairment test. In the second step, we compared the implied fair value of Tumbleweed Communications KK’s goodwill, determined by allocating Tumbleweed Communications KK’s fair value to all of its assets (recognized and unrecognized) and liabilities to its carrying amount, both of which were measured as of the date of adoption. A transitional impairment loss of $974,000 was recognized as the cumulative effect of a change in accounting principle in our consolidated statement of operations.

During the six months ended June 30, 2002, Tumbleweed Communications KK experienced a sustained decline in operations. As a result, we revaluated our future prospects in Japan and decided to transition to an indirect sales distribution model in Japan. As of June 30, 2002, we determined that our goodwill was impaired and wrote-off the $5.7 million remainder of the goodwill balance. During the three months ended September 30, 2002, we began the liquidation of Tumbleweed Communications KK. As a result of the liquidation of Tumbleweed Communications KK, during the three months ended September 30, 2002, we recorded an operating expense of $377,000 related to the write-off of the remaining net assets of Tumbleweed Communications KK and our eighty percent equity position in Tumbleweed Communications KK. Tumbleweed Communications KK ceased operations in August 2002 and formally declared bankruptcy in December 2002.

RESULTS OF OPERATIONS

Three Month Periods Ended March 31, 2003 and 2002

Revenue. Revenue, which consists of both product and intellectual property, or IP, revenue as well as services revenue, results from new contracts and backlog. We define backlog as deferred revenue, contractual commitments that are not due and payable as of the balance sheet date, or collectibility is in doubt, and/or for whom the product or service has not yet been delivered. Product and IP revenue consists of license and transaction fees, patent license agreement fees, and the sale of distribution rights. Services revenue includes support and maintenance, consulting, and training fees. Total revenue for the three months ended March 31, 2003 decreased to $5.8 million from $8.1 million for the same three months in 2002. The decrease in total revenue was due to a $2.6 million decrease in product and IP revenue. The reduction in product and IP revenue was partially offset by a $301,000 increase in services revenue. For the three months ended March 31, 2003, no single customer comprised 10% or more of our revenue. For the three months ended March 31, 2002 one customer comprised approximately 18% of our revenue. For the three months ended March 31, 2003 and 2002, five customers comprised approximately 28% and 42% of our revenue, respectively.

Product and IP revenue for the three months ended March 31, 2003 decreased to $2.9 million from $5.5 million for the same three months in 2002. The decrease of $2.6 million in product and IP revenue was primarily due to a decrease in transaction revenue, license revenue and IP revenue in the three months ended March 31, 2003. During 2001 we began shifting from a transaction-based model, in which fees are based on the volume of transactions or contractual

15

Table of Contents

minimum volumes and revenue is recognized when fees are due and payable during those months where transaction volume does not exceed the designated minimums, to a perpetual license model. Transaction revenue decreased to $158,000 from $930,000 and we expect transaction revenue to continue to decrease in the future. As part of this transition, many of our former transaction-based customers have purchased software licenses with associated support and maintenance contracts. License revenue decreased to $2.6 million from $3.3 million due to the continued decline in information technology spending by our existing and prospective customers based primarily on the uncertainty of the economy, which also contributed to a decrease in average selling prices for our products. IP revenue decreased by more than $900,000 due to a reduction in patent license agreements consummated in the three months ended March 31,2003.

Services revenue for the three months ended March 31, 2003 increased to $2.9 million from $2.6 million for the same three months in 2002. The increase in services revenue was due to a $538,000 increase in maintenance revenue from our installed customer base. This was partially offset by a $236,000 decrease in consulting revenue due to our shift in consulting services towards supporting customer implementations of our product and away from a generalized secure messaging consulting practice, in which we advised and provided services across a variety of technology platforms. This transition resulted in the reduction in the number of revenue generating projects and revenue generating consultants. We expect consulting revenue to decline in fiscal year 2003 as we continue this transition.

Cost of Revenue. Cost of revenue is comprised of product license costs and service costs. Product license cost is primarily comprised of royalties paid to third parties for software licensed by us for inclusion in our products. Service costs are comprised primarily of employee and employee-related costs related to customer support and consulting and contract development projects with third parties. Total cost of revenue for the three months ended March 31, 2003 decreased to $1.4 million, or 24% of revenue, from $2.2 million, or 27% of revenue for the same three months in 2002. Total cost of revenue decreased, as a percentage of revenue, due to a shift in our services revenue mix to higher-margin customer support and maintenance revenue from lower-margin consulting revenue. Total cost of revenue decreased, in absolute dollars, primarily due to a decrease in employees and related employee costs, including salary reductions. The decrease in employees was driven by our increased focus regarding the direct implementation and development of our core products, and the transition from direct sales operations to indirect sales operations in Europe and Japan which reduced our professional services headcount in those regions to zero. Overall, employee-related costs decreased by $504,000. The remainder of the decrease in total cost of revenue was due to reductions in third-party consulting expenses, allocated overhead charges and depreciation expense. Consulting expenses decreased by $92,000 due to our decision to terminate our Data Center service in the second half of 2002. This decision reduced consulting expenses used to support this service. Allocated overhead charges decreased due to a reduction in our allocable cost base caused by our reduction in information technology spending and our reduction in facility costs. Depreciation expense decreased due to some of our assets becoming fully depreciated in 2002, and lower capital expenditures in 2002 as compared to 2001 and 2000.

Research and Development Expenses. Research and development expenses are comprised of employee and employee-related costs and other costs required for the development of our applications, quality assurance, and testing. Research and development expenses for the three months ended March 31, 2003 decreased to $2.0 million from $3.2 million for the same three months in 2002. The decrease in research and development expenses was primarily due to a decrease in the number of employees and related employee costs, including salary reductions, and a reduction in allocated overhead charges of $356,000. The decrease of employees is due to our decision to reduce the number of our product offerings and outsource development for non-core product offerings. As a result, employee-related costs decreased by $655,000. We believe that our investment in research and development is required to remain competitive and therefore expect to maintain resource levels consistent with the fourth quarter of 2002. As part of this effort, we are outsourcing development to an offshore development center for those products for which we can reduce costs and meet delivery and continuing engineering requirements.

Sales and Marketing Expenses. Sales and marketing expenses are comprised of salaries, commissions, travel expenses, other related employee costs, and costs associated with marketing programs. Sales and marketing expenses for the three months ended March 31, 2003 decreased to $3.4 million from $5.6 million for the same three months in 2002. The decrease in sales and marketing expenses was primarily due to decreased employees and related employee costs, including salary reductions. The decrease in employees was primarily due to a shift in our sales focus towards large accounts in target industries which allowed us to reduce the number of direct sales representatives and sales support employees in North America, and the transition from direct sales operations to indirect sales operations in Europe and Japan, which reduced

16

Table of Contents

our sales and marketing employees in those regions to zero. This decline in employees decreased employee-related costs by $1.8 million. In addition, marketing programs decreased by $237,000 due to more focused marketing efforts in North America and a lesser number of products.

General and Administrative Expenses. General and administrative expenses consist primarily of employee and employee-related and support costs for our finance, legal, and human resources departments as well as public reporting costs, and professional fees including intellectual property enforcement and protection costs. General and administrative expenses for the three months ended March 31, 2003 decreased to $1.4 million from $1.6 million for the same three months in 2002. The decrease in general and administrative expenses was due to lower bad debt expense. Bad debt expense decreased by $344,000 due to a decrease in the size of our accounts receivable balance, increased collections efforts, more centralized operations in the United States, and improved geographic and industry mix of our customers. This was partially offset by an increase in intellectual property enforcement and protection costs. We believe that the enforcement and protection of our intellectual property is important to our business and we expect to continue to incur costs related to the enforcement and protection of our intellectual property in the second quarter of 2003.

Stock-based Compensation Expense. Stock-based compensation expense was recorded in connection with the amortization of deferred stock compensation recorded as a result of grants of stock options to non-employees and employees at exercise prices less than the fair value on the grant date and the vesting acceleration of stock options approved for certain employees, net of credits related to stock options granted to employees who were later terminated. Stock-based compensation expense for the three months ended March 31, 2003 decreased to $34,000 from $262,000 for the same three months in 2002. The decrease was the result of the termination of certain employees whose options had not yet vested.

