Former Uber security chief Joseph Sullivan sentenced to probation, fined $50k, and community service for covering up a cyber-attack. |
Former Uber Security Chief Sentenced to Probation for Covering Up Cyber-Attack
Table Of Content
- The Crime
- The Hack
- Conclusion
The Crime
Joseph Sullivan, the former chief security officer of Uber, has been sentenced to three years probation for hiding a cyber-attack from authorities. He was found guilty of paying hackers $100,000 to keep quiet after they accessed 57 million records of Uber customers, including their names and phone numbers.
Sullivan must also pay a fine of $50,000 and serve 200 hours of community service. Prosecutors had originally asked for a 15-month prison sentence. Sullivan was also found guilty of obstructing an investigation from the Federal Trade Commission.
The Hack
Sullivan became Uber's chief security officer in 2015. In November 2016, the hackers who targeted Uber emailed Sullivan and told him they had stolen a large amount of data, which they would delete in return for a ransom. Staff working for Sullivan confirmed that data, including records of 57 million Uber users and 600,000 driving license numbers, had been stolen.
According to the US Department of Justice (DOJ), Sullivan arranged for the hackers to be paid $100,000 in exchange for them signing non-disclosure agreements to not reveal the hack to anyone. The hackers were paid in December 2016, disguised as a bug bounty - a reward used to pay cyber-security researchers who disclose vulnerabilities so they can be fixed. The hackers subsequently faced conspiracy charges in 2019 and pleaded guilty.
According to the Wall Street Journal, Judge William Orrick said he was showing Sullivan leniency partly because this was the first case of its kind, but also because of his character. However, he warned that anyone else who commits a similar crime should expect to spend time in custody, regardless of anything. It is important to remember that cyber-attacks are illegal and can have serious consequences. It is always better to report any suspicious activity to the authorities rather than trying to cover it up.
Conclusion
Joseph Sullivan, the former chief security officer of Uber, has been sentenced to three years of probation, a $50,000 fine, and 200 hours of community service for concealing a cyber-attack that exposed 57 million records of Uber customers, including their names and phone numbers. Sullivan had paid the hackers $100,000 in exchange for signing non-disclosure agreements to not reveal the hack to anyone. The payment was disguised as a bug bounty, which is a reward given to cybersecurity researchers who report vulnerabilities so they can be fixed. Sullivan was also found guilty of obstructing an investigation from the Federal Trade Commission.
The hackers subsequently faced conspiracy charges in 2019 and pleaded guilty. Judge William Orrick showed leniency to Sullivan due to his character and because this was the first case of its kind. However, he warned that anyone who commits a similar crime should expect to spend time in custody. It is crucial to report any suspicious activity to the authorities rather than trying to cover it up as cyber-attacks are illegal and can have serious consequences.
0 Comments