U.S. District Decide William Orrick sentenced Sullivan to 3 years of probation, noting his important previous work in defending individuals from the type of crime he later hid. He additionally mentioned that Sullivan’s steps had succeeded in holding the stolen knowledge from being uncovered.
Orrick mentioned he felt former Uber chief government Travis Kalanick was equally liable for what he thought-about a severe offense, and he puzzled aloud why Kalanick had not been charged. The decide additionally mentioned he was influenced by the unprecedented nature of the case, warning that future offenders could be jailed, even when they have been the pope.
Sullivan’s conviction had shocked many safety professionals, a lot of whom noticed Sullivan, a onetime federal cybercrime prosecutor, as an trade chief who additionally labored within the public curiosity as the highest safety government at Fb, Uber and Cloudflare.
In addition they criticized the federal government for criminalizing questionable judgment in paying off extortionists when the apply has grow to be a daily prevalence at U.S. firms hit by ransomware. The FBI has mentioned it won’t pursue expenses in opposition to those that approve payouts that don’t go to gangs underneath sanctions for working in live performance with Russian authorities or focusing on crucial infrastructure.
Greater than 180 letters have been filed with the decide praising Sullivan and asking that he be spared jail time to proceed serving to defenders and victims of safety failures. One of many letters was signed by 40 present or former chief safety or chief info safety officers.
However prosecutors sought 15 months in jail, arguing that so many individuals rallied to assist Sullivan as a result of he was rich and well-connected, and that justice required such defendants be handled the identical approach as poor outcasts.
Sullivan “has a spotless historical past. He’s revered in his group. He’s an innovator in his area,” the U.S. lawyer’s workplace in San Francisco wrote in a sentencing memo. “However, when given the chance to decide on between himself and adherence to the legislation, he selected himself. Worse than that, Defendant Sullivan prioritized his and Uber’s pursuits over these of the tens of hundreds of thousands of Uber customers and riders who trusted their private info to the corporate.”
Each side mentioned their favored final result would assist solidify cooperation between U.S. officers and personal safety efforts, a precedence for the Biden administration as prison hacking will get extra refined and extra intertwined with international authorities pursuits.
Kiersten Todt, who just lately stepped down as chief of employees on the federal Cybersecurity and Infrastructure Safety Company, wrote to the decide that prime executives had warned her that the decision would “make it inconceivable to recruit sensible individuals into the roles of CISOs and CSOs if imprisonment is on the desk — and can set the trade again.”
From the bench, Orrick mentioned that letters wherein different safety executives mentioned they too feared prosecution confirmed that the writers didn’t perceive the info of the case. He mentioned Sullivan intentionally deceived the federal government, inflicting actual hurt to the FTC and the general public.
Talking briefly and emotionally earlier than the decide pronounced the sentence, Sullivan took accountability and apologized for hurting his household, buddies and the “noble career” of cybersecurity.
“I used to be a foul position mannequin,” Sullivan mentioned in a halting voice. “We’re there to be the champion of the client, and I failed on this case.”
Citing the letters in their very own memo, Sullivan’s attorneys recounted quite a few good deeds, equivalent to establishing eBay’s belief and security group and a Fb child-safety effort that his successor there, Alex Stamos, credited with delivering three-fourths of all notifications to the Nationwide Heart for Lacking and Exploited Kids in 2021.
“It’s not unreasonable to say that Joe and the handful of different executives who tackled this drawback in these early days are possible liable for extra world prosecutions of kid sexual exploitation than just about some other residing individuals,” wrote Stamos, now director of the Stanford Web Observatory.
The prison case in opposition to Sullivan began when a hacker emailed Uber anonymously and described a safety lapse that allowed him and a associate to obtain knowledge from one of many firm’s Amazon repositories.
It emerged that that they had used a stray digital key Uber had left uncovered to get into the Amazon account, the place they discovered and extracted an unencrypted backup of information on greater than 50 million Uber riders and 600,000 drivers.
Sullivan’s group steered them towards Uber’s bounty program and famous that the highest payout underneath it was $10,000. The hackers mentioned they would want six figures and threatened to launch the information.
Negotiation ended with a $100,000 fee and a promise from the hackers that that they had destroyed the information and wouldn’t disclose what that they had carried out. Whereas prosecutors referred to as it a coverup, testimony confirmed that Sullivan’s employees used the method to get clues that will make them the true identities of the perpetrators, which they felt was vital leverage to carry them to their phrase. The 2 have been later arrested and pleaded responsible to hacking expenses, and one testified for the prosecution in Sullivan’s trial.
The obstruction cost drew energy from the truth that Uber on the time was nearing the top of an FTC investigation following a significant 2014 breach, which occurred earlier than Sullivan joined the corporate.
Whereas he directed the response to the 2 hackers, Sullivan saved many others on the firm apprised, together with a lawyer on Sullivan’s group, Craig Clark. Proof confirmed that Sullivan instructed Kalanick, Uber’s CEO on the time, and that Kalanick accredited Sullivan’s technique. The corporate’s chief privateness lawyer, who was overseeing the response to the FTC, was knowledgeable, and the top of the corporate’s communications group additionally had particulars.
Clark, the designated authorized lead on breaches, was given immunity to testify in opposition to his former boss. On cross-examination, he acknowledged advising the group that the assault wouldn’t need to be disclosed if the hackers have been recognized, agreed to delete what that they had taken and will persuade the corporate that that they had not unfold the information additional, all of which finally got here to go.
Prosecutors have been left to problem “whether or not Joe Sullivan might have presumably believed that,” as considered one of them put it in closing arguments. In his remarks Thursday, Sullivan mentioned he ought to have gotten an outdoor authorized opinion as an alternative of being relieved at getting inner cowl to keep away from disclosure.
After Kalanick was pressured out of the corporate for unrelated scandals, his successor, Dara Khosrowshahi, got here in and realized of the breach. Sullivan described it as a routine bug bounty payout, prosecutors mentioned, modifying from one electronic mail the quantity of the payoff and the truth that the hackers had obtained unencrypted knowledge, together with cellphone numbers, on tens of hundreds of thousands of riders. After a later investigation turned up the total story, Khosrowshahi testified, he fired Sullivan for not telling him extra, sooner.
Keen to point out that it was working in a brand new period, the corporate helped the U.S. lawyer’s workplace construct a case in opposition to Sullivan. And the prosecutors in flip unsuccessfully pressed Sullivan to implicate Kalanick, who would have been a far larger prize however was not damned by the surviving written proof, in line with individuals aware of the method.