Other Income, Net. Other income, net, is primarily comprised of interest income earned on investment securities. Other income, net, for the three months ended March 31, 2003 decreased to $14,000 from $407,000 for the same three months in 2002. The decrease in other income, net, is primarily due to a minority interest credit during the three months ended March 31, 2002 and the decline in interest rates and a reduction in our cash balances relative to the year-earlier period. During the three months ended March 31, 2002 we recorded a $148,000 minority interest credit related to the loss recognized by Tumbleweed Communications KK in that quarter. Tumbleweed Communications KK ceased operations in August 2002 and formally declared bankruptcy in December 2002. As a result, there was no minority interest impact to our financial statements in the three months ended March 31, 2003.

LIQUIDITY AND CAPITAL RESOURCES

Since inception, we have financed our operations primarily through the issuance of equity securities. As of March 31, 2003, we had approximately $27.0 million in cash and cash equivalents.

Net cash used in operating activities for the three months ended March 31, 2003 increased to $2.3 million from $1.2 million for the same three months in 2002. Cash used in operating activities was primarily the result of our net operating loss of $2.5 million. Although our net loss decreased by $2.9 million, net cash used in operating activities increased by $1.1 million relative to the same three months in 2002 primarily due to non-cash charges for depreciation expense, bad debt expense and a $974,000 cumulative effect of change in accounting principle related to the adoption of SFAS 142 in the three months ended March 31, 2002. Depreciation expense decreased to $359,000 from $859,000 due to certain of our assets becoming fully depreciated in 2002, and lower capital expenditures in 2002 as compared to 2001 and 2000. Bad debt expense decreased to $31,000 from $375,000 due to a decrease in the size of our accounts receivable balance, an improvement in our collections efforts and improved geographic and industry mix of our customers. Cash used in operating activities also increased due to a $406,000 decrease in deferred revenue in the three months ended March 31, 2003 as opposed to a $1.8 million increase in the three months ended March 31, 2002. The $1.8 million increase in the three months ended March 31, 2002 was due to a large customer contract in that quarter which included significant deferred revenue related to consulting and support and maintenance revenue.

Net cash used in investing activities was $64,000 for both the three months ended March 31, 2003 and the same three months in 2002. Net cash used in investing activities was comprised of purchases of property and equipment.

17

Table of Contents

Net cash used in financing activities for the three months ended March 31, 2003 decreased to $35,000 from $64,000 for the same three months in 2002. Net cash used in financing activities was primarily for the repayments of borrowings on our equipment loan facility and other long-term liabilities.

As of March 31, 2003, Tumbleweed’s principal commitments consisted of obligations related to outstanding operating leases and unconditional purchase obligations consisting of contractually committed third-party royalty and consulting payments and costs related to the acquisition of Valicert. Our equipment leases require payment of rental fees to third party leasing providers. We have no obligations to purchase the equipment at the end of the lease term. We do not anticipate a substantial increase in capital expenditures in the immediate future. We also do not anticipate an increase in operating lease obligations.

In June 1999, Tumbleweed entered into an operating lease covering approximately 40,000 square feet of office space in Redwood City, California. The lease is for a term of approximately five years, with current monthly rent payments of approximately $124,000. This lease expires in November 2004. We are currently planning to lease a new headquarters office or renew our existing lease prior to the expiration. In September 2000, we leased an additional 42,000 square feet in an adjacent building with a term of five years and subleased this space. We terminated this second lease as of December 31, 2001 and made a lease settlement payment of $2.3 million, using lease deposits, in the first quarter of 2002 as a part of the lease termination agreement.

As a result of the Interface acquisition, Tumbleweed assumed an operating lease covering approximately 13,000 square feet of office space in Slough, United Kingdom. The lease is for a term ending in 2020 with current quarterly rent payments of approximately $60,000. This office space is currently subleased to a tenant who is currently providing us with quarterly rent payments of approximately $60,000. The sublease terminates in July 2003, and we are currently attempting to renew the sublease or find a new sublessee.

In July 1998, Tumbleweed entered into a debt agreement with a bank, which included a $750,000 equipment loan facility. In June 1999, we obtained a second equipment loan facility in the amount of $1.0 million with the same bank. The first equipment loan in the amount of $750,000 expired in December 2001 and the second equipment loan in the amount of $1.0 million expired in December 2002. Borrowings under both equipment loan facilities maintained interest at prime rate plus 0.75%, were due and payable in 36 equal monthly installments and were secured by certain of our assets. The weighted average interest rate for the equipment loans was 5.50%, for the three months ended March 31, 2002. At December 31, 2002 the equipment loan had aggregate maturities of $27,000 that were paid in full in January 2003.

On February 18, 2003, Tumbleweed announced the signing of a definitive merger agreement with Valicert . Pending stockholder and regulatory approvals, we will acquire all of the outstanding shares of Valicert in a stock-for-stock transaction. As approved by the Boards of Directors of each company, the merger calls for each share of Valicert common stock to be exchanged for 0.385 shares of Tumbleweed common stock, or approximately 9.8 million shares, which Tumbleweed expects would represent approximately 24% of Tumbleweed’s outstanding stock post merger. The transaction is expected to close in the second or third quarter of 2003, depending on regulatory review. As of March 31, 2003, we have future payment obligations of approximately $1.4 million to our attorneys, financial printers, investment bankers, and public accountants related to the acquisition of Valicert. We expect our total costs for these items and extended directors and officers insurance related to this merger to be approximately $2.2 million.

Valicert’s independent auditors have included a paragraph in their report stating that substantial doubt exists as to Valicert’s ability to continue as a going concern. As of December 31, 2002 Valicert had a cash balance of $3.1 million. As of March 31, 2003, Valicert had a cash balance of $2.3 million and had not reported a profitable quarter since its inception in 1996. As a result, it is unlikely that Valicert will contribute a significant amount of cash to Tumbleweed if the proposed merger is completed. If the operations of Valicert are not immediately accretive to Tumbleweed’s earnings, Tumbleweed will need to fund the operations of Valicert using its cash balances.

Our capital requirements depend on numerous factors, including revenue generated from operations and market acceptance of our products and services, the resources devoted to the development of our products and services and the resources devoted to sales and marketing. We have decreased our spending on capital expenditures in recent quarters and

18

Table of Contents

do not anticipate increases in capital expenditures in the immediate future. We believe that our existing capital resources should enable us to maintain our current and planned operations for at least the next 12 months. Although Tumbleweed believes it has sufficient cash and cash equivalents to fund the combined operations of Tumbleweed and Valicert for at least the twelve months following completion of the merger, Tumbleweed may have insufficient cash reserves to fund the combined operations thereafter. As of March 31, 2003, Tumbleweed had cash and cash equivalents of $27.0 million and had incurred cumulative net losses since inception of $272.6 million. Tumbleweed’s current cash reserves, especially in light of Tumbleweed’s $10.0 million stock repurchase program authorized in August of 2002 to the extent repurchases are effected, may be insufficient if Tumbleweed experiences either lower than expected revenues or extraordinary or unexpected cash expenses. Tumbleweed’s capital reserves will also be affected by the costs of the proposed merger with Valicert and, if completed, the ongoing capital requirements of that business. While Tumbleweed expects to reduce the cash requirements of the combined companies following the merger through employee and related expense savings, Tumbleweed may be unable to do so. Funding, if needed, however may not be available on acceptable terms or at all. If adequate funds are not available, Tumbleweed may be required to curtail significantly or defer one or more of Tumbleweed’s operating goals or programs, or take other steps that could harm Tumbleweed’s business or future operating results.

Tumbleweed will continue to consider future financing alternatives, which may include the incurrence of indebtedness, additional public or private equity offerings or an equity investment by a strategic partner; however, we have no present commitments or arrangements assuring us of any future equity or debt financing. Additionally, equity or debt financing may not be available to us on favorable terms, if at all.

In August 2002, Tumbleweed’s Board of Directors approved a program to repurchase up to $10.0 million of our common stock. Although we are not required to purchase any stock under the program, we may purchase shares either in the open market or in negotiated transactions as market and business conditions warrant. The timing and amount of any shares repurchased is determined by our management based on an evaluation of market conditions and other factors. The purchases are made at current market prices or in negotiated transactions off the market and are funded using our working capital. The repurchase program extends over a twelve month period and may be suspended or discontinued at any time. In October 2002, we adopted a 10b5-1 plan, which we renewed in April 2003. This plan allows us to repurchase our stock under our repurchase program during a period in which we are in possession of material non-public information, provided we previously communicated repurchase instructions to our broker at a time when we were not in possession of such material non-public information. The 10b5-1 plan does not increase the aggregate $10.0 million amount authorized for repurchase purposes. During the year ended December 31, 2002 we repurchased 717,500 shares of our common stock for $796,000. We did not repurchase any shares of our common stock during the three months ended March 31, 2003.

