Senators blasted Uber over their handling of a 2016 data breach and how it might affect a cybersecurity incentive program used to hide the breach from the public at a Senate Commerce Subcommittee hearing Tuesday.

Why it matters: The breach affected 57 million users worldwide, including 25 million in the United States. Uber opted not to notify the consumers whose data was stolen, instead paying the hackers to delete the data which was potentially in violation of many state breach notification laws. The fact that it took years to notify the public "raises red flags in this committee," said Senate Subcommittee on Consumer Protection, Product Safety, Insurance, and Data Security Chair Jerry Moran (R-KS).

Uber admits it was in the wrong: Uber Chief Information Security Officer John Flynn acknowledged that not notifying users was a mistake.

"There is no justification for that. We should have notified consumers…We did not have the right people in the room."
— Uber CISO John Flynn at Senate hearing.

Why the coverup might harm other security programs: Uber paid the hacker to delete the files using money from a bug bounty program, which incentivizes good guy hackers to alert companies of security flaws that companies can then fix independently.

  • Katie Moussouris, the chief executive of Luta Security and an internationally recognized bug bounty guru, told the subcommittee that paying a hacker who maliciously stole records using bug bounty funds "muddied" the difference between a beneficial program and extortion.
  • Sen. Moran agreed this might cause problems saying, "These substantive concerns should not completely outweigh [bug bounties'] innovative crowdsourced approach [to security]."

Go deeper

Robert Mueller speaks out on Roger Stone commutation

Former Special Counsel Robert Mueller testifies before the House Permanent Select Committee on Intelligence on Capitol Hill on Wednesday July 24, 2019. Photo: The Washington Post / Contributor

Former special counsel Robert Mueller responded to claims from President Trump and his allies that Roger Stone was a "victim" in the Justice Department's investigation into Russian interference in the 2016 election, writing in a Washington Post op-ed published Saturday: "He remains a convicted felon, and rightly so."

Why it matters: The rare public comments by Mueller come on the heels of President Trump's move to commute the sentence of his longtime associate, who was sentenced in February to 40 months in prison for crimes stemming from the Russia investigation. The controversial decision brought an abrupt end to the possibility of Stone spending time behind bars.

Trump dons face mask during Walter Reed visit

Trump wearing a face mask in Walter Reed National Military Medical Center on July 11. Photo: Alex Edelman/AFP via Getty Images

President Trump wore a face mask during his Saturday visit to Walter Reed National Military Medical Center, according to AP.

Why it matters: This is the first known occasion the president has appeared publicly with a facial covering as recommended by health officials since the coronavirus pandemic began, AP writes.

Updated 4 hours ago - Politics & Policy

Coronavirus dashboard

Illustration: Sarah Grillo/Axios

  1. Global: Total confirmed cases as of 5:30 p.m. ET: 12,607,510 — Total deaths: 562,338 — Total recoveries — 6,948,863Map.
  2. U.S.: Total confirmed cases as of 5:30 p.m. ET: 3,228,884 — Total deaths: 134,600 — Total recoveries: 983,185 — Total tested: 38,919,421Map.
  3. Public health: Jimmy and Rosalynn Carter: "Please wear a mask to save lives" Fauci hasn't briefed Trump on the coronavirus pandemic in at least two months — We're losing the war on the coronavirus.
  4. Food: How the coronavirus pandemic boosted alternative meat.
  5. Sports: Charge of "money grab" by college football.
  6. World: India reimposes lockdowns as coronavirus cases soar.