Former Uber security chief is punished for hiding a hack

In lieu of going to jail, Uber's former chief security officer was given three years of probation and ordered to complete community service.

In response to hackers gaining access to 57 million records of Uber users, including names and phone numbers, Joseph Sullivan was found guilty of paying them $100,000 (£79,000).

In addition, he must perform 200 hours of community service and pay a $50,000 fine.

Initially, the prosecution requested a 15-month prison term.

Sullivan was also found guilty of impeding a Federal Trade Commission probe.

The judge, William Orrick, reportedly told the Wall Street Journal that he was being lenient with Sullivan not just because this was the first instance of its kind but also due to his character.

I hope everyone here understands that if there are more, folks should anticipate spending time in detention regardless of anything, he said.

THE HACK

In 2015, Sullivan started working as Uber's chief security officer.

According to the US Department of Justice (DOJ), the hackers that attacked Uber sent Sullivan an email in November 2016 informing him that they had stolen a significant amount of data that they would erase in exchange for a ransom.

Employees at Sullivan confirmed that information, including 600,000 driver's licence numbers and records of 57 million Uber users, had been stolen.

The DOJ claims that Sullivan made arrangements for the hackers to receive $100,000 in exchange for signing non-disclosure agreements promising to keep the hack a secret.

In December 2016, the hackers received payment under the pretence of a "bug bounty"—a incentive given to cyber-security researchers who reveal flaws so they can be addressed.

In 2019, the hackers were charged with conspiring, and they pleaded guilty.