JOE SULLIVAN▊
- TITLE
- Chief Security Officer, Uber (2015–2017) — the concealment happened on his watch FACT
- SCHEME
- Routed a $100,000 payment to the 2016 attackers through Uber's HackerOne bug-bounty program; the attackers signed NDAs falsely representing they kept no stolen data FACT
- HABITAT
- Silicon Valley security suites; the industry keynote circuit
- RECORD
- Convicted by federal jury on two felony counts — obstruction of justice and misprision of a felony, Oct 6 2022 ADJUDICATED
- SENTENCE
- Three years' probation, 200 hours community service, $50,000 fine — no prison, May 4 2023 FACT
- DISPOSITION
- Conviction affirmed by the U.S. Court of Appeals for the Ninth Circuit, Mar 13 2025 ADJUDICATED
I’ve thought about this a lot. If you’re a person who’s never sat in the seat of the CSO, the natural conclusion is the person to blame is the person in that title.
Joe Sullivan, Uber’s former security chief, after his 2022 federal conviction for concealing the 2016 breach — his scapegoat argument, that the title took the fall for a decision others shared. A jury convicted him; he was sentenced to three years’ probation. CSO Online.
The specimen, observed 2015–2017 in the CSO chair of a company already under federal investigation for a prior breach. When a second breach arrived, it was fed into the machinery built to reward friendly hackers — and the paperwork called it a bounty.
What you are about to observe is not a fraud in the usual plumage. No self-conferred title, no plagiarized book, no penny-stock. This organism reached the top of the food chain by genuine ability, and then met the one problem its ability could not out-manage: a crime committed against the company it was paid to protect, arriving at the worst possible moment.
What it did next is the whole case. That is why the archive exists. Every event below carries its receipt. Both sides get the microphone — and on this file the defense speaks from inside the government's own case.
the drama timeline
ACT I — THE ARRANGEMENT (2016)
A predator is defined by what it does when cornered, not when comfortable. Watch the sequence. The testimony comes first; the breach comes second; the choice comes third.
-
OCT 2016
The breach, and the bounty that wasn't
Attackers reach an Amazon S3 bucket with credentials found on GitHub and take names, emails, and phone numbers for 57 million users and drivers, plus driver's-license numbers for roughly 600,000 U.S. drivers. Sullivan arranges to pay them $100,000 through Uber's HackerOne bug-bounty program, and obtains NDAs in which they falsely represent they retained no data. The event lands ten days after he had given sworn FTC testimony about Uber's security.
The bounty program was real. That is the elegance of the maneuver and, later, its problem: the cage was built for a different animal, and something else was fed into it.
ACT II — THE UNMASKING (2017–2018)
The concealment held for about a year. New management is the natural predator of the inherited secret.
-
2017
A new CEO opens the drawer
Uber's incoming chief executive, Dara Khosrowshahi, discloses the 2016 breach publicly and Sullivan is dismissed. The prosecution would later note the payment had been arranged with then-CEO Travis Kalanick's knowledge — a detail the defense would press hard, since Kalanick was never charged.
-
SEP 2018
The company writes the check
Uber settles with all 50 state attorneys general for $148 million over the year-long cover-up. The corporation's price is paid in money. The individual's price is still being decided.
ACT III — THE PROSECUTION (2020–2023)
Here the file turns from corporate housekeeping into something no security executive had faced before: a personal indictment.
-
2020
The first personal indictment of a CSO
Federal prosecutors charge Sullivan over the concealment. It is the first time the government brings criminal charges against a sitting corporate security chief for how a breach was handled.
-
OCT 6 2022
The jury convicts
A federal jury finds Sullivan guilty on two felony counts: obstruction of justice and misprision of a felony. It is the first criminal conviction of a security executive in U.S. history for handling of a breach.
-
MAY 4 2023
Probation, not prison
The court sentences him to three years' probation, 200 hours of community service, and a $50,000 fine. Prosecutors had sought incarceration. He serves no time.
A conviction that lands soft. The court saw a first offender, cooperation credit arguments, and a defendant who did not act entirely alone — and it declined the cage.
ACT IV — THE APPEAL (2025)
The last move in the repertoire is the appeal, and it is where the theory of the whole case was tested on paper.
