Uber Data Breach Results in Corporate Cooperation and Executive Conviction

According to the Complaint, while conducting an investigation into the incident two years later, Uber’s outside lawyers discovered Sullivan’s misconduct. In response, Uber disclosed the breach publicly, and to the FTC, in November 2017.

The failure to disclose the incident to the FTC during the FTC’s investigation was a critical fact, but perhaps not the most important fact, leading to the prosecution in this case. As properly stated in the jury instruction used in this case for the misprision offense: the “[m]ere failure to report a federal felony is not a crime. The defendant must also commit some affirmative act designed to conceal the fact that a federal felony has been committed. Such an act does not need to be made directly to an authority.” In a Complaint filed in August 2020, federal prosecutors alleged that instead of initiating steps to notify the affected users and relevant authorities as may be required by certain state data breach notification laws, and as Uber had done in 2014 when similar data had been impacted, Sullivan “instructed his team to keep knowledge of the 2016 Data Breach tightly controlled” while he quietly engaged in weeks-long backchanneling with the hackers responsible for it. The negotiations enabled Sullivan to secure nondisclosure agreements from the hackers—including a promise to destroy the data and attestations that they “did not take or store any data” in the first place—in exchange for $100,000. But, as prosecutors alleged, those attestations were false. The government charged that Sullivan improperly made the payment to hackers under a “bug bounty” program intended to incent white-hat hackers to identify security vulnerabilities proactively and in good faith, not to repay those who had in fact accessed and obtained large volumes of personal data in an attempt at extortion. Moreover, the government charged that Sullivan concealed certain details about the incident resulting in affirmative misrepresentations and misleading omissions when Sullivan briefed the new CEO about the incident. Not only did Sullivan’s actions conceal the data breach, the affirmative steps to cover up the crime by the hackers contributed to the ability of the hackers to potentially commit other hacks. 

Sullivan’s prosecution and trial are notable given that the government put on evidence from one of the very hackers who initially had breached Uber’s systems along with testimony from Uber executives. Prosecutors from the U.S. Attorney’s Office for the Northern District of California charged two individuals, Vasile Mereacre and Brandon Glover, with conspiring to commit extortion involving computers. Both pled guilty in 2019, and Mereacre testified at trial, confirming that he and Glover had downloaded data including the names, email addresses, and phone numbers of 57 million users of the Uber application, along with 600,000 drivers’ license numbers.

In July 2022, the government also entered into a non-prosecution agreement with Uber for a term tied to entry of a final judgment in the prosecution against Sullivan, citing several factors weighing against corporate prosecution:

• A change in leadership in late 2017, and the new leadership team’s prompt investigation of the 2016 breach and its disclosure to the public and regulators;
• The investment of substantial resources to significantly restructure and enhance the company’s compliance, legal, and security functions;
• Uber’s agreement to maintain a comprehensive privacy program for 20 years and to report to the FTC any incident reported to other government agencies relating to unauthorized intrusion into individuals’ consumer information; 
• Uber’s full cooperation with the U.S. Attorney’s Office for the Northern District of California, including its agreement to make current and former employees and executives available to the government; and
• The settlement of civil litigation with the attorneys general for all 50 States and the District of Columbia.

As noted in the DOJ’s press release, Uber’s full cooperation played an important role in this decision. According to Deputy Attorney General Lisa Monaco’s September 2022 revision to DOJ’s Corporate Enforcement Policy, a company is eligible to receive “full cooperation credit” from the DOJ when it has not only “promptly notified prosecutors of particularly relevant information once it was discovered,” but also “prioritized” the production of that information deemed “most relevant for assessing individual culpability.” The Monaco Memo emphasizes that a company may lose its “eligibility for cooperation credit”—in whole or in part—if it “delays its disclosure” of significant facts once it identifies them. 

The failure to disclose the 2016 incident amidst the FTC’s investigation of Uber’s privacy and cybersecurity practices for a similar incident also lead to a revision of the FTC’s consent order to require Uber to notify the FTC of certain incidents involving unauthorized access to consumer information in the future. This revision also could subject the Company to civil penalties if it fails to notify the FTC of incidents in the future in accordance with the terms of the settlement.   

This case serves as a cautionary tale for any corporation that runs a bug bounty program, and provides critical lessons for data breach response and cybersecurity governance. For example, companies may want to review their bug bounty programs to ensure proper governance and controls are in place. Companies should also consider their data breach notification obligations following any bug bounty report or cyber incident.