Uber’s former head of safety has been convicted of protecting up a 2016 knowledge breach on the rideshare large, hiding particulars from US regulators and paying off a pair of hackers in return for his or her discretion.
The trial, carefully watched in cyber safety circles, is believed to be the primary felony prosecution of an organization government over the dealing with of an information breach.
Joe Sullivan, who was fired in 2017 over the incident, was discovered responsible on Tuesday by a San Francisco jury of obstructing an investigation by the Federal Commerce Fee. On the time of the 2016 breach, the regulator had been investigating the car-booking service over a distinct cyber safety lapse that had occurred two years earlier.
Jurors additionally convicted Sullivan of a second depend associated to having information of however failing to report the 2016 breach to the suitable authorities authorities.
The incident finally turned public in 2017 when Dara Khosrowshahi, who had simply taken over as chief government, disclosed particulars of the assault.
Prosecutors stated Sullivan had taken steps to verify knowledge compromised within the assault wouldn’t be revealed. In accordance with court docket paperwork, two hackers approached Sullivan’s workforce to inform Uber of a safety flaw that uncovered the private info of just about 60mn drivers and riders on the platform.
The hackers, one in every of whom testified through the trial, turned down the corporate’s supply of $10,000 — the utmost payout beneath Uber’s “bug bounty” coverage designed to encourage personal disclosure of safety flaws — and threatened to launch the information if a bigger price was not paid.
The events negotiated a $100,000 cost, which required signing a non-disclosure settlement and a dedication to delete any person knowledge that had been obtained. The 2 hackers later pleaded responsible to the assault.
Legal professionals for Sullivan defended his actions in court docket, saying he had acted to guard customers and had notified his superiors — together with then-CEO Travis Kalanick — of the information breach.
The consequence will ship shockwaves via the cyber safety trade, elevating questions over who ought to take accountability when damaging breaches happen.
“This verdict is misplaced,” stated Katie Moussouris, founder and chief government of Luta Safety, which specialises in managing “bug bounty” programmes for giant organisations. “The function of chief safety officer can not turn out to be chief sacrificial officer if we would like these roles to be efficient.”
Uber didn’t reply to requests for remark.
“Sullivan affirmatively labored to cover the information breach from the Federal Commerce Fee and took steps to stop the hackers from being caught,” stated Stephanie Hinds, US lawyer for the northern district of California, in a press release.
“We won’t tolerate concealment of vital info from the general public by company executives extra eager about defending their fame and that of their employers than in defending customers,” she added.
Sullivan, a former authorities prosecutor specialising in cyber crime, has beforehand labored at Fb and Cloudflare.
A date for his sentencing has not but been set. He might resist eight years in jail.
