Joseph Sullivan

FACT Sullivan was Uber's CSO from 2015 to 2017 and had earlier been Facebook's CSO; in August 2016 he additionally took the title Deputy General Counsel [1][4]. The FTC was then investigating Uber's data-security practices after a 2014 breach, and he had testified at investigational hearings about the company's encryption practices [1].

FACT In October 2016 attackers reached Uber's private GitHub account, found AWS credentials there, and downloaded unencrypted data — "the names and driver's license numbers of some 600,000 individuals" [1]; DOJ describes the incident as involving records of roughly 57 million users and drivers [3]. The exposed data was the kind the FTC was asking about.

1. Classify the intrusion as a bug-bounty finding. Uber paid the attackers $100,000 for signatures on an NDA recharacterising the unauthorised access as legitimate "research" under the Bug Bounty Program [1].
2. Use an existing payment channel instead of an incident process. That program had money, a contract template and no attached disclosure obligation; routing the event through it converted a reportable incident into a routine payout [1][3].
3. Buy contractual silence rather than containment assurance. The contracts "falsely represent[ed] that the hackers did not take or store any data" [3].
4. Inform the CEO; not the general counsel. He told CEO Travis Kalanick the hackers had signed, and "did not inform Uber's general counsel of these developments, despite telling other employees to the contrary" [1].
5. Continue the regulatory engagement on the old facts. He signed off on new statements to the FTC about encryption while knowing the October intrusion had exposed unencrypted data [1].

FACT A jury convicted him in October 2022 of obstruction of justice and misprision of a felony; on 5 May 2023 Judge William H. Orrick imposed three years' probation and a $50,000 fine [3]. Incoming CEO Dara Khosrowshahi learned the facts in autumn 2017 and terminated him [1].

FACT On 13 March 2025 the Ninth Circuit affirmed in all respects (United States v. Sullivan, No. 23-927; 131 F.4th 776): no separate "nexus" instruction was required, no "duty to disclose" instruction was necessary, the misprision evidence was sufficient, and post-hoc authorisation through an NDA cannot retroactively legalise unauthorised access [1][2].

• A criminal record is not an organisational record. It establishes what a jury found on the charged conduct; it does not adjudicate what other executives knew, and the opinion notes the CEO was told.
• The figures differ by source — 600,000 driver's licence numbers in the opinion, roughly 57 million records in DOJ's description [1][3].
• The "duty to disclose" holding is narrow — about a jury instruction, not a general statement of a security executive's disclosure duty.
• Do not read today's rules backwards. These events precede the SEC's 2023 disclosure rule; the obligations in play attached to an open FTC proceeding.

INTERPRETATION The structural fact is the teachable one: the security chair also held Deputy General Counsel. The escalation route to legal ran through the office that owned the incident. Where the person who classifies an event and the person who must be told are the same, there is no independent check — and the general counsel was not informed [1].

A differently-designed escalation path. Four mechanisms, none exotic, any of which changes the outcome. (1) A written, no-discretion trigger sending any incident that arises while a regulatory proceeding is open to the general counsel and outside counsel. (2) Bug-bounty payment authority held apart from incident-classification authority, with a second signature for any payment attached to an NDA. (3) A line from the security chair to the audit committee passing through nobody who benefits from silence. (4) A named role — by title, not person — for "who decides this is a breach," held by someone not accountable for the program's reputation.

Trait Dial (INTERPRETATION — inferred from the decisions). Unilateral↔consensus −3; decisiveness↔inquiry −3; optimism↔skepticism −2, in that contractual silence was treated as containment. Overuse Ladder: decisiveness → unilateralism, ownership → concealment.

Maturity Model. A Maturity failure, not a capability one. "I was wrong. Change the plan." is hardest exactly when a proceeding is open and saying it is expensive. Risk Corollary: paying researchers can be a defensible priced risk, but priced means somebody other than the buyer sees the price. A risk accepted privately by the person who created the exposure has not been priced at all.

1. Write, in one sentence, the trigger that forces an incident out of your hands and to counsel automatically. Who can waive it — and what if that person is the one under scrutiny?
2. Your bug-bounty program can pay a researcher today with no disclosure consequence. Describe the facts that convert a payout into a breach, and name who decides, by role.
3. You are offered the security chair at a company with an open regulatory proceeding. What three things do you require in writing first?