Joseph Sullivan, Obstruction of Justice, California 2023

Former Uber Chief Security Officer Charged with Obstruction of Justice

SAN FRANCISCO – Joseph Sullivan, the former Chief Security Officer for Uber, has been charged with obstruction of justice and misprision of a felony in connection with the attempted cover-up of the 2016 hack of Uber Technologies Incorporated.

According to the complaint, between April 2015 and November 2017, Sullivan served as Uber’s Chief Security Officer. During this time, two hackers contacted Sullivan by email and demanded a six-figure payment in exchange for silence. The hackers ultimately revealed that they had accessed and downloaded an Uber database containing personally identifying information, or PII, associated with approximately 57 million Uber users and drivers.

The database included the drivers’ license numbers for approximately 600,000 people who drove for Uber. The criminal complaint alleges that Sullivan took deliberate steps to conceal, deflect, and mislead the Federal Trade Commission about the breach.

“Silicon Valley is not the Wild West,” said U.S. Attorney David L. Anderson. “We expect good corporate citizenship. We expect prompt reporting of criminal conduct. We expect cooperation with our investigations. We will not tolerate corporate cover-ups. We will not tolerate illegal hush money payments.”

“Concealing information about a felony from law enforcement is a crime,” said FBI Deputy Special Agent in Charge Craig D. Fair. “While this case is an extreme example of a prolonged attempt to subvert law enforcement, we hope companies stand up and take notice. Do not help criminal hackers cover their tracks. Do not make the problem worse for your customers, and do not cover up criminal attempts to steal people’s personal data.”

The complaint describes how Sullivan played a pivotal role in responding to FTC inquiries about Uber’s cyber security. Uber had been hacked in September of 2014 and the FTC was gathering information about that 2014 breach. The FTC demanded responses to written questions and required Uber to designate an officer to provide testimony under oath on a variety of topics. Sullivan assisted in the preparation of Uber’s responses to the written questions and was designated to provide sworn testimony on a variety of issues.

On November 14, 2016, approximately 10 days after providing his testimony to the FTC, Sullivan received an email from a hacker informing him that Uber had been breached again. Sullivan’s team was able to confirm the breach within 24 hours of his receipt of the email. Rather than report the 2016 breach, Sullivan allegedly took deliberate steps to prevent knowledge of the breach from reaching the FTC.

Defendant: Joseph Sullivan

Criminal Charges: Obstruction of justice and misprision of a felony

City and State: San Francisco, California

Exact Date: Not specified

Sentence or Outcome: Currently pending

Dollar Amounts: $100,000 (payment to hackers in BitCoin)

Source: https://www.justice.gov/usao-ndca/pr/former-chief-security-officer-uber-charged-obstruction-justice