On October 5, 2022, Joe Sullivan, Uber’s former Chief Security Officer, was convicted of “obstruction of the proceedings of the Federal Trade Commission and misprision of felony in connection with the attempted cover-up of a 2016 hack at Uber.” He faces up to eight years in prison. The conviction marks the first time that an individual company executive has faced criminal charges related to an information security breach.
While this conviction could be viewed as a slippery slope toward more cases—both civil and criminal—where Chief Security Officers or Chief Information Security Officers are found personally liable for company data breaches that happen on their watch, Sullivan’s actions went beyond simple failure to stop a breach or even failure to report it. As the prosecutor in the case, US Attorney Stephanie Hinds explained, “Sullivan affirmatively worked to hide the data breach from the Federal Trade Commission (FTC) and took steps to prevent the hackers from being caught. We will not tolerate the concealment of important information from the public by corporate executives more interested in protecting their reputation and that of their employers than in protecting users. Where such conduct violates the federal law, it will be prosecuted.” By bringing these charges the government was sending a message that it views companies as responsible for the data they collect from consumers and expects those companies to be transparent and honest when dealing with a known data breach.