Uber's Former Security Chief Charged With Covering Up Massive 2016 Hack

The case was believed to be first time a corporate information security officer has been charged with concealing a hack.

By Retuers | Updated: 21 August 2020 12:55 IST

Uber's Former Security Chief Charged With Covering Up Massive 2016 Hack

The complaint alleges that then-CEO Travis Kalanick was aware of Sullivan’s actions

Highlights

The complaint alleges then-CEO Kalanick was aware of Sullivan’s actions
Sullivan arranged to pay the hackers $100,000 under Uber’s programme
Sullivan now works as chief information security officer at Cloudflare

In an unprecedented case, a former chief security officer for Uber was criminally charged on Thursday with trying to cover up a 2016 hacking that exposed personal information of about 57 million of the ride-hailing company's customers and drivers.

The US Department of Justice charged Joseph Sullivan, 52, with felony obstruction of justice, saying he took "deliberate steps" to keep the Federal Trade Commission from learning about the hack while the agency was monitoring Uber security in the wake of an earlier breach.

The case was believed to be first time a corporate information security officer has been charged with concealing a hack.

Cruise Operator Hit by Ransomware Attack, Guest and Employee Data Accessed

Sullivan, himself a former federal prosecutor, arranged to pay the hackers $100,000 (roughly Rs. 75 lakhs) under Uber's programme for rewarding security researchers who report flaws. That amount was by far the most Uber had paid through the bounty programme, which was not meant to cover theft of sensitive data.

A former chief of security at Facebook, Sullivan now works as chief information security officer at Cloudflare.

In past interviews, security staff said the Uber payout was intended to force the hackers into the open to accept the money and to ensure that the data, especially driver's license information on Uber contractors, was destroyed.

Ex-NSA Hacker Uses Microsoft Office Exploit to Take Control of macOS Devices

The complaint says Sullivan had the hackers sign non-disclosure agreements that falsely stated they had not stolen data. It alleges that then-CEO Travis Kalanick was aware of Sullivan's actions.

A spokeswoman for Kalanick declined to comment. A spokesman for Sullivan said that the charges had no merit, that Sullivan had worked with his colleagues on the case and that disclosure matters were decided by the legal department.

“If not for Mr. Sullivan's and his team's efforts, it's likely that the individuals responsible for this incident never would have been identified at all,” said spokesman Brad Williams.

Kalanick's successor as CEO, current Uber chief Dara Khosrowshahi, disclosed the payoff, then fired Sullivan and a deputy after learning the extent of the breach. Uber then paid $148 million (roughly Rs. 1108 crores) to settle claims by all 50 US states and Washington DC that it had been to slow to reveal the hack.

The Uber case will resonate for the increasing number of companies that deal directly with hackers.

Many have bounty programmes like Uber's, which are generally seen as a tool to improve security and provide an incentive for hackers to stay within the law. But some participants do not play by the rules.

In the Uber case, the FBI noted, the two main hackers went on to attack other companies, which the agency said could have been averted if Sullivan had gone first to law enforcement. Both have pleaded guilty and are awaiting sentencing.

The case also suggests that companies that pay hackers to get rid of ransomware, malicious programs that encrypt their files, are not exempt from requirements to report losses of personally sensitive information.

Buying a budget TV online? We discussed how you can pick the best one, on Orbital, our weekly technology podcast, which you can subscribe to via Apple Podcasts or RSS, download the episode, or just hit the play button below.

Comments

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.