According to The U.S. Department of Justice (DOJ), a "federal jury convicted Joseph Sullivan, the former Chief Security Officer of Uber Technologies, of obstruction of proceedings of the Federal Trade Commission (FTC) and misprision of felony in connection with his attempted cover-up of a 2016 hack of Uber." Sullivan was subsequently convicted of obstructing justice and concealing knowledge that a federal felony had been committed. He was sentenced to serve a three-year term of probation and ordered to pay a fine of $50,000.
The DOJ continued, saying that "Sullivan was hired soon after the FTC investigation launched, and he participated in Uber's response to that investigation, including its efforts to comply with investigative demands issued by the FTC. Among other things, Sullivan participated in a presentation to the FTC in March 2016 regarding Uber’s cybersecurity program, and he testified under oath in November 2016." During the trial, it was determined that "ten days after his sworn FTC testimony, Sullivan learned that Uber had been hacked again. Furthermore, the hackers had exploited the same vulnerability that had led to the 2014 breach. Unlike the 2014 breach, however, the data stolen in 2016 was massive in scale and included records associated with approximately 57 million Uber users and drivers. Despite having testified regarding that same security vulnerability and related issues ten days prior, Sullivan executed a scheme to prevent any knowledge of the breach from reaching the FTC."
Sullivan appealed the case to the United States Court of Appeals for the Ninth Circuit. The panel affirmed Sullivan's jury conviction for both charges.
