by Uber former chief of security Joe Sullivan won’t go to jail for covering up a data breach affected more than 50 million Uber drivers and carpool users. Last year, a jury found Sullivan guilty of obstructing an ongoing FTC investigation, as well as concluding he was guilty of concealing the 2016 Uber data breach, but a judge sentenced Sullivan to three years probation and 200 hours of labor. public good, like axis report.
In case you lost it:
Although Sullivan won’t go to jail for covering up a data breach, axis notes that the sentencing and punishment of Sullivan could be the first time a chief information security officer (CISO) has faced criminal charges for “mishandling a data breach”. But the term “mishandling” is somewhat of a misnomer, making subsequent probation seem a bit lightly.
Not only did Sullivan cover up the data breach, but he also gave the hackers $100,000 to keep the breach quiet. Sullivan and his team passed the payment through Uber’s bug bounty program.
The overall case is something landmark that could set a precedent for cybersecurity in the United States in the future. That may be why the judge who sentenced Sullivan received 186 letters defending the former Uber security chief, including one from Former Uber CEO Travis Kalanick. Some of the other letters were from CISOs, who feared that having Sullivan in jail meant they too would go to jail.
Uber data breach occurred in 2016 according to by Kalanick term, but it was not publicly disclosed until the following year, 2017. That same year, Kalanick resigned and Dara Khosrowshahi become the next CEO of Uber. Khosrowshahi fired Sullivan in 2017 and will later testify that he thought covering up the data breach was the “wrong decision”.
Sullivan continued to lead the cybersecurity team at Cloudflare from 2018 to 2022, stepping down only when — I can’t stress this enough — chief protect office staff to prepare for the above test One network security criminal. Prosecutors asked the court to sentence Sullivan to 15 months in prison time, but Sullivan was given three years’ probation and 200 hours of community service. Who knows, maybe Sullivan will teach ethics or cybersecurity classes as part of a court-mandated service.
