\n<\/p>\n
Before joining Uber<\/span> as chief security officer in 2015, Joe Sullivan served for two years as a federal prosecutor with the United States Department of Justice, where he specialized in computer hacking and IP issues. He worked on a number of high-profile cases, from the first case in the U.S. of prosecution<\/a>\u00a0under the Digital Millennium Copyright Act to the prosecution of a hacker who breached NASA\u2019s Jet Propulsion Laboratory<\/a>.<\/p>\n More than 20 years after joining the U.S. government to help organizations defend against the so-called bad guys, Sullivan found himself on the other side of the justice system.<\/p>\n In October 2022, a San Francisco jury found him guilty<\/a> on charges of obstructing an official proceeding and misprision of a felony (a failure-to-report-wrongdoing offense.) In May this year, Sullivan was sentenced<\/a> to three years probation.<\/p>\n The irony is not lost on Sullivan, who spoke to TechCrunch in London this week prior to his keynote speech at the cybersecurity conference Black Hat Europe.<\/p>\n This precedent-setting case pertains to a breach of Uber\u2019s systems in 2016<\/a>, where hackers threatened to expose the data of 50 million Uber customers and drivers. The verdict centered primarily around Uber\u2019s decision not to report the breach to the Federal Trade Commission, as the company was mandated to report all breaches after an earlier 2014 hack of its systems<\/a> exposed the names and driver\u2019s license numbers of 50,000 people.<\/p>\n The case didn\u2019t go as Sullivan, who was fired from Uber in 2017, had expected.<\/p>\n \u201cWe thought we were going to win the trial. We barely put on a defense because my lawyers were like, \u2018we don\u2019t need to.\u2019 I didn\u2019t testify, so the jury never saw me. They just saw the anonymous Uber executive with a mask on,\u201d Sullivan told TechCrunch during the interview on Wednesday.<\/p>\n The first-of-its-kind verdict hit Sullivan hard initially. \u201cWhen I lost the trial last October, I was in a funk, I didn\u2019t want to talk to anybody, and I didn\u2019t know what would happen to my life,\u201d he said. \u201cI just wanted to curl up in a ball.\u201d<\/p>\n Sullivan\u2019s case also caused anxiety among fellow CSOs and CISOs, a number of whom wrote letters to the case\u2019s sentencing judge, William Orrick, praising Sullivan\u2019s actions and voicing their fears that they too could face legal penalties for simply doing their jobs.<\/p>\n \u201cJoe\u2019s case has had a huge impact on the cybersecurity community,\u201d one letter, signed by more than 50 CISOs, read. \u201cIt has been the subject of frequent executive team conversations and panel discussions at industry seminars, and a significant driver of efforts to change policies and practices to err on the side of disclosure, even when the legal requirement to do so remains unsettled.\u201d<\/p>\n These fears have lasted long beyond Sullivan\u2019s conviction. The former Uber CSO, who now works as CEO at a non-profit dedicated to providing humanitarian and technology aid to the people of Ukraine, told TechCrunch that he receives calls every week from security professionals asking whether they should stay in the industry and whether they should take interviews for higher-ranking roles that come with greater responsibility \u2014 and greater risk.<\/p>\n \u201cWhat I tell the security executives right now is that they shouldn\u2019t run away from the job \u2014 they should run towards it,\u201d Sullivan said, noting that the shared anxiety among cybersecurity professionals, along with the fact that he wanted to be a \u201cbetter person,\u201d is part of the reason he wanted to start speaking out about the Uber data breach case.<\/p>\n \u201cI realized that sharing what I\u2019ve gone through is better than not and healthier for me. It\u2019s taken me a year to say that, but that\u2019s the right way to be,\u201d Sullivan told TechCrunch. \u201cI was very bitter, but I want to be a better person. I also want to continue being part of the security world, so I have to get over it.\u201d<\/p>\n Sullivan told TechCrunch that another reason he\u2019s keen to speak out is because of the fact that there have been \u201c100 webinars, by 100 lawyers, saying that \u2018you won\u2019t end up like Joe if you have insurance, if you bring legal and PR into the room, or if you have a breach responsibility policy\u2019\u201d.<\/p>\n \u201cWe did all of those things [at Uber],\u201d Sullivan said. \u201cWe had insurance; there was a data breach response policy; we looped in PR, and the CEO [Travis Kalanick] signed off on everything, including the dollar amount,\u201d he added, referring to the $100,000 payment that was made to the two young men that discovered the vulnerability that led to the 2016 Uber breach.<\/p>\n When asked whether he believed Uber\u2019s then-CEO should have been held responsible, Sullivan said: \u201cI don\u2019t think anybody did anything wrong at the end of the day.\u201d<\/p>\n \u201cUber wouldn\u2019t exist today \u2014 in fact, we would still be taking taxis \u2014 if it wasn\u2019t for [Kalanick] and his sheer forcefulness,\u201d Sullivan added. \u201cOn the upside, he drove some change in the world. However, on the downside, his philosophy was that the person who threw the first punch wins the fight.\u201d<\/p>\n In what Sullivan describes as \u201cthe greatest irony of his career,\u201d part of his role at the Department of Justice involved him working closely with organizations in Silicon Valley in order to encourage more collaboration with the government. \u201cThat\u2019s been the story of my career; trying to get the public and private sectors to work together\u201d.<\/p>\n Sullivan believes that going forward, this public-private sector collaboration, along with strong regulation, is the only way to fix the \u201cbroken\u201d cybersecurity industry.<\/p>\n \u201cWhen I joined, [Uber] had the worst security of any $40 billion company, and that can\u2019t fly in the world anymore. If you\u2019re going to sell a product, your security has to be good enough the day you sell it,\u201d Sullivan said. \u201cI could be very bitter about the idea of government regulation since I was regulated, but I also think we need it for the internet to work well in the future,\u201d<\/p>\nFixing a broken industry<\/strong><\/h3>\n