Contractual Obligations and Commercial Commitments

Future cash payments for contractual obligations and commercial commitments as of March 31, 2003, are as follows (in thousands):

The amounts above will be offset by sublease payments of $154,000 in 2003 and $104,000 in 2004.

RISKS AND UNCERTAINTIES THAT YOU SHOULD CONSIDER BEFORE INVESTING IN TUMBLEWEED.

Tumbleweed has a history of losses and may experience continued losses.

Tumbleweed’s prospects must be considered in light of the risks, expenses, delays and difficulties frequently encountered by companies engaged in new and rapidly evolving technology markets like Tumbleweed’s. Tumbleweed

19

Table of Contents

incurred net losses of $20.9 million, $114.2 million, and $69.8 million in 2002, 2001, and 2000, respectively. As of March 31, 2003, Tumbleweed had incurred cumulative net losses of $272.6 million.

Tumbleweed’s success may depend in large part upon the adoption and utilization of Tumbleweed’s products and technology, as well as Tumbleweed’s ability to effectively maintain existing relationships and develop new relationships with customers and strategic partners. If Tumbleweed does not succeed in doing so, it may not achieve or maintain profitability on a timely basis or at all. In particular, Tumbleweed intends to expend significant financial and management resources on product development, sales and marketing, strategic relationships, technology and operating infrastructure. As a result, Tumbleweed may incur additional losses and continued negative cash flow from operations for the foreseeable future.

Fluctuations in Tumbleweed’s quarterly operating results may not be predictable and may result in significant volatility in Tumbleweed’s stock price.

Tumbleweed’s product revenue has fluctuated and Tumbleweed’s quarterly operating results will continue to fluctuate based on, among other things, the timing of the execution and termination of customer agreements in a given quarter. Tumbleweed’s services revenue is subject to the risk that Tumbleweed may not be able to meet increasing customer demand because of a lack of adequately trained personnel, and the risk that customers may not timely accept the services provided and delay payment for such services. In addition, Tumbleweed has experienced, and expect to continue to experience, fluctuations in revenue and operating results from quarter to quarter for other reasons, including, but not limited to:

As a result of these factors, Tumbleweed believes that quarter-to-quarter comparisons of its revenue and operating results are not necessarily meaningful, and that these comparisons may not be accurate indicators of future performance. Tumbleweed may not be able to accurately forecast its revenue or expenses. Because Tumbleweed’s staffing and operating expenses are based on anticipated revenue levels, and because a high percentage of Tumbleweed’s costs are fixed, small variations in the timing of the recognition of specific revenue could cause significant variations in operating results from quarter to quarter. In addition, many of Tumbleweed’s customers delay purchases of Tumbleweed’s products until the end of each quarter. If Tumbleweed is unable to adjust spending in a timely manner to compensate for any unexpected revenue shortfall, any significant revenue shortfall would likely have an immediate negative effect on Tumbleweed’s operating results. Moreover, Tumbleweed believes the difficulties outlined above with respect to financial

20

Table of Contents

forecasts also apply to securities analysts that may publish estimates of Tumbleweed’s financial results. Tumbleweed’s operating results in one or more future quarters may fail to meet the expectations of securities analysts or investors due to any of a wide variety of factors, including fluctuations in financial ratios or other metrics used to measure Tumbleweed’s performance. If this occurs, Tumbleweed would expect to experience an immediate and significant decline in the trading price of Tumbleweed’s stock.

Economic conditions could adversely affect Tumbleweed’s ability to maintain and increase revenue.

The revenue and profitability or loss of Tumbleweed’s business depends on the overall demand for Tumbleweed’s products, Tumbleweed’s intellectual property, and Tumbleweed’s services, particularly within the industries in which Tumbleweed offers specific versions of Tumbleweed’s products. Because Tumbleweed’s sales are primarily to customers in the financial services, health care, and government industries, Tumbleweed’s business depends on the overall economic conditions and the economic and business conditions within these industries. The progressive weakening of the global economy, the information technology industry in particular, and the weakening of the business conditions within the above industries has caused a decrease in Tumbleweed’s license revenues. A softening of demand for information technology spending caused by a continued weakening of the economy, domestically or internationally, may result in a continued decrease in revenues and continued losses.

In addition, the financial, political, economic and other uncertainties following the terrorist attacks upon the United States have led to a further weakening of the global economy, and have created an uncertain economic environment. Tumbleweed cannot predict the impact of these events, any subsequent terrorist acts or of any related military action, on Tumbleweed’s customers or business. Subsequent terrorist acts and/or the threat of future outbreak or continued escalation of hostilities involving the United States or other countries could adversely affect spending on information technology and on Tumbleweed’s software license revenue, as well as have an adverse effect on Tumbleweed’s business, financial condition or results of operations.

Tumbleweed may have insufficient cash reserves to see it through to profitability.

Although Tumbleweed believes it has sufficient cash and cash equivalents to fund the combined operations of Tumbleweed and Valicert for at least the twelve months following completion of the merger, Tumbleweed may have insufficient cash reserves to fund the combined operations thereafter. As of March 31, 2003, Tumbleweed had cash and cash equivalents of $27.0 million and had incurred cumulative net losses since inception of $272.6 million. Tumbleweed’s current cash reserves, especially in light of Tumbleweed’s $10.0 million stock repurchase program authorized in August of 2002 to the extent repurchases are effected, may be insufficient if Tumbleweed experiences either lower than expected revenues or extraordinary or unexpected cash expenses. Tumbleweed’s capital reserves will also be affected by the costs of the proposed merger with Valicert and, if completed, the ongoing capital requirements of that business. Although Tumbleweed expects to reduce the cash requirements of the combined companies following the merger through employee and related expense reductions, Tumbleweed may be unable to do so. Funding, if needed, may not be available on acceptable terms or at all. If adequate funds are not available, Tumbleweed may be required to curtail significantly or defer one or more of Tumbleweed’s operating goals or programs, or take other steps that could harm Tumbleweed’s business or future operating results.

Failure to obtain needed financing could affect Tumbleweed’s ability to maintain current operations and pursue potential growth, and the terms of any financing Tumbleweed obtains may impair the rights of Tumbleweed’s existing stockholders.

In the future, Tumbleweed may be required to seek additional financing to fund its operations. Factors such as the commercial success of Tumbleweed’s existing products and services, the timing and success of any new products and services, the progress of Tumbleweed’s research and development efforts, Tumbleweed’s results of operations, the status of competitive products and services, and the timing and success of potential strategic alliances or potential opportunities to acquire or sell technologies or assets may require us to seek additional funding sooner than Tumbleweed expects. In the event that Tumbleweed requires additional cash, Tumbleweed may not be able to secure additional financing on terms that are acceptable, especially in light of the uncertainty in the current market environment, and Tumbleweed may not be

21

Table of Contents

successful in implementing or negotiating such other arrangements to improve its cash position. If Tumbleweed raises additional funds through the issuance of equity or convertible debt securities, the percentage ownership of Tumbleweed’s stockholders would be reduced and the securities Tumbleweed issues might have rights, preferences and privileges senior to those of Tumbleweed’s current stockholders. If adequate funds were not available on acceptable terms or at all, Tumbleweed’s ability to achieve or sustain positive cash flows, maintain current operations, fund any potential expansion, take advantage of new opportunities, develop or enhance products or services, or otherwise respond to competitive pressures could be significantly limited.

A limited number of customers account for a high percentage of Tumbleweed’s revenue, and the failure to maintain or expand these relationships could adversely affect Tumbleweed’s future revenue.

The loss of one or more of Tumbleweed’s major customers, the failure to attract new customers on a timely basis or a reduction in usage and revenue associated with the existing or proposed customers would harm Tumbleweed’s future revenue and prospects. For the three months ended March 31, 2003, no single customer comprised 10% or more of our revenue. For the three months ended March 31, 2002 one customer comprised approximately 18% of our revenue. For the three months ended March 31, 2003 and 2002, five customers comprised approximately 28% and 42% of our revenue, respectively.

Tumbleweed expects to continue making strategic investments and acquisitions, which may involve substantial costs, may substantially dilute existing Tumbleweed investors, and may fail to yield anticipated benefits.

