Former Uber Security Chief Convicted of Data Hack Coverup

    Former security chief of Uber was convicted of concealing a massive data breach. Know details.
    By: BLOOMBERG
    | Updated on: Oct 06 2022, 22:52 IST
    Most affordable electric car in India? Tata Tiago EV launched; Check price, specifications
    Tata Tiago EV
    1/6 The Tata Tiago EV (electric vehicle) was just launched officially on September 28. This is Tata’s first electric hatchback and only the fourth electric vehicle to come out of the Tata Motors camp. The other three EV in Tata’s arsenal include Nexon EV, Nexon EV Max and Tigor EV. (REUTERS)
    Tata Tiago EV
    2/6 The Tata Tiago EV has a starting price of Rs. 8.49 lakh (ex-showroom) as per its introductory offer and this has made the car the most affordable mass-market electric car in the country. It should be noted that the introductory offer is available only for the first 10000 orders. (Tata Motors)
    Tata Tiago
    3/6 The Tata Tiago EV comes with two battery options of 19.2 kWh and 24 kWh. While the former can last up to 250 kilometers, the latter gives a range of 315 kilometers. (Representational Image) (Tata Motors)
    image caption
    4/6 Tata Tiago EV also comes with fast charging support and using that, you can go from 10 to 80 percent in 57 minutes. (AP)
    image caption
    5/6 The EV also gets automatic climate control, rain-sensing wipers, cruise control, eight-speaker Harman sound system, connected car technology and more. (REUTERS)
    image caption
    6/6 Tata Tiago EV comes with Teal Blue, Daytona Grey, Pristine White, Midnight Plum and Tropical Mist. (AP)
    Uber
    View all Images
    The trial featured almost four weeks of testimony that explored cyber security management as well as a shakeup at Uber in 2017.  (REUTERS)

    Uber Technologies Inc.'s former security chief was convicted of concealing a massive data breach in a case that prosecutors tied to the company's troubled past under its original leadership.

    Joe Sullivan was found guilty in San Francisco federal court Wednesday by a jury which rejected his claim that other executives at the ride-hailing giant were aware of the 2016 hack and were responsible for it not being disclosed to regulators for more than a year.

    The trial featured almost four weeks of testimony that explored cyber security management as well as a shakeup at Uber in 2017 when a series of scandals drove co-founder Travis Kalanick out as chief executive officer.

    Sullivan was convicted of both charges against him, obstructing a government investigation and concealing the theft of personal data of 50 million customers and 7 million drivers.

    Sullivan, a former federal prosecutor who previously headed security for Facebook, is well-known for his expertise in the field in Silicon Valley. He faces as long as eight years in prison, though his sentence will likely be far less.

    “While we obviously disagree with the jury's verdict, we appreciate their dedication and effort in this case. Mr. Sullivan's sole focus -- in this incident and throughout his distinguished career -- has been ensuring the safety of people's personal data on the internet,” said David Angeli, a lawyer for Sullivan. “We will evaluate next steps in the coming days.“

    Companies are required under state and federal laws to promptly disclose data breaches. Uber's mishandling of the 2016 attack on its servers resulted in the company paying $148 million in a settlement with all 50 states, which at the time was the biggest data-breach payout in US history. Uber had previously been reprimanded by the Federal Trade Commission over a similar data breach from 2014.

    “Sullivan affirmatively worked to hide the data breach from the Federal Trade Commission and took steps to prevent the hackers from being caught,” Stephanie Hinds, US attorney for San Francisco, said in an emailed statement. “We will not tolerate concealment of important information from the public by corporate executives more interested in protecting their reputation and that of their employers than in protecting users.”

    Sullivan was accused of quietly arranging for Uber to pay the hackers $100,000 in Bitcoin to delete the stolen data under the guise of a program used to reward security researchers for identifying vulnerabilities, known as a “bug bounty.” In return, the two hackers agreed not to disclose that they had stolen the data. The hackers later pleaded guilty for their role in the incident.

    The October 2016 hack stayed secret until the following November when it was disclosed by the new CEO, Dara Khosrowshahi, about three months into his tenure. At the same time, he fired Sullivan.

    Khosrowshahi testified that after discovering inconsistencies in Sullivan's account of what happened, he decided it was time to replace his security chief. “I couldn't trust his judgment anymore,” he said.

    Sullivan's defense was that Uber's legal department and other managers were aware of the incident before it blew up publicly.

    Angeli challenged the notion of a coverup by pointing to Sullivan's sharing of information with numerous employees, before Khosrowshahi arrived at the company. Jurors were shown a 1:24 a.m. text that Sullivan sent to Kalanick describing the breach less than 12 hours after it happened.

    “Remember, Mr. Kalanick is the top person at Uber,” Angeli said at closing arguments. “Mr. Sullivan could not have reported this to someone higher up at the company.”

    Prosecutors argued that Sullivan, who joined Uber in 2015, was well aware of the requirements to disclose the breach, especially after the company's dealings with the FTC over the 2014 hack.

    Sullivan, who was supposed to have improved security after the earlier breach, didn't want the details of the new hack to get out because it would have hurt his reputation, prosecutor Ben Kingsley told jurors.

    Rather than disclose it, Sullivan “prioritized his reputation, and the company's reputation, over his obligations,” he said.

    Sullivan didn't testify, nor did Kalanick.

    The case is U.S. v. Sullivan, 20-cr-00337, U.S. District Court, Northern District of California (San Francisco).

    Follow HT Tech for the latest tech news and reviews , also keep up with us on Twitter, Facebook, Google News, and Instagram. For our latest videos, subscribe to our YouTube channel.

    First Published Date: 06 Oct, 22:52 IST
    NEXT ARTICLE BEGINS
    keep up with tech