Ex-Uber Security Chief Gets Probation for Concealing 2016 Data Breach (axios.com) 8
A judge sentenced Joe Sullivan, the former chief security officer at Uber, to three years' probation and 200 hours of community service on Thursday for covering up a 2016 cyberattack from authorities and obstructing a federal investigation. From a report: Sullivan's case is likely the first time a security executive has faced criminal charges for mishandling a data breach, and the response to Sullivan's case has split the cybersecurity community. In October, a jury found Sullivan guilty of obstructing an active FTC investigation into Uber's security practices and concealing a 2016 data breach that affected 50 million riders and drivers. Uber paid the hackers $100,000 to not release any stolen data and keep the attack quiet. Sullivan and his team routed the payment through the company's bug bounty program, which good-faith security researchers usually use to report flaws. The hack wasn't publicly disclosed until 2017, shortly after Dara Khosrowshahi stepped into the CEO role.
Khosrowshahi fired Sullivan in 2017, telling the jury last fall that he thought the decision to conceal the breach was "the wrong decision." Sullivan then joined Cloudflare as its chief security officer in 2018, and he stayed there until July 2022 when he stepped down to prepare for his trial. "If I have a similar case tomorrow, even if the defendant had the character of Pope Francis, they would be going to prison," Judge William Orrick said during the sentencing on Thursday. "When you go out and talk to your friends, to your CISOs, you tell them that you got a break not because of what you did, not even because of who you are, but because this was just such an unusual one-off," Orrick added.
Khosrowshahi fired Sullivan in 2017, telling the jury last fall that he thought the decision to conceal the breach was "the wrong decision." Sullivan then joined Cloudflare as its chief security officer in 2018, and he stayed there until July 2022 when he stepped down to prepare for his trial. "If I have a similar case tomorrow, even if the defendant had the character of Pope Francis, they would be going to prison," Judge William Orrick said during the sentencing on Thursday. "When you go out and talk to your friends, to your CISOs, you tell them that you got a break not because of what you did, not even because of who you are, but because this was just such an unusual one-off," Orrick added.
Re: (Score:3, Insightful)
ll the while, China, Iran, Russia, and India are pretty much 100% secure
absolute crock, theyre just under no obligation to tell you. funny how the places you list are all currently major sources of international cybercrime.
https://techhq.com/2022/07/chi... [techhq.com]
https://wccftech.com/tsmc-chai... [wccftech.com]
https://www.bitdefender.co.uk/... [bitdefender.co.uk]
https://www.bleepingcomputer.c... [bleepingcomputer.com]
thats just china.
Judge admits he got away with it (Score:4, Interesting)
Re: (Score:3)
He didn't go to jail because people don't go to jail for security breaches like this. Or can you find examples of where they have, something that meaningfully sets this case apart from the others?
Re:Judge admits he got away with it (Score:5, Informative)
He didn't go to jail because people don't go to jail for security breaches like this. Or can you find examples of where they have, something that meaningfully sets this case apart from the others?
obstructing a federal investigation
People definitely go to jail for that.
Re: (Score:2)
Trump begs to differ.
Re: (Score:1)
Sullivan is actually one of the good guys in tech. He was just a scapegoat being pinned for things his superiors wanted (in a wink-wink, nudge-nudge, kind of way). Yes he probably should have stood up to them but sometimes you feel forced to play the game.
There is SO much crooked stuff that goes on behind closed doors people don't even know about. Much worse than this and nobody says jack shit because it's just business as usual.
Infuriating (Score:5, Interesting)