Tumbleweed is continuously evaluating investments in complementary technologies and businesses. Acquisitions of companies, divisions of companies, or products, including Tumbleweed’s acquisition of Valicert, entail numerous risks, including:

As a result of acquisitions, Tumbleweed may acquire significant assets that include goodwill and other purchased intangibles. The testing of these intangibles under established accounting guidelines for impairment requires significant use of judgment and assumptions. Changes in business conditions could require adjustments to the valuation of these assets. In this regard, Tumbleweed wrote off substantially all of its investment in Interface Systems subsequent to the completion of that acquisition.

22

Table of Contents

If Tumbleweed does not secure key relationships with enterprise customers, Tumbleweed’s access to broader markets will be limited, which would adversely affect revenue in future periods.

Tumbleweed’s enterprise customers, which use or intend to use Tumbleweed’s products to intelligently manage the incoming and outgoing online communications of their enterprises, are a significant source of Tumbleweed’s revenue. A key aspect of Tumbleweed’s strategy is to access target markets prior to adoption of alternative solutions by the larger participants in these markets. The failure to secure key relationships with new enterprise customers in targeted markets could limit or effectively preclude Tumbleweed’s entry into these target markets, which would harm Tumbleweed’s business and prospects.

Customers in a preliminary phase of implementing Tumbleweed’s product may not proceed on a timely basis or at all, and the failure to do so could adversely affect revenue in future periods.

Some of Tumbleweed’s customers are currently in a pre-production or pre-launch stage of implementing Tumbleweed’s products and may encounter delays or other problems in introducing them. A customer’s decision not to do so or a delay in implementation could result in a delay or loss in related revenue or otherwise harm Tumbleweed’s businesses and prospects. Tumbleweed cannot predict when or if any customer that is currently in a pilot or preliminary phase will implement broader use of Tumbleweed’s services.

The markets for secure messaging applications generally, and for Tumbleweed’s products specifically, are new and may not develop, and the failure to do so could limit Tumbleweed’s business prospects.

The market for Tumbleweed’s products and services is new and evolving rapidly. If the market for Tumbleweed’s products and services fails to develop and grow, or if Tumbleweed’s products and services do not gain broad market acceptance, Tumbleweed’s business and prospects will be harmed. In particular, Tumbleweed’s success will depend upon the adoption and use by current and potential customers and their end-users of secure messaging applications. Tumbleweed’s success will also depend upon acceptance of Tumbleweed’s technology as the standard for providing these services. The adoption and use of Tumbleweed’s products and services will involve changes in the manner in which businesses have traditionally exchanged information. In some cases, Tumbleweed’s customers have little experience with products, services and technology like those offered by us.

Tumbleweed’s ability to influence usage of its products and services by customers and end-users is limited. For example, the usage of Secure Messenger by the end-users of Tumbleweed’s service provider customers has been limited to date. Tumbleweed has spent, and intend to continue to spend, considerable resources educating potential customers and their end-users about the value of Tumbleweed’s products and services. It is difficult to assess the present and future size of the potential market for Tumbleweed’s products and services, or Tumbleweed’s growth rate, if any. Moreover, Tumbleweed cannot predict whether Tumbleweed’s products and services will achieve any market acceptance. For example, as email has become increasingly widespread and accepted, current and potential customers may be more willing to accept related security risks with email, as opposed to utilizing Tumbleweed’s products. Tumbleweed’s ability to achieve its goals also depends upon rapid market acceptance of future enhancements of Tumbleweed’s products and Tumbleweed’s ability to identify new markets as they emerge. Any enhancement that is not favorably received by customers and end-users may not be profitable and, furthermore, could damage Tumbleweed’s reputation or brand name. Any failure to identify and address new market opportunities could harm Tumbleweed’s business and prospects.

The markets Tumbleweed addresses are highly competitive and rapidly changing, and Tumbleweed may not be able to compete successfully.

Tumbleweed may not be able to compete successfully against current and future competitors, and the multiple competitive pressures Tumbleweed faces could harm Tumbleweed’s business and prospects. The markets in which Tumbleweed competes are intensely competitive and rapidly changing.

The principal competitive factors in Tumbleweed’s industry include price, product functionality, product integration, platform coverage and ability to scale, worldwide sales infrastructure and global technical support. Some of Tumbleweed’s competitors have greater financial, technical, sales, marketing and other resources than Tumbleweed does,

23

Table of Contents

as well as greater name recognition and a larger installed customer base. Additionally, some of these competitors have research and development capabilities that may allow them to develop new or improved products that may compete with product lines Tumbleweed markets and distributes. Tumbleweed expects that the market for secure messaging applications will become more consolidated with larger companies being better positioned to compete in such an environment in the long term. As this market continues to develop, a number of companies with greater resources than ours could attempt to increase their presence in this market by acquiring or forming strategic alliances with Tumbleweed’s competitors or business partners. Tumbleweed’s success will depend on its ability to adapt to these competing forces, to develop more advanced products more rapidly and less expensively than Tumbleweed’s competitors, and to educate potential customers as to the benefits of licensing Tumbleweed’s products rather than developing their own products. Competitors could introduce products with superior features, scalability and functionality at lower prices than Tumbleweed’s products and could also bundle existing or new products with other more established products in order to compete with us. In addition, because there are relatively low barriers to entry for the software market, Tumbleweed expects additional competition from other established and emerging companies. Increased competition is likely to result in price reductions, reduced gross margins and loss of market share, any of which could harm Tumbleweed’s business.

Changing Tumbleweed’s sales distribution model from direct sales operations to indirect sales operations in Europe and Japan may reduce Tumbleweed’s revenue in future periods.

During 2002, Tumbleweed transitioned from direct sales operations to indirect sales operations in Europe and Japan due to sustained declines in the operating results of those regions. In Europe, Tumbleweed is winding down its direct sales operations and has signed a reseller agreement with a distributor to sell Tumbleweed’s products and provide technical support to Tumbleweed’s customers there. In Japan, Tumbleweed transitioned to an indirect sales distribution model and began the liquidation of its majority-owned subsidiary in Japan, Tumbleweed Communications KK. Tumbleweed Communications KK ceased operations in August 2002 and formally declared bankruptcy in December 2002. Revenue from Tumbleweed’s international regions in Europe and Asia may decrease on a year-over-year basis in future years as a result of this transition.

Restructuring of operations and other cost reducing measures Tumbleweed has implemented may not achieve the results Tumbleweed intends and may adversely affect operating results in future periods.

In January 2001, Tumbleweed announced a restructuring of its business, which included a reduction in force and the closure of three international locations. Since that time Tumbleweed has reduced its work force from more than 400 employees to 134 employees and has engaged in other ongoing measures to reduce expenses and establish an enterprise that is appropriate for Tumbleweed’s expected revenue levels. The planning and implementation of these efforts have placed, and may continue to place, a significant strain on Tumbleweed’s managerial, operational, financial and other resources. Additionally, the actions undertaken to restructure the business may negatively affect Tumbleweed’s revenue stream, customer satisfaction, employee turnover, recruiting and retention of important employees. If Tumbleweed experiences difficulties in carrying out the restructuring, Tumbleweed’s expenses could increase more quickly than Tumbleweed expects. If Tumbleweed finds that the actions taken to date did not sufficiently decrease Tumbleweed’s expenses, Tumbleweed may find it necessary to implement further streamlining of Tumbleweed’s expenses, to perform additional reductions in Tumbleweed’s headcount or to undertake additional restructurings of Tumbleweed’s business.

The restructuring of Tumbleweed’s business has placed a strain on resources, which may render it more difficult to realize the benefits from business opportunities.

The restructuring of Tumbleweed’s business has placed and continues to place, a significant strain on managerial, informational, administrative and operational resources. Tumbleweed’s current systems, procedures and controls may not be adequate to achieve the rapid execution necessary to effectively operate within the market for its products and services. Tumbleweed needs to continue to enhance and improve its managerial capacity, and improve or replace its existing operational, customer service and financial systems, procedures and controls. Any failure to properly manage these systems and procedural transitions could impair Tumbleweed’s ability to attract and service customers, and could cause us to incur higher operating costs and delays in the execution of its business plan. Despite its restructuring, Tumbleweed expects that it may need to expand elements of its employee base on a selective basis. Tumbleweed’s

24

Table of Contents

management may not be able to hire, train, retain, motivate and manage required personnel. In addition, Tumbleweed’s management may not be able to successfully identify, manage and exploit existing and potential market opportunities. If Tumbleweed cannot manage its operations effectively, Tumbleweed’s business and operating results could suffer. Finally, Tumbleweed may have operational, customer service and financial systems that are not appropriate for Tumbleweed’s current estimated size. Moving to more appropriate office systems may also place a strain on Tumbleweed’s current systems and require financial expenditures to end the commitments on other systems.