-
MAR 13 2025
The Ninth Circuit affirms
The Ninth Circuit affirms the conviction. Its holding is the sentence every CSO now reads twice: the attackers' unauthorized access "could not be laundered through Uber's post hoc authorization, via a non-disclosure agreement (NDA), of their computer access." A bounty is not a pardon.
-
EPILOGUE
The precedent stands, the man walks
Sullivan remains at liberty and active in the industry; the conviction — the first of its kind — is now settled appellate law. His counsel warned the ruling would unfairly expose "those who serve on the cybersecurity front lines." The archive keeps the tape running.
both sides, on the record
The adjudicated core: a federal jury convicted Sullivan on two felony counts — obstruction of justice and misprision of a felony — and the Ninth Circuit affirmed on March 13, 2025 [1] [2].
The conduct: a $100,000 payment routed through the bug-bounty program to the 2016 attackers, with NDAs falsely representing the stolen data was destroyed — while an FTC investigation into an earlier breach was open, days after he had testified to that same agency [1] [6].
The holding that binds the field: the court ruled the unauthorized access "could not be laundered through Uber's post hoc authorization, via a non-disclosure agreement" — the bounty framing does not survive contact with the record [2].
It ran through a real program. The HackerOne bug-bounty channel existed and had legitimately paid researchers before; the defense's position was that this was handled as a bounty, not conjured as a bribe — a judgment call inside an established process, not an invented cover [6].
He did not act alone. The government's own complaint says the payment was arranged with then-CEO Travis Kalanick's knowledge; Uber's legal function was in the loop. Sullivan was the only person criminally charged — a fact the defense pressed and one the reader should weigh [10].
Scope and sentence: the court imposed probation, community service, and a fine — no prison — over the prosecution's objection [3]. His counsel argues, and much of the profession agrees, that punishing the defender chills the candid disclosure the rules are meant to produce; CSO Online reported the verdict as the moment personal liability became "real" for CISOs [5] [8]. And the parallel civil theory did not hold up: the SEC's fraud case against SolarWinds CISO Timothy G. Brown was gutted by the court and then voluntarily dismissed with prejudice in November 2025 [9].
YOU DECIDE
Scoped to the cover-up, never the man. The claim that concealing the breach was a crime is settled — a jury said so, the Ninth Circuit said so again, and the holding names the trick by name: a bounty is not a laundromat for unauthorized access.
Weigh the costly signals both ways. The government fully litigated this one and won, twice; it fully litigated the SolarWinds theory and walked away with nothing. And the CEO who knew was never charged, while the man who signed the paperwork was. Accountability reached the security suite — whether it reached the right desk is the argument the record leaves open.
The archive does not judge. The archive merely keeps the tape running.
evidence locker
PRIMARY RECORD — COURT & DOJ
PRESS & ANALYSIS
NPR — "Uber Pays $148 Million Over Year-Long Cover-Up Of Data Breach" (Sep 2018) FACT — the 50-state settlement and the disclosure timeline.
npr.org/2018/09/27/652119109/… CSO Online — "Guilty verdict in the Uber breach case makes personal liability real for CISOs" ATTRIBUTED — the profession's read on what the verdict means for defenders.
csoonline.com/article/573871/… SEC Litigation Release LR-26423 — dismissal of SEC v. SolarWinds Corp. and Timothy G. Brown (Nov 20 2025) FACT — the parallel CISO-liability theory the government abandoned; the counter-case's strongest data point. Bot-blocked (403) but live.
sec.gov/enforcement-litigation/litigation-releases/lr-26423
CONTEXT & THE DISCOURSE
troll.fan — Security Charlatans & Institutional Failures (the SEC / personal-liability wave) CROSS-REF — the fuller ledger this case anchors: Drizly/Rellas, SpyFone/Zuckerman, SolarWinds/Brown.
troll.fan/charlatans.html
The standard. Everything above is sourced to court records, the Justice Department's own releases, and named press reporting. Facts are stated as facts; the conviction and its affirmance are adjudicated. The defense is presented at full strength — the real bug-bounty program, the CEO who knew and was never charged, the probation-not-prison sentence, and the parallel theory the government dropped. No motive is asserted beyond the record, no private character diagnosed. The burden of proof is on us, not the subject. If it couldn't survive a defamation challenge, it wouldn't be on this page.