Former Uber Technologies Inc. Chief Security Officer Joe Sullivan has been found guilty in a trial on charges that he covered up a security breach at Uber in 2016 that saw the theft of data relating to some 57 million Uber passengers and drivers.

Sullivan (pictured) was charged in 2020 with obstruction of justice and “misprision” or concealment of a felony by the U.S. Attorney’s Office in the Northern District of California. The hack of Uber took place in 2016 but did not come to light until Uber fired Sullivan in November 2017. He was said to have paid the hackers $100,000 to delete the data and keep the breach quiet.

As noted two years ago, the story of Sullivan being charged took an interesting twist, since he had previously played a pivotal role in responding to U.S. Federal Trade Commission inquiries about Uber’s cybersecurity practices following an earlier breach in 2014. The complaint against Sullivan alleged that he was made aware of the hack 10 days after testifying to the U.S. Federal Trade Commission, but instead of informing the commission, he decided to cover it up.

The road to court for Sullivan was a somewhat slow one, with the judge in the case ruling that he should face wire fraud charges in June. Lawyers for Sullivan had argued unsuccessfully that prosecutors did not adequately allege he concealed the hacking to ensure that Uber drivers would not flee and would continue paying service fees. Judge William Orrick also rejected a claim that Sullivan was only attempting to deceive Uber’s then-Chief Executive Officer Travis Kalanick and Uber’s general counsel, not drivers.

Sullivan was found guilty by the jury of both charges in the case — obstruction and one count of misprision of a felony.

“While we obviously disagree with the jury’s verdict, we appreciate their dedication and effort in this case,” David Angeli, a lawyer for Sullivan, told Bloomberg. “Mr. Sullivan’s sole focus in this incident and throughout his distinguished career has been ensuring the safety of people’s personal data on the internet. We will evaluate next steps in the coming days.“

Sullivan’s career included serving as the CSO of Meta Platforms Inc., then Facebook, from January 2010 to April 2015 and as CSO of Cloudflare Inc. from July 2018. His time at Uber spanned just shy of three years, according to LinkedIn — April 2015 to November 2017.

A sentencing date for Sullivan is yet to be scheduled.

“Sullivan affirmatively worked to hide the data breach from the Federal Trade Commission and took steps to prevent the hackers from being caught,” Stephanie Hinds, U.S. attorney for San Francisco, said in a statement. “We will not tolerate concealment of important information from the public by corporate executives more interested in protecting their reputation and that of their employers than in protecting users.”

Photo: Joe Sullivan/Twitter