Tumbleweed has a lengthy sales and implementation cycle, which increases the cost of completing sales and renders completion of sales less predictable.

If Tumbleweed is unable to license its services to new customers on a timely basis or if its existing and proposed customers and their end-users suffer delays in the implementation and adoption of its services, Tumbleweed’s revenue may be limited and business and prospects may be harmed. Tumbleweed’s customers must evaluate its technology and integrate its products and services into the products and services they provide. In addition, Tumbleweed’s customers may need to adopt a comprehensive sales, marketing and training program in order to effectively implement some of its products. Finally, Tumbleweed must coordinate with its customers using its product for third-party communications in order to assist end-users in the adoption of Tumbleweed’s products. For these and other reasons, the cycle associated with establishing licenses and implementing Tumbleweed’s products can be lengthy. This cycle is also subject to a number of significant delays over which Tumbleweed has little or no control. Forecasts about license revenue may be inaccurate as a result of any or all of these factors, and inaccurate forecasts may cause Tumbleweed’s business, or market valuation, to suffer.

Tumbleweed may be unable to adequately protect its intellectual property rights, and the inability to do so could render its products less desirable and adversely affect its operating results.

Tumbleweed currently relies on a combination of patents, trade secrets, copyrights, trademarks and licenses, together with non-disclosure and confidentiality agreements to establish and protect its proprietary rights in its products. Tumbleweed holds certain patent rights with respect to some of its products. Tumbleweed’s existing patents or trademarks, as well as any future patents or trademarks obtained by Tumbleweed, may be challenged, invalidated or circumvented, or Tumbleweed’s competitors may independently develop or patent technologies that are substantially equivalent or superior to its technology. Tumbleweed also relies on unpatented trade secrets and other unpatented proprietary information. Although Tumbleweed takes precautionary measures to maintain its unpatented proprietary information, others may acquire equivalent information or otherwise gain access to or disclose Tumbleweed’s proprietary information, and Tumbleweed may be unable to meaningfully protect its rights to its proprietary information as a result operating results will suffer.

Tumbleweed may be subject to claims of patent infringement, which could result in substantial costs to Tumbleweed and, if adversely determined, render Tumbleweed’s products less desirable or competitive or require Tumbleweed to obtain a license.

Third parties could assert patent or other intellectual property infringement claims against Tumbleweed, and the cost of responding to such assertions, regardless of their validity, could be significant. Tumbleweed may increasingly be subject to claims of intellectual property infringement as the number of its competitors grows and the functionality of their products and services increasingly overlap with Tumbleweed’s. In this regard, in September 2002 and February 2003, Tumbleweed received letters from Entrust, Inc. indicating that Tumbleweed may be interested in licensing the technology covered by various patents issued to Entrust. In October 2002, Tumbleweed sent a letter to Entrust indicating that Entrust may be interested in licensing the technology covered by various patents issued to Tumbleweed. Some element of Tumbleweed’s processes are or might be covered by any of these Entrust patents, Tumbleweed might seek to negotiate and obtain a license from Entrust. If Tumbleweed were unwilling or unable to obtain a license from Entrust, Tumbleweed would remain subject to potential liability for patent infringement, which could have a material adverse effect on Tumbleweed’s business and operating results.

25

Table of Contents

Tumbleweed is currently suing several third parties for patent infringement, which will result in substantial litigation costs and ultimately may not result in additional revenue to Tumbleweed or a favorable judicial determination.

Since 1999, Tumbleweed has aggressively pursued cases of potential infringement by third parties of the Tumbleweed patents and other intellectual property rights. In this regard, Tumbleweed is currently suing Yahoo!, E*Trade, Ticketmaster and Ameritrade, Inc. The enforcement process is costly and requires significant management attention. These costs generally are expensed during the period incurred, and the costs of pursuing the litigation may not be directly matched with the related licensing or settlement revenue, if any. In addition, Tumbleweed’s enforcement of its rights may increase the risk of adverse claims, with or without merit, which could be time consuming to defend, result in costly litigation, divert management’s attention and resources, limit the use of Tumbleweed’s services, or require Tumbleweed to enter into royalty or license agreements. In addition, such counter-claims asserted by these third parties may be found to be valid and could result in an injunction or damages against Tumbleweed. Tumbleweed’s ability to prevail in this litigation is inherently uncertain, and if Tumbleweed were subject to an adverse judicial determination, Tumbleweed’s ability to protect its products and to secure related licensing or settlement revenue could be lost.

If Tumbleweed does not provide adequate support services to its customers to implement its products, Tumbleweed may lose all or a portion of the revenue from these customers.

Tumbleweed’s professional services organization assists its customers in implementing its products through software installation, integration with existing customer systems, contract engineering, consulting and training. If the professional services organization does not adequately assess customer requirements or address technical problems, customers may seek to discontinue their relationships with us due to dissatisfaction with the product or Tumbleweed’s customer support. Furthermore, these customers may realize lower usage than they could have otherwise achieved because they did not fully capitalize on the product in ways that could have been addressed by Tumbleweed’s professional services organization. Tumbleweed’s products must be integrated with existing hardware and complex software products of its customers or other third parties, and its customers may not have significant experience with the implementation of products similar to Tumbleweed’s own. In addition, profitably providing contract engineering and integration services is an increasingly important aspect of Tumbleweed’s strategy to strengthen customer loyalty to its product and company. Therefore, Tumbleweed’s business and future prospects significantly depend on the strength of its professional services organization and its ability to leverage this organization by augmenting its reach through trained and qualified systems integrators. If Tumbleweed’s professional services organization does not adequately meet these multiple challenges, its business and prospects could suffer.

Product performance problems, system failures, and Internet problems could severely interrupt service and harm Tumbleweed’s reputation, which could adversely affect future revenue.

The ability of Tumbleweed’s customers to use its services depends on stable product performance, and the efficient and uninterrupted operation of the computer and communications hardware as well as the software and Internet network systems that they maintain. Although Tumbleweed’s ability to manage the effects of system failures which occur in computer hardware, software and network systems is limited, the occurrences of these failures could harm Tumbleweed’s reputation, business and prospects. The Internet has experienced a variety of outages and other delays as a result of damage to portions of Tumbleweed’s infrastructure, and the Internet could face similar outages and delays in the future. In addition, an increasing number of Tumbleweed’s customers require us to provide computer and communications hardware, software and Internet networking systems to them as an outsourced data center service. All data centers, whether hosted by Tumbleweed, its customers or by an independent third party to which it outsources this function, are vulnerable to damage or interruption from fire, flood, earthquake, power loss, telecommunications failure or other similar events.

If Tumbleweed’s software contains errors, Tumbleweed may lose customers or experience reduced market acceptance of its products.

Tumbleweed’s software products are inherently complex and may contain defects and errors that are detected only when the products are in use. In addition, some of Tumbleweed’s customers require or may require enhanced customization of Tumbleweed’s software for their specific needs, and these modifications may increase the likelihood of undetected defects or errors. Further, Tumbleweed often provides implementation, consulting and other technical services, the performance of which typically involves working with sophisticated software, computing and networking

26

Table of Contents

systems, and Tumbleweed could fail to meet customer expectations as a result of any defects or errors. As a result, Tumbleweed may lose customers, customers may fail to implement Tumbleweed’s products more broadly within their organization and Tumbleweed may experience reduced market acceptance of Tumbleweed’s products. Some of Tumbleweed’s products are designed to facilitate the secure transmission of sensitive business information to specified parties outside the business over the Internet. As a result, the reputation of Tumbleweed’s software products for providing good security is vital to their acceptance by customers. Tumbleweed’s products may be vulnerable to break-ins, theft or other improper activity that could jeopardize the security of information for which Tumbleweed is responsible. Problems caused by product defects, failure to meet project milestones for services or security breaches could result in loss of or delay in revenue, loss of market share, failure to achieve market acceptance, diversion of research and development resources, harm to Tumbleweed’s reputation, or increased insurance, service and warranty costs. To address these problems, Tumbleweed may need to expend significant capital resources that may not have been budgeted.

Failure to license necessary third party software incorporated in Tumbleweed’s products could cause delays or reductions in Tumbleweed’s sales.

