Ex-Uber security chief charged with concealing 2016 hack

Uber's former chief security officer, Joe Sullivan, was charged Thursday for obstructing justice and concealing a felony for his role in attempting to cover up a 2016 hack that compromised the data of millions of Uber customers and drivers.

The big picture: The hack didn't become public until a year after it happened, prompting the company's then-new CEO, Dara Khosrowshahi, to fire Sullivan and some of his deputies for their handling of the incident.

• Sullivan is now the second former Uber executive to face criminal charges, following self-driving technology expert Anthony Levandowski (for a separate case).

Details: The U.S. Attorney’s Office for the Northern District of California revealed the charges in a statement.

• "Silicon Valley is not the Wild West," U.S. Attorney David Anderson said. "We will not tolerate corporate cover-ups. We will not tolerate illegal hush money payments."
• If convicted, Sullivan faces a maximum penalty of five years in prison for the obstruction of justice charge and three years for the concealment of a felony charge.

From Uber:

"We continue to cooperate fully with the Department of Justice’s investigation. Our decision in 2017 to disclose the incident was not only the right thing to do, it embodies the principles by which we are running our business today: transparency, integrity, and accountability."

From Sullivan:

There is no merit to the charges against Mr. Sullivan, who is a respected cybersecurity expert and former Assistant U.S. Attorney. 

This case centers on a data security investigation at Uber by a large, cross-functional team made up of some of the world’s foremost security experts, Mr. Sullivan included. If not for Mr. Sullivan’s and his team’s efforts, it’s likely that the individuals responsible for this incident never would have been identified at all. From the outset, Mr. Sullivan and his team collaborated closely with legal, communications and other relevant teams at Uber, in accordance with the company’s written policies. Those policies made clear that Uber’s legal department -- and not Mr. Sullivan or his group -- was responsible for deciding whether, and to whom, the matter should be disclosed.  

Editor's note: The story has been updated with a statement from Uber and a Sullivan's spokesperson.