Joseph Sullivan, Uber’s former chief security officer, has been sentenced to three years probation for obstructing an investigation into a cyber-attack. Sullivan was found guilty of paying hackers $100,000 to keep quiet about the breach of 57 million customer records in November 2016.
The hackers were paid under the guise of a “bug bounty” – a reward used to pay cybersecurity researchers who disclose vulnerabilities so they can be fixed. Sullivan must also pay a fine of $50,000 and serve 200 hours of community service. Prosecutors had originally requested a 15-month prison sentence for Sullivan.
According to the US Department of Justice (DoJ), the hackers contacted Sullivan. They told him they had stolen a large amount of data, including the records of 57 million Uber users and 600,000 driving license numbers. Sullivan arranged for the hackers to be paid in exchange for their silence. The hackers subsequently faced conspiracy charges in 2019 and pleaded guilty.
Despite Sullivan’s conviction, the judge, William Orrick, decided to show him leniency, stating that he was doing so because this was the first case of its kind and because of Sullivan’s character. He also warned that if similar issues arise in the future, people should expect to spend time in custody.
The case has highlighted the issue of companies paying hackers to keep quiet about data breaches, which is not an acceptable practice. The incident also raises concerns about the protection of user data and the role of companies in reporting cyber-attacks. The case is expected to have implications for how companies handle data breaches and the consequences for executives involved in cover-ups.
The case of Joseph Sullivan has brought attention to the ongoing issue of cybersecurity and data protection in today’s digital age. The consequences of such breaches can be severe, leading to financial loss, identity theft, and reputational damage to both individuals and companies. In recent years, several high-profile companies have faced similar cyber-attacks, including Equifax, Yahoo, and Marriott.
The Uber case has highlighted the importance of transparency and prompt reporting of such incidents, as it took Uber over a year to disclose the breach. The handling of the situation has also raised concerns about the role of executives in cover-ups, with Sullivan’s conviction being a warning to others that such actions will not go unpunished.
The case has also raised questions about the ethics of paying hackers to keep quiet about data breaches, as this can incentivize further attacks and undermine cybersecurity efforts. It is important for companies to prioritize the protection of customer data and take swift action in response to breaches, rather than attempting to conceal the issue.
Overall, the case of Joseph Sullivan serves as a reminder of the need for greater vigilance and transparency in the field of cybersecurity and the potential consequences of failing to do so. It is essential for companies to prioritize data protection and take all necessary measures to prevent, detect, and respond to cyber-attacks.