Tumbleweed licenses third party software that Tumbleweed incorporates into its products. These licenses may not continue to be available on commercially reasonable terms, or at all. Some of this technology would be difficult to replace. The loss of any such license could result in delays or reductions of Tumbleweed’s applications until Tumbleweed identifies, license and integrate or develop equivalent software. If Tumbleweed is required to enter into license agreements with third parties for replacement technology, Tumbleweed could face higher royalty payments and Tumbleweed’s products may lose certain attributes or features. In the future, Tumbleweed might need to license other software to enhance its products and meet evolving customer needs. If Tumbleweed is unable to do this, Tumbleweed could experience reduced demand for its products.

Tumbleweed may be unable to recruit, retain and motivate qualified personnel, which could adversely affect product development and thereby limit future business opportunities.

Tumbleweed must continue to identify, recruit, hire, train, retain and motivate highly skilled technical, managerial, sales, marketing and customer service personnel. Competition for these personnel is intense, and Tumbleweed may not be able to successfully recruit, assimilate or retain sufficiently qualified personnel. In particular, Tumbleweed may encounter difficulties in recruiting a sufficient number of qualified software developers and sales personnel, and Tumbleweed may not be able to retain these employees. The failure to recruit and retain necessary technical, managerial, sales, merchandising, marketing and customer service personnel could harm Tumbleweed’s business and its ability to obtain new customers and develop new products. Although Tumbleweed has used and continue to use stock options as a retention tool, many of Tumbleweed’s employees hold stock options that are “underwater” (i.e., the market price of Tumbleweed’s stock is below their option exercise price), and these options may be ineffective as a retention tool. Tumbleweed’s employee turnover may increase if outstanding stock options continue to remain underwater and Tumbleweed does not adjust the option exercise prices. Any adjustment of stock option exercise prices may result in additional stock compensation expense, dilution to Tumbleweed’s stockholders and depress Tumbleweed’s stock price.

If Tumbleweed loses the services of executive officers or other key employees, Tumbleweed’s ability to develop its business and secure customer relationships will suffer.

Tumbleweed is substantially dependent on the continued services and performance of its executive officers and other key personnel. The loss of the services of any of Tumbleweed’s executive officers or other key employees could significantly delay or prevent the achievement of Tumbleweed’s development and strategic objectives. Tumbleweed does not have long-term employment agreements with any of Tumbleweed’s key personnel. The loss of services of any of Tumbleweed’s executive officers or other key personnel could significantly harm Tumbleweed’s business and prospects.

Tumbleweed’s efforts to establish, maintain and strengthen its brands will require significant expenditures and may not be successful.

If the marketplace does not associate Tumbleweed’s brands with high quality Internet communication services, it may be more difficult for us to attract new customers or introduce future products and services. The market for

27

Table of Contents

Tumbleweed’s services is new. Therefore, Tumbleweed’s failure to establish brand recognition at this stage could harm its ability to compete in the future with other companies that successfully establish a brand name for their services. Tumbleweed must succeed in its marketing efforts, provide high quality services and increase Tumbleweed’s user base in order to build its brand awareness and differentiate Tumbleweed’s products from those of its competitors. These efforts have required significant expenditures to date. Moreover, Tumbleweed believes that these efforts will require substantial commitments of resources in the future as Tumbleweed’s brands become increasingly important to its overall strategy and as the market for Tumbleweed’s services grows.

Tumbleweed’s allowance for doubtful accounts may be insufficient to cover receivables Tumbleweed is unable to collect, which would adversely affect future operating results.

Tumbleweed assumes a certain level of credit risk with its customers in order to do business. Conditions affecting any of Tumbleweed’s customers could cause them to become unable or unwilling to pay us in a timely manner, or at all, for products or services Tumbleweed has already provided them. For example, if the current economic conditions continue to decline or if new or unanticipated government regulations are enacted which affect Tumbleweed’s customers, they may be unable to pay their bills. In the past, Tumbleweed has experienced significant collection delays from certain customers, and Tumbleweed cannot predict whether it will continue to experience similar or more severe delays in the future. In particular, some of Tumbleweed’s customers are suffering from the general weakness in the economy and among technology companies in particular. Although Tumbleweed has established an allowance for doubtful accounts that it believes is sufficient to cover losses due to delays in or inability to pay and while it takes a consistently conservative position on the collectibility of receivables with respect to particular customers, Tumbleweed’s allowance for doubtful accounts may not be sufficient to cover its losses. If losses due to delays or inability to pay are greater than Tumbleweed’s allowance for doubtful accounts, Tumbleweed would be required to recognize an additional expense for the write-off and to increase Tumbleweed’s allowance for doubtful accounts, which could adversely affect its operating results.

Because Tumbleweed’s products utilize the Internet, if use of the Internet does not increase, or the architecture of the Internet is altered, the level of use of Tumbleweed’s products may not decline or not increase.

If the Internet and other products and services necessary for the utilization of Tumbleweed’s products are not sufficiently developed, fewer customers and end-users will use Tumbleweed’s products and its business will be harmed. In particular, the success of Tumbleweed’s products and services will depend on the development and maintenance of adequate Internet infrastructure, such as a reliable network backbone with the necessary speed, data capacity and other features demanded by users. Moreover, Tumbleweed’s success will also depend on the timely development of complementary products or services such as high-speed Internet connections for providing reliable access and services and this may not occur. Moreover, changes in the architecture of the Internet may limit the success of Tumbleweed’s products. Because the online exchange of information is new and evolving, the Internet may not prove to be a viable platform for secure messaging applications in the long term. The Internet has experienced, and is expected to continue to experience, significant growth in the numbers of users and amount of traffic. As the Internet continues to experience increased numbers of users and frequency of use, or if its users require increasingly more resources, the Internet infrastructure may not be able to support the demands placed on it. As a result, the performance or reliability of the Internet may be harmed. This in turn could decrease the level of Internet usage and also the level of utilization of Tumbleweed’s products and services.

Government regulation relating to the Internet may increase costs of doing business or require changes in Tumbleweed’s business model, which could increase Tumbleweed’s cost of doing business or decrease the demand for its products.

Tumbleweed is subject to regulations applicable to businesses generally and laws or regulations directly applicable to companies utilizing the Internet. Although at present there are relatively few specific laws and regulations directly applicable to the Internet, it is possible that a number of laws and regulations may be adopted with respect to the Internet. These laws could cover issues like user privacy, pricing, content, intellectual property, distribution, taxation, antitrust, legal liability and characteristics and quality of products and services. The adoption of any additional laws or regulations could decrease the demand for Tumbleweed’s products and services and increase Tumbleweed’s cost of doing business

28

Table of Contents

or otherwise harm Tumbleweed’s business or prospects. Delays in the enactment of expected regulations may result in delayed software purchasing by Tumbleweed’s customers who are subject to such regulations, which in turn may harm Tumbleweed’s business.

Moreover, the applicability to the Internet of existing laws in various jurisdictions governing issues like property ownership, sales and other taxes, libel and personal privacy is uncertain and may take years to resolve. For example, tax authorities in a number of states are currently reviewing the appropriate tax treatment of companies engaged in online commerce. New state tax regulations may subject us to additional state sales and income taxes. Any new legislation or regulation, the application of laws and regulations from jurisdictions whose laws do not currently apply to Tumbleweed’s business, or the application of existing laws and regulations to the Internet and commercial online services could harm Tumbleweed’s ability to conduct business and harm operating results.

If Tumbleweed may be unable to obtain necessary export approvals the market opportunity for Tumbleweed products would decline.

Exports of software products utilizing encryption technology are generally restricted by the U.S. and various foreign governments. All cryptographic products require export licenses from certain U.S. government agencies. We have obtained approval to export products using up to 128-bit symmetric encryption and 1024-bit public key encryption, including the products formerly named IME Server, IME Desktop, IME Receive Applet, IME Remote API using OmniORB with SSL, MMS WorldWide/56 and MMS Strong WorldWide/128. We are not exporting other products and services that are subject to export control under U.S. law. However, the list of products and countries for which export approval is required, and the related regulatory policies, could be revised, and Tumbleweed may not be able to obtain necessary approval for the export of future products. The inability to obtain required approvals under these regulations could limit Tumbleweed’s ability to make international sales. Furthermore, competitors may also seek to obtain approvals to export products that could increase the amount of competition Tumbleweed faces. Additionally, countries outside of the U.S. could impose regulatory restrictions impairing Tumbleweed’s ability to import its products into those countries.

Costs of communicating via the Internet could increase if access fees are imposed, which could adversely affect demand for Tumbleweed products or render them less competitive.

