Former Uber Chief Security Officer convicted for data breach coverup

SAN FRANCISCO – Former Uber Chief Security Officer Joseph Sullivan was convicted by a federal jury this week for his role in covering up a 2016 data breach of the company.

Sullivan was found guilty of obstruction of proceedings of the Federal Trade Commission (FTC) and misprision of felony in connection with his cover up efforts regarding the 2016 hack. United States Attorney Stephanie M. Hinds and FBI Special Agent in Charge Robert K. Tripp made the announcement after a four-week trial.

“Technology companies in the Northern District of California collect and store vast amounts of data from users,” said Hinds. “We expect those companies to protect that data and to alert customers and appropriate authorities when such data is stolen by hackers. Sullivan affirmatively worked to hide the data breach from the Federal Trade Commission and took steps to prevent the hackers from being caught. We will not tolerate concealment of important information from the public by corporate executives more interested in protecting their reputation and that of their employers than in protecting users. Where such conduct violates the federal law, it will be prosecuted.”

“The message in today’s guilty verdict is clear: companies storing their customers’ data have a responsibility to protect that data and do the right thing when breaches occur,” Tripp said following up. “The FBI and our government partners will not allow rogue technology company executives to put American consumers’ personal information at risk for their own gain."

Response to the verdict in the security community is mixed with commentators taking to social in some cases to express concern with the verdict:

. . . , and the head of the company’s communications team had details as well."

Y'all. That is the opposite of quietly and covertly covering up a thing so no one knows. That is how the process works. How is any CISO supposed to go forward at this point?

— H. Poteat (@NSQE) October 5, 2022

Others find reactions to the verdict to be somewhat overblown and have decried sensationalism for what is a reasonable outcome for the trial considering the evidence.

The press coverage on the Joe Sullivan/Uber outcome is driving me nuts. They’re sinking their teeth into a bunch of red herring issues that will drive panic in the security community. https://t.co/ThefHkeW8P

— Whitney Merrill (@wbm312) October 6, 2022

Currently Sullivan remains free on bond pending his sentencing which will occur at a later date. Sullivan faces a possible maximum of five years in prison for the obstruction charge and three for the charge of misprision.