Some CSOs say ex-Uber CSO Joe Sullivan did nothing wrong and his trial tests criminal penalties they may face over security lapses or challenges in gray areas
Joe Sullivan, a former federal prosecutor, is accused of helping to cover up a security breach, a charge he denies
Context & Ripple Effects
Joe Sullivan's trial opened on September 6 with his lawyers arguing Uber made him a scapegoat for the 2016 breach amid the chaos following Travis Kalanick's exit framing him as the company's fall guy. The case traces back to his 2020 obstruction charge for concealing the hack of millions of users and drivers from FTC officials the original federal charge, and a June ruling that he must also face wire fraud charges.
What makes the story bigger than one executive is the reaction inside the profession: fellow chief security officers are publicly saying Sullivan did nothing wrong, treating the case as a referendum on whether they can be criminally punished for gray-area handling of breaches. The stakes were settled weeks later when a jury found him guilty of failing to disclose the breach to regulators the October verdict.
First-order effects
- Sullivan personally faces conviction and sentencing for decisions he made as Uber's security chief, while the CSOs backing him now have to weigh their own legal exposure every time they handle a breach disclosure.
Second-order effects
- Companies hiring security chiefs will likely demand that breach-response decisions be escalated, documented, and shared with counsel so liability does not sit with the CSO alone, changing how security reports to boards and general counsels.
Third-order effects
- If concealment rather than the breach itself is what draws prosecution, the structural lesson for the industry is that quiet hacker payoffs and delayed regulator disclosure carry personal criminal risk, pushing breach response toward immediate disclosure as the defensible default.
The trend: Breach disclosure is shifting from an internal judgment call by security executives to a legally fraught decision with direct personal criminal exposure for the people who make it.