Certain local telephone carriers have asserted that the increasing popularity and use of the Internet has burdened the existing telecommunications infrastructure, and that many areas with high Internet use have begun to experience interruptions in telephone service. These carriers have petitioned the Federal Communications Commission to impose access fees on Internet service providers and online service providers. If these access fees are imposed, the costs of communicating on the Internet could increase substantially, potentially slowing the increasing use of the Internet. This could in turn decrease demand for Tumbleweed’s services or increase the costs of doing business.

Tumbleweed may have liability for Internet content, which could increase Tumbleweed’s costs of compliance or subject Tumbleweed to potential damages claims.

As a provider of Internet communication products and services, Tumbleweed faces potential liability for defamation, negligence, copyright, patent or trademark infringement and other claims based on the nature and content of the materials transmitted online. Any imposition of liability, particularly liability that is not covered by insurance or is in excess of insurance coverage, could be costly and could require us to implement measures to reduce exposure to this liability. This may require us to expend substantial resources or to discontinue selected service or product offerings.

We do not and cannot screen all of the content generated by users of Tumbleweed’s product but may be exposed to liability with respect to this content. Furthermore, certain foreign governments, such as Germany, have enforced laws and regulations related to content distributed over the Internet that are more strict than those currently in place in the U.S. Other countries, such as China, regulate or prohibit the transport of telephonic data in their territories. Failure to comply with regulations in a particular jurisdiction could result in fines or criminal penalties or the termination of service in one or more jurisdictions. Moreover, the increased attention focused on liability issues as a result of lawsuits and legislative proposals could impact the growth of Internet use. Liability insurance may not cover claims of these types, or may not be adequate to indemnify against all liability that may be imposed.

29

Table of Contents

A Tumbleweed subsidiary may have liability arising from indemnification obligations it may owe to a former officer who is being sued for breach of fiduciary duty.

On July 7, 2000, three complaints were filed by David H. Zimmer, Congressional Securities, Inc. and others against Interface Systems, Inc. (a company Tumbleweed acquired in 2000) and various additional defendants, including Interface’s prior president and chief executive officer, Robert A. Nero. Plaintiffs currently seek compensatory damages for losses resulting from not selling their Interface stock from March 14, 2000 to the end of March 2000 and for losses from purchases of Interface stock from March 14, 2000 through April 12, 2000. In March 2003, the court dismissed all claims against Interface and dismissed all claims against Mr. Nero, except a breach of fiduciary duty claim to the extent that claim arises from Michigan common law. In April 2003, Mr. Nero filed an answer and a counterclaim against Mr. Zimmer and Congressional Securities, Inc. seeking contribution and indemnity. Because Mr. Nero and Interface are parties to an indemnification agreement, Interface may incur vicarious liability if and to the extent that the court awards damages against Mr. Nero in this lawsuit. The accompanying financial statements do not include a reserve for any costs for damages, if any, that might result from this uncertainty. An adverse outcome could significantly harm Tumbleweed’s business and operating results.

Tumbleweed may be a defendant in a purported securities class action lawsuit which could divert management attention and resources or eventually expose Tumbleweed to liability.

An attorney issued a press release on March 7, 2003 stating that he had filed a purported securities class action lawsuit, alleging the violation of federal and state securities laws, on behalf of persons who acquired the common stock of Tumbleweed (other than purchasers of Tumbleweed’s initial public offering) from August 6, 1999 to October 18, 2000. Tumbleweed has not been served with a summons or a complaint with respect to this purported securities class action lawsuit. An adverse outcome could harm Tumbleweed’s business and operating results. Moreover, the costs in defending this lawsuit could harm future operating results.

Internet and technology related stock prices are especially volatile and this volatility may depress Tumbleweed’s stock price.

The stock market has experienced significant price and volume fluctuations and the market prices of securities of technology companies, particularly Internet-related companies, have been highly volatile. In the past, following periods of volatility in the market price of a company’s securities, securities class action litigation has often been instituted against companies. The institution of this type of litigation against Tumbleweed could result in substantial costs and a diversion of Tumbleweed’s management’s attention and resources, which could harm Tumbleweed’s business and prospects.

Tumbleweed’s certificate of incorporation and bylaws contain provisions that could discourage or prevent an acquisition of Tumbleweed, which could depress Tumbleweed’s stock price.

Tumbleweed’s certificate of incorporation and bylaws may inhibit changes of control that are not approved by its Board of Directors. These provisions could limit the price that investors might be willing to pay in the future for shares of Tumbleweed’s common stock. In particular, Tumbleweed’s certificate of incorporation provides for a classified Board of Directors and prohibits stockholder action by written consent. These provisions require advance notice for nomination of directors and stockholders’ proposals. In addition, as a Delaware corporation, we are subject to Section 203 of the Delaware General Corporation Law. In general, this law prevents a person who becomes the owner of 15% or more of the corporation’s outstanding voting stock from engaging in specified business combinations for three years unless specified conditions are satisfied. In addition, Tumbleweed’s certificate of incorporation allows its Board of Directors to issue preferred stock without further stockholder approval. This could have the effect of delaying, deferring or preventing a change in control. The issuance of preferred stock also could effectively limit the voting power of the holders of Tumbleweed common stock. The provisions of Tumbleweed’s certificate of incorporation and bylaws, as well as provisions of Delaware law, may discourage or prevent an acquisition or disposition of Tumbleweed’s business.

30

Table of Contents

Tumbleweed may not be able to maintain its listing on The Nasdaq National Market, and if Tumbleweed fails to do so, the price and liquidity of Tumbleweed’s common stock may decline.

The Nasdaq Stock Market has quantitative maintenance criteria for the continued listing of common stock on the Nasdaq National Market. The requirements include maintaining a minimum bid price per share of $1. As of May 12, 2003, Tumbleweed was in compliance with all Nasdaq National Market listing requirements. However, there have been recent periods when the closing bid price per share for Tumbleweed’s common stock has dropped below $1. Although Tumbleweed’s bid price has generally been above $1 per share, if the bid price of Tumbleweed’s common stock price slips below $1 per share for more than 30 trading days, Tumbleweed may be required to effect a reverse stock split or become subject to a delisting action of Tumbleweed’s common stock on The Nasdaq National Market. Tumbleweed may nonetheless be unable to comply with the quantitative maintenance criteria or any of The Nasdaq National Market’s listing requirements and other rules in the future. If Tumbleweed fails to maintain continued listing on The Nasdaq National Market and must move to a market with less liquidity, Tumbleweed’s financial condition could be harmed and its stock price may decline. If Tumbleweed were to be delisted, it could have a material adverse effect on the market price of, and the liquidity of the trading market for, Tumbleweed’s common stock.

ITEM 3— QUANTITATIVE AND QUALITATIVE DISCLOSURES ABOUT MARKET RISK

Tumbleweed currently does not use financial instruments to hedge operating expenses in Hong Kong, the Netherlands, Switzerland, or the United Kingdom denominated in the respective local currency. We assess the need to utilize financial instruments to hedge currency exposures on an ongoing basis.

Tumbleweed does not use derivative financial instruments for speculative trading purposes, nor do we hedge our foreign currency exposure in a manner that entirely offsets the effects of changes in foreign exchange rates. We regularly review our hedging program and may as part of this review determine at any time to change our hedging program.

Interest Rate Sensitivity

The primary objective of Tumbleweed’s investment activities is to preserve principal while at the same time maximizing the income we receive from our investments without significantly increasing risk. Some of the securities that we have invested in may be subject to market risk. This means that a change in prevailing interest rates may cause the fair value of the investment to fluctuate. For example, if we hold a security that was issued with a fixed rate equal to the then-prevailing interest rate and the prevailing interest rate later rises, the fair value of our investment will decline. To minimize this risk, we maintain our portfolio of cash equivalents in commercial paper and money market funds. In general, our investments are not subject to market risk because the interest paid on these funds fluctuates with the prevailing interest rate. As of March 31, 2003, none of our cash equivalents were subject to market risk.

ITEM 4— CONTROLS AND PROCEDURES

Evaluation of Disclosure Controls and Procedures

Our Chief Executive Officer and Chief Financial Officer have evaluated the effectiveness of our disclosure controls and procedures (as such term is defined in Rules 13a-14(c) and 15d-14(c) under the Securities Exchange Act of 1934, as amended (the “Exchange Act”)) as of a date within 90 days prior to the filing date of this quarterly report (the “Evaluation Date”). Based on such evaluation, such officers have concluded that, as of the Evaluation Date, our disclosure controls and procedures are effective in alerting them on a timely basis to material information relating to Tumbleweed (including our consolidated subsidiaries) required to be included in our reports filed or submitted under the Exchange Act.

