Some CSOs say ex-Uber CSO Joe Sullivan did nothing wrong and his trial tests criminal penalties they may face over security lapses or challenges in gray areas
Context & Ripple Effects
The case began with Joe Sullivan's obstruction-of-justice charge in 2020 over Uber's failure to disclose its 2016 breach of customer and driver records to FTC officials. When the federal trial opened in early September 2022, his lawyers argued Uber scapegoated him in the turbulence after Travis Kalanick's exit — and much of the CSO community has publicly sided with that framing.
The stakes go beyond one defendant: security chiefs see the trial as a test of whether gray-area judgment calls during a breach — pay the hackers, notify later — can be prosecuted as crimes. The jury's answer came in October 2022 with a guilty verdict, followed by a sentence of three years' probation, making the precedent concrete for every executive who signs off on disclosure timing.
First-order effects
- CSOs across the industry now face personal criminal exposure for breach-disclosure decisions, not just the corporate fines and firings that followed breaches at Uber and peers.
- Sullivan's scapegoating defense puts Uber's internal decision-making on trial alongside him, pressuring the company's legal and security leadership over who approved the 2016 handling.
Second-order effects
- Companies will likely restructure how breach-notification decisions are made and documented, spreading sign-off across legal, compliance, and the board so no single security chief bears sole criminal risk.
- CSO hiring conversations now include personal liability terms — indemnification, D&O-style protection — as candidates price the Sullivan precedent into employment decisions.
Third-order effects
- If individual prosecution becomes the enforcement template for disclosure lapses, the CSO role structurally shifts toward legal-defensible process over technical judgment, and regulators gain leverage by raising personal stakes rather than corporate penalties.
- The gray areas the trial exposes — ransom payments, disclosure timing, hacker negotiations — create pressure for clearer statutory guidance on when security decisions cross into criminal conduct.
The trend: Criminal accountability for data breaches is migrating from corporations to individual security executives, with disclosure decisions becoming personal legal risks.