Security News > 2022 > October > Former Uber CSO convicted for concealing data breach, theft from the authorities

Joe Sullivan, the former Chief Security Officer of Uber, has been convicted of obstruction of proceedings of the Federal Trade Commission and misprision of felony in connection with the attempted cover-up of the hack Uber suffered in 2016.

"In the wake of that disclosure, the FTC's Division of Privacy and Identity Protection embarked on an investigation of Uber's data security program and practices. In May 2015, the month after Sullivan was hired, the FTC served a detailed Civil Investigative Demand on Uber, which demanded both extensive information about any other instances of unauthorized access to user personal information, and information regarding Uber's broader data security program and practices."

On November 4, 2016, Sullivan testified before the FTC under oath, and delineated the steps Uber had taken to keep customer data secure.

"Exactly ten days after his FTC testimony, Sullivan learned that Uber had been hacked again. The hackers reached out to Sullivan directly, via email, on November 14, 2016. The hackers informed Sullivan and others at Uber that they had stolen a significant amount of Uber user data, and they demanded a large ransom payment from Uber in exchange for their deletion of that data," the DoJ added.

According to the DoJ, "The evidence showed that, despite knowing in great detail that Uber had suffered another data breach directly responsive to the FTC's inquiry, Sullivan continued to work with the Uber lawyers handling or overseeing that inquiry, including the General Counsel of Uber, and never mentioned the incident to them."

After Dara Khosrowshahi became CEO of Uber in August 2017, Sullivan "Lied, falsely telling the CEO that the hackers had only been paid after they were identified and deleting from a draft summary prepared by one of his reports that the hack had involved personally identifying information and a very large quantity of user data. Sullivan lied again to Uber's outside lawyers conducting an investigation into the incident. Nonetheless, the truth about the breach was ultimately discovered by Uber's new management, which disclosed the breach publicly, and to the FTC, in November 2017.".

News URL

https://www.helpnetsecurity.com/2022/10/06/former-uber-cso-convicted/