31

Table of Contents

Changes in Internal Controls

Since the Evaluation Date, there have not been any significant changes to our internal controls or in other factors that could significantly affect these controls, including any corrective actions with regard to significant deficiencies and material weaknesses.

PART II—OTHER INFORMATION

ITEM 1— LEGAL PROCEEDINGS

On July 7, 2000, three complaints were filed by David H. Zimmer, Congressional Securities, Inc. and others against Interface Systems, Inc. (a company Tumbleweed acquired in 2000) and various additional defendants, including Interface’s prior president and chief executive officer, Robert A. Nero. Plaintiffs’ complaint currently seeks compensatory damages for losses resulting from not selling their Interface stock from March 14, 2000 to the end of March 2000 and for losses from purchases of Interface stock from March 14, 2000 through April 12, 2000. In March 2003, the court dismissed all claims against Interface and dismissed all claims against Mr. Nero, except a breach of fiduciary duty claim to the extent that claim arises from Michigan common law. In April 2003, Mr. Nero filed an answer and a counterclaim against Mr. Zimmer and Congressional Securities, Inc. seeking contribution and indemnity. Because Mr. Nero and Interface are parties to an indemnification agreement, Interface may incur vicarious liability if and to the extent that the court awards damages against Mr. Nero in this lawsuit. The accompanying financial statements do not include a reserve for any costs for damages, if any, that might result from this uncertainty as a loss is not probable or estimable. An adverse outcome could significantly harm Tumbleweed’s business and operating results.

An attorney issued a press release on March 7, 2003 stating that he had filed a purported securities class action lawsuit, alleging the violation of federal and state securities laws, on behalf of persons who acquired the common stock of Tumbleweed (other than purchasers of Tumbleweed’s initial public offering) from August 6, 1999 to October 18, 2000. Tumbleweed has not been served with a summons or a complaint with respect to this purported securities class action lawsuit. An adverse outcome could harm Tumbleweed’s business and operating results. Moreover, the costs in defending this lawsuit could harm future operating results.

Although Tumbleweed believes these lawsuits are without merit, no assurance can be given about their outcome, and an adverse outcome could significantly harm our business and operating results. Moreover, the costs in defending the lawsuits could harm future operating results.

In May 2002, Tumbleweed sued PayPal, Inc. alleging infringement of our U.S. Patent No. 5,790,790 and our U.S. Patent No. 6,192,407. In May 2002 PayPal filed an answer and counterclaims denying our allegations and seeking declarations from the court that our patents are not infringed and are invalid. In September 2002, we filed a First Amended Complaint that added eBay, Inc. as a defendant. Both PayPal and eBay filed an answer and counterclaims to the First Amended Complaint denying our allegations and seeking declarations from the court that our patents are not infringed and are invalid. In January 2003, we filed a Second Amended Complaint that added a cause of action against each of PayPal and eBay for infringement of our U.S. Patent No. 6,487,599, which the U.S. Patent and Trademark Office granted to us after we had filed the First Amended Complaint. Both PayPal and eBay filed an answer and counterclaims to the Second Amended Complaint denying our allegations and seeking declarations from the court that our patents are not infringed and are invalid. The litigation is proceeding and is currently in the claim construction phase.

In September 2002, Tumbleweed received a letter from Entrust, Inc. indicating that we may be interested in licensing the technology covered by U.S. Patent No. 6,393,568, Encryption and Decryption System and Method with Content Analysis Provision, issued to Entrust. In October 2002, we sent a letter to Entrust indicating that Entrust may be interested in licensing the technology covered by four patents issued to Tumbleweed. In February 2003, we received a letter from Entrust indicating that we may have an interest in three additional patents issued to Entrust.

Tumbleweed believes it does not infringe any valid Entrust patent. Moreover, in April 2003, Tumbleweed filed with the U.S. Patent and Trademark Office a request for interference with Entrust Patent No. 6,393,568. If we were to conclude based on additional information that some element of our processes are or might be covered by a valid Entrust patent, we might seek to negotiate and obtain a license from Entrust. If we were unwilling or unable to obtain a license from Entrust, we would remain subject to potential liability for patent infringement. Although we will contest any lawsuit

32

Table of Contents

by Entrust vigorously, we cannot make assurances that we will prevail if Entrust were to sue us for infringement of any of the Entrust patents. If any portions of our products were found to be infringing a valid Entrust patent, then we would likely be unable to continue to offer those portions of our products found to be infringing. We could also then be required to pay damages for past infringing use, possibly attorneys’ fees, and possibly treble damages. This could have a material adverse effect on our business prospects, financial condition, results of operations, and cash flows.

In September 2002, Tumbleweed sued Yahoo!, Inc., Yahoo, alleging infringement of our U.S. Patent No. 5,790,790 and our U.S. Patent No. 6,192,407. In January 2003, pursuant to a stipulation between the parties, we filed a First Amended Complaint to add a cause of action for infringement of an additional patent, U.S. Patent No. 6,487,599, which the U.S. Patent and Trademark Office granted to us after we had filed the original complaint, and to specifically allege that Yahoo had infringed and continues to infringe the asserted patents with its online financial service known as PayDirect. Yahoo filed an answer and counterclaims to the First Amended Complaint denying our allegations and seeking declarations from the court that our patents are not infringed and are invalid. In March 2003, we filed a Second Amended Complaint, naming HSBC Bank USA as a co-defendant, on the grounds that HSBC Bank USA and Yahoo are commercial partners in the accused online financial service, which they have jointly marketed as “Yahoo!PayDirect with HSBC.” In April 2003, HSBC Bank USA filed an answer to our Second Amended Complaint denying our allegations and seeking declarations from the court that our patents are not infringed and are invalid. The litigation is currently in the claim construction phase.

In October 2002, Tumbleweed sued E*Trade, Inc. alleging infringement of our U.S. Patent No. 6,192,407. In December 2002, before the defendant had filed an answer to our complaint, two of its service providers agreed to pay us on behalf of the defendant a significant initial amount and a royalty of four cents per delivery of electronic information using a personalized, trackable URL (as covered in the claims of our patent). After the initial payment was made, we dismissed the lawsuit.

In February 2003, Tumbleweed sued Ticketmaster alleging infringement of our U.S. Patent No. 5,790,790, our U.S. Patent No. 6,192,407, and our U.S. Patent No. 6,487,599. In March 2003 Ticketmaster filed an answer to our Complaint denying our allegations and seeking declarations from the court that our patents are not infringed and are invalid. This litigation is in its preliminary phases.

In February 2003, Tumbleweed sued Ameritrade, Inc. alleging infringement of our U.S. Patent No. 6,192,407. In March 2003, we filed a First Amended Complaint to add a cause of action for infringement of an additional patent, U.S. Patent No. 6,529,956, which the U.S. Patent and Trademark Office granted to us after we had filed the original complaint. In March 2003, Ameritrade, Inc. filed an answer to our First Amended Complaint denying our allegations and seeking declarations from the court that our patents are not infringed and are invalid. This litigation is in its preliminary phases.

ITEM 6— EXHIBITS AND REPORTS ON FORM 8-K

33

Table of Contents

On February 20, 2003, Tumbleweed filed a report on Form 8-K, which announced the signing of a definitive merger agreement with Valicert, Inc. A copy of Tumbleweed’s press release announcing the merger was attached thereto.

On March 6, 2003, Tumbleweed filed a report on Form 8-K, which disclosed the terms and conditions of the merger agreement with Valicert, Inc. A copy of the merger agreement was attached and incorporated by reference therein.

34

Table of Contents

SIGNATURES

Pursuant to the requirements of the Securities Exchange Act of 1934, the Registrant has duly caused this report to be signed on its behalf by the undersigned, hereunto duly authorized:

35

Table of Contents

CERTIFICATION

Pursuant to 18 U.S.C. Section 1350,

as adopted pursuant to Section 302 of the Sarbanes-Oxley Act of 2002

I, Jeffrey C. Smith, Chairman and Chief Executive Officer of Tumbleweed Communications Corp. (the “Company”), certify that:

Date: May 12, 2003

36

Table of Contents

CERTIFICATION

Pursuant to 18 U.S.C. Section 1350,

as adopted pursuant to Section 302 of the Sarbanes-Oxley Act of 2002

I, Gregory M. Capitolo, Senior Vice President—Finance and Chief Financial Officer of Tumbleweed Communications Corp. (the “Company”), certify that:

Date: May 12, 2003

37