Former Uber Security Head Found Guilty of Hiding Hack from Authorities

Uber’s former head of security, Joe Sullivan, has been found guilty on charges that he did not disclose a breach of customer and driver records to government regulators.

The New York Times reports that Joe Sullivan, the former security chief at ride-sharing giant Uber, was found guilty on Wednesday by a jury in federal court on charges that he failed to disclose a breach of customer and driver records to government regulators.

In 2016 the Federal Trade Commission investigated Uber over a breach of its online systems. During this time, Sullivan learned of a new breach that affected the Uber accounts of more than 57 million riders. The jury found Sullivan guilty of obstructing the FTC’s investigation and one count of misprision or acting to hide a felony from authorities.

The case appears to be the first time that a company executive faced criminal prosecution over a hack. Chinmayi Sharma, a scholar in residence at the Robert Strauss Center for International Security and Law and a lecturer at the University of Texas at Austin School of Law, commented: “The way responsibilities are divided up is going to be impacted by this. What’s documented is going to be impacted by this. The way bug bounty programs are designed is going to be impacted by this.”
David Angeli, a lawyer for Sullivan, commented: “While we obviously disagree with the jury’s verdict, we appreciate their dedication and effort in this case. Mr. Sullivan’s sole focus — in this incident and throughout his distinguished career — has been ensuring the safety of people’s personal data on the internet.”

Uber has suffered additional data breaches since the hack that led to charges against Sullivan. Breitbart News reported in September on the latest hack suffered by the company.

The Verge reports that Uber claims to be investigating a “cybersecurity incident” following reports that the company’s internal systems have been breached. The alleged hacker claims to be 18 years old and says that they have access to company tools including Amazon Web Services and Google Cloud Platform. The New York Times reports that Uber has taken multiple internal systems offline, including Slack.

An Uber spokesperson said that the company declined to answer additional questions and pointed to its public statement on Twitter: “We are currently responding to a cybersecurity incident. We are in touch with law enforcement and will post additional updates here as they become available,” the statement said.

Colton Seal, the CEO and co-founder of Routefusion, tweeted a screenshot of what appears to be Uber’s internal Slack chat where the hacker announced themself to employees.

Many employees were reportedly so shocked by the message from the hacker that they assumed it was a joke. Employee responses ranged from lighthearted emoji reactions to an “it’s happening” GIF. One unnamed employee stated that staff were interacting with the hacker thinking it was a joke.