Mike Johnson – DigiCert Inc.

Sometimes the minnow swallows the whale. Metaphorically that is, which was the case in 2017 when DigiCert Inc. absorbed a couple of segments of a company four times its size.

Quite the complex transaction with minimal indigestion, says Mike Johnson, the general counsel and corporate secretary who had come aboard one year earlier. At that time DigiCert was a competitor to Symantec Corp.’s certificate authority business, advancing quickly but still much smaller in size, with two operations in Utah.

But a big fish it was intent on being, and became that way by acquiring parts of Symantec, a cybersecurity software and services heavyweight based in Mountain View, California, with offices around the globe.

In the process, DigiCert resolved a headache for Symantec, which was involved in a dispute with Google over the operations of its certificate business.

Both companies having gotten what they needed, it was the best outcome for a deal of this magnitude, says Johnson, who helped enable the process with his mix of legal, business and soft skills garnered in previous in-house roles at Amazon and Splunk, and from his early years with law firms.

Temperament matters

“My role was to coordinate and advocate on behalf of our stakeholders—our employees, customers and partners; and the executive team and the investors—who weren’t always in consensus,” Johnson tells Vanguard in March from DigiCert headquarters in the Salt Lake City suburb of Lehi. “We tried to harmonize our approach and ensure with outside counsel [Kirkland & Ellis and Baker McKenzie] that the legal agreements we entered into—of which there were many—reflected those harmonized positions.”

Though there could be strong feelings on both sides of the table, Johnson says a scorched-earth strategy could have gotten this new relationship off to a bad start to everyone’s detriment. DigiCert and Symantec, after all, would continue to collaborate during a year of transition that has left the former poised to grow, while the latter focuses on its remaining business units.

“When someone on the company or investor side wanted to dig their heels in, we’d try to understand what motivated their position and then highlight the long-term ramifications of taking an extreme position,” Johnson says.

A couple of years later, there seems to be a bridge in place to further DigiCert’s growth, Johnson helping the company in 2018 complete a more modest acquisition, the $45 million deal for the Swiss-headquartered trust service provider QuoVadis.

Between this latest acquisition and new R&D efforts into future-proof security concepts like preparing for the advent of quantum computing, DigiCert is charting new ground. The company aligns to a philosophy of having the best global technology and people, coupled with localized expertise that understands the market needs of say, Europe, with a unique lens. It’s a powerful combination.

Ever the opportunist and having become something of a whale by now, DigiCert remains on the lookout for further targets. Johnson stands by readily, though in the meantime he and his team have their hands full dealing with the consequences of DigiCert growing from those two Utah operations to other U.S. locations and branches in Australia, Britain, Ireland, Japan, South Africa and Switzerland, among other countries.

A growing team

Head of just a two-person legal department in 2016, Johnson now oversees a widely disbursed team of 15 legal professionals with another soon to be welcomed into the fold. Each country, he explains, has its own rules, regulations and local customs, particularly around intellectual property protection.

“One of my best hires” he says of Aaron Olsen, who for the past year has acquitted himself as DigiCert’s data privacy officer as well advising on personnel matters. Olsen was even ahead of the game on the European Union’s year-old General Data Protection Regulation, finding ways for DigiCert to apply a “privacy by design” approach to its product development cycles.

“We’ve turned what many had perceived as a challenge—GDPR compliance—into a selling point,” Johnson says. “We can confidently say we are the market leaders for our industry when it comes to data privacy matters.”

The business of providing digital security to corporate clients figures only to grow, the need for data privacy expanding exponentially with each new internet device and the bad publicity any company can expect if breached. And nowadays it’s not just person-to-person communication; connected machines also exchange sensitive information and DigiCert has the means to safeguard such correspondence.

Other matters on Johnson’s plate include corporate governance, equity administration, and inbound and outbound licensing duties. But no matter how Johnson’s legal staff grows, he’ll continue his “in the weeds” approach.

“You won’t find me in an ivory tower pondering legal theory,” the 2009 Georgetown University law grad says with a laugh. “It’s a nimble business where we have to pivot quickly to keep up with our business partners. There’s no shortage of things to do; the most important part of my job is deciding how legal time is best spent.”

However, he’s glad he no longer has to bill for those hours. Just 37, Johnson was able to leave that part of legal life behind in 2013 after stretches of a couple of years each with Simpson Thacher & Bartlett and Kirkland & Ellis. He’d serve as an Amazon corporate counsel in Seattle from 2013 to 2015, then do a little over a year as a product and commercial counsel for Splunk in the Bay Area.

“In-house you get the best of both worlds,” says the married father of three young children. “You partner with people intent on growing the business and you have a buffet of excellent outside legal providers who are subject matter experts and can give stitch-in-time advice.”

He’ll also keep familiarizing himself with DigiCert’s very complex wares. A poli-sci major and Spanish minor as a Brigham Young undergrad, Johnson can’t claim formal credentials in technology, but has proven adept at learning on the job.

“I’ve tried to get neck-deep in our products and technology so I can understand why our customers buy them and what we do to differentiate ourselves from our competitors,” he says. “It gives me the right lenses to do the appropriate legal analysis when issues or opportunities arise. It also helps me ferret out the non-issues.”