Examining the Consequences: Former Uber CISO Avoids Jail Time for 2016 Data Breach

Uber‘s former chief information security officer, Joseph Sullivan, was sentenced on May 4 to three years of probation, 200 hours of community service, and a $50,000 fine for his part in covering up a 2016 data breach that exposed data on over 50 million customers. Sullivan was found guilty last October on two felony counts related to the breach, one of which was concealing it from the Federal Trade Commission (FTC) during their investigation of an earlier 2014 breach at Uber. Sullivan purposefully withheld and concealed the 2016 breach from the FTC, even as he gave sworn testimony to them about the 2014 breach. He also paid $100,000 to the two hackers responsible for the breach through Uber‘s official bug bounty program and had them sign a supplemental nondisclosure agreement to buy their silence. Prosecutors argued for a 15-month prison term for Sullivan, but Judge William Orrick decided on a probationary sentence, stating that Sullivan was lucky to escape jail time due to the unusual circumstances of the case.

The sentence has received mixed reactions from the cybersecurity community. Some industry insiders see Sullivan as the fall guy for a broader security failure at Uber, while others believe the sentence does not go far enough to deter similar behaviour by corporate executives. Orrick himself made it clear that other cybersecurity leaders would not be so fortunate if they committed a similar offence before him. He noted that the decision not to send Sullivan to jail was not based on the character of the individual but rather the exceptional circumstances of the case.

This case highlights the crucial role of CISOs in organisations in preventing and responding to data breaches. It is a reminder that cybersecurity is a team sport that involves multiple executives and requires a cohesive approach to effective risk management. It is also important for CISOs to have a contingency plan in place before a breach occurs to limit the financial and operational fallout from the incident. Speaking about the case, Avishai Avivi, CISO at SafeBreach, said that it was an appropriate sentence, considering Sullivan’s contributions to the public and the information security field but also noted that Uber‘s former CEO, Travis Kalanick, was “just as culpable” as Sullivan.

In conclusion, the consequences of not reporting a data breach are severe, but concealing it is worse. The Sullivan case emphasises the importance of transparency in breach response and the role that CISOs play in limiting the damage to organisations. It also highlights the critical need for executives to act ethically and legally, even when under pressure, to protect their businesses and customers from the risks of cybersecurity threats. Organizations must ensure that cybersecurity is a top priority for their leadership teams and that they have a robust plan in place to respond effectively to breaches.

Legal Justice-cybersecurity,databreach,Uber,consequences,CISO,jailtime