On May 4, 2023, U.S. District Judge William Orrick sentenced former Uber CISO and former DOJ cybercrime prosecutor Joe Sullivan to three years of probation and 200 hours of community service for his role in concealing a massive data breach at Uber from the public and from the FTC. While the court rejected the government’s request for 15 months of jail for the former prosecutor, the court also did not accept Sullivan’s assertions that his activities were simply “normal” activities for a CISO in response to a data breach. The prosecution noted that the many letters of support he received from members of the cybersecurity community did not understand the nature and facts of the Uber case and that fears expressed by CISOs that they could face criminal prosecution for simply doing their jobs reflected the fact that these CISOs “don’t have a clear picture of what happened” in the Sullivan case. The judge also emphasized the fact that Uber, in general, and Sullivan, in particular, failed in their obligations to protect the public from the breach and obstructed the FTC investigation and response to a previous data breach.
While Sullivan was able to avoid a prison sentence, the case raises serious questions about how CISOs can ensure that they have a successful tenure with an organization, that they can ensure that their voice is heard and responded to and how they can ensure that they do not end up left hanging by their employer. Of course, there is no substitute for competence...
Three Houston-area individuals accused of belonging to a sovereign-citizen group have been indicted in federal court on charges of falsely claiming to be diplomats of the “Moroccan Empire,” accord...