Respond to prefers-color-scheme dark in app web views

Follow section front redirects in Spectrum

Enable NLP source in PCS for load testing

Switch off the News Alerts Survey Widget when we have enough responses

Poll to determine if new LUF updates are available

Allows the winning A/B test variant to be turned on without Spectrum deployment

Show infinite scrolling sections in Assembler MultiView

Show option for NLP article summaries in Action Bar

Show NLP summaries collection recirc on article pages

A general feature flag for Recipe Features that aren't yet released

Feature flag for media team features that aren't yet released

Use new Orca video player for preroll plugin in Spectrum

Show the snow tracker (instead of the heat tracker) on Spectrum

Fooled by AI? These firms sell deepfake detection that’s ‘REAL 100%.’ 

Apple apologizes for iPad ad after blowback 

Google’s new ‘Find My’ device network is useful but a stalking risk

Eighth-inning decision burns the Nats in a 4-2 loss to the Red Sox

Commanders rookie DT Johnny Newton needs a second foot surgery

Nats win opener at Fenway behind Patrick Corbin and a lockdown bullpen

Tens of thousands in Georgia protest Russian-style ‘foreign agents’ law

Israel says 300,000 fled Gaza fighting; military expands operation in Rafah

Israel orders more Rafah evacuations, expanding military operation

‘Bunker mentality’ at Columbia lit protest spark that spread nationwide

A mystery illness stole their kids’ personalities. These moms fought for answers.

The greatness — yes, greatness — of the Planet of the Apes

An unexpected sight to behold: Ted Cruz working bipartisan deals

Narrative of Trump snoozing in court takes hold — much to his annoyance

Manafort will no longer take on Republican convention role

I used to dismiss my mom’s advice. Then I found a note she wrote before she died.  

Photos of his mom at lunch are a balm people didn’t know they needed

Dog hit by car loses leg, is adopted by firefighter who helped her

Ask Amy: Mother isn’t accepting of her gay son

Carolyn Hax: Keep scrolling seven hours per day, or give therapy a try?

Miss Manners: Journalist posts on social media about a typo at another outlet

Cruise ship drags dead whale into New York, prompting investigation

5 big travel lessons from an accomplished conservationist

The case for eating at Italian gas stations

Courtroom photo ban adds to hurdles for Trump trial journalists

Israel’s shameful ban on Al Jazeera

Checks, not sex, and other takeaways from Trump’s New York hush money trial

The urgent air defense lessons of April 16 

Are smartphones destroying childhood? It’s complicated.

In the campaign against Donald Trump, do the ends justify the means?

In photos: Scenes from the grand final of the 2024 Eurovision competition

Bishop vanished. His species can still be saved.

Northern lights glow worldwide

Claire Messud turns her family’s history into a masterpiece

Kristi Noem’s dog killing is pure Southern gothic

Joseph Epstein, conservative provocateur, tells his life story in full

US-POLITICS-BIDEN

Big Tech news and how to take control of your data and devices

See more coverage in your recommendations

Technology

Tips delivered to your inbox twice weekly

The Tech Friend newsletter

Business and Tech alerts

Get the weekly Campaign Moment newsletter

Set alerts for major election developments

Election 2024

The Campaign Moment newsletter

Politics alerts

Jeff Chiu

SAN FRANCISCO — Former Uber chief security officer Joe Sullivan avoided prison Thursday as he was sentenced for covering up the 2016 theft of company data on 50 million Uber customers while the company was being investigated by the Federal Trade Commission over a previous breach.

Sullivan had been <a href="https://www.washingtonpost.com/technology/2022/10/05/uber-obstruction-sullivan-hacking/" target=_blank>convicted</a> in October of obstruction of justice and hiding a felony, making him the first corporate executive to be found guilty of crimes related to a data breach by outsiders.

U.S. District Judge William Orrick sentenced Sullivan to three years of probation, noting his significant past work in protecting people from the sort of crime he later concealed. He also said that Sullivan’s steps had succeeded in keeping the stolen data from being exposed.

Orrick said he felt former Uber chief executive Travis Kalanick was equally responsible for what he considered a serious offense, and he wondered aloud why Kalanick had not been charged. The judge also said he was influenced by the unprecedented nature of the case, warning that future offenders would be jailed, even if they were the pope.

Sullivan’s conviction had shocked many security professionals, many of whom saw Sullivan, a onetime federal cybercrime prosecutor, as an industry leader who also worked in the public interest as the top security executive at Facebook, Uber and Cloudflare.

They also criticized the government for criminalizing questionable judgment in paying off extortionists when the practice has become a regular occurrence at U.S. companies hit by <a href="https://www.washingtonpost.com/business/2021/05/12/ransomware-attack/" target="_blank" class="contextual_link">ransomware</a>. The FBI has said it will not pursue charges against those who approve payouts that do not go to gangs under sanctions for working in concert with Russian authorities or targeting critical infrastructure.

More than 180 letters were filed with the judge praising Sullivan and asking that he be spared jail time to continue helping defenders and victims of security failures. One of the letters was signed by 40 current or former chief security or chief information security officers.

But prosecutors sought 15 months in prison, arguing that so many people rallied to support Sullivan because he was wealthy and well-connected, and that justice required such defendants be treated the same way as poor outcasts.

Sullivan “has a spotless history. He is respected in his community. He is an innovator in his field,” the U.S. attorney’s office in San Francisco wrote in a sentencing memo. “But, when given the opportunity to choose between himself and adherence to the law, he chose himself. Worse than that, Defendant Sullivan prioritized his and Uber’s interests over those of the tens of millions of Uber users and riders who trusted their personal information to the company.”

Both sides said their favored outcome would help solidify cooperation between U.S. officials and private security efforts, a priority for the Biden administration as criminal hacking gets more sophisticated and more intertwined with foreign government interests.

Kiersten Todt, who recently stepped down as chief of staff at the federal Cybersecurity and Infrastructure Security Agency, wrote to the judge that top executives had warned her that the verdict would “make it impossible to recruit smart people into the roles of CISOs and CSOs if imprisonment is on the table — and will set the industry back.”

From the bench, Orrick said that letters in which other security executives said they too feared prosecution showed that the writers did not understand the facts of the case. He said Sullivan deliberately deceived the government, causing real harm to the FTC and the public.

Speaking briefly and emotionally before the judge pronounced the sentence, Sullivan took responsibility and apologized for hurting his family, friends and the “noble profession” of cybersecurity.

“I was a bad role model,” Sullivan said in a halting voice. “We’re there to be the champion of the customer, and I failed in this case.”

Citing the letters in their own memo, Sullivan’s attorneys recounted numerous good deeds, such as establishing eBay’s trust and safety team and a Facebook child-safety effort that his successor there, Alex Stamos, credited with delivering three-fourths of all notifications to the National Center for Missing and Exploited Children in 2021.

“It is not unreasonable to say that Joe and the handful of other executives who tackled this problem in those early days are likely responsible for more global prosecutions of child sexual exploitation than pretty much any other living people,” wrote Stamos, now director of the Stanford Internet Observatory.

The criminal case against Sullivan started when a hacker emailed Uber anonymously and described a security lapse that allowed him and a partner to download data from one of the company’s Amazon repositories.

It emerged that they had used a stray digital key Uber had left exposed to get into the Amazon account, where they found and extracted an unencrypted backup of data on more than 50 million Uber riders and 600,000 drivers.

Sullivan’s team steered them toward Uber’s bounty program and noted that the top payout under it was $10,000. The hackers said they would need six figures and threatened to release the data.

Negotiation ended with a $100,000 payment and a promise from the hackers that they had destroyed the data and would not disclose what they had done. While prosecutors called it a coverup, testimony showed that Sullivan’s staff used the process to get clues that would lead them to the real identities of the perpetrators, which they felt was necessary leverage to hold them to their word. The two were later arrested and pleaded guilty to hacking charges, and one testified for the prosecution in Sullivan’s trial.

The obstruction charge drew strength from the fact that Uber at the time was nearing the end of an FTC investigation following a major 2014 breach, which occurred before Sullivan joined the company.

