Felony Conviction Hasn’t Changed Former CISO’s View Of Cybersecurity Profession

In an interview with TechCrunch, former Uber chief information security officer Joe Sullivan talks about the effect that being found guilty of obstructing an official proceeding and failure to report a felony had on him and his profession.

A jury found Sullivan guilty of concealing a 2016 data breach at Uber that affected 50 million riders and drivers. He was sentenced to three years probation.

Sullivan noted that he kept legal and PR in the loop when the decisions that led to the guilty verdict were made.

“We thought we were going to win the trial,” he says. “We barely put on a defense because my lawyers were like, ‘We don’t need to.’”

Uber paid the hackers $100,000 to not release any stolen data and keep the attack quiet. Sullivan and his security team routed the payment through the company’s bug bounty program. The hack wasn’t publicly disclosed until 2017.

The verdict centered around Uber’s decision not to report the breach to the FTC. The company was mandated to report all breaches after an earlier 2014 hack of its systems exposed the names and driver’s license numbers of 50,000 people.

Before taking the Uber job, Sullivan was a DOJ prosecutor. He specialized in hacking and IP issues and worked on the prosecution of a hacker who breached NASA’s Jet Propulsion Laboratory, the first prosecution under the Digital Millennium Copyright Act.

In Sullivan’s opinion, a public-private sector collaboration, along with strong regulation, is the only way to fix the “broken” cybersecurity industry.

He says his decision to speak out was made because the fear his case engendered in the cybersecurity community has lasted long beyond his conviction.

“What I tell the security executives right now is that they shouldn’t run away from the job. They should run towards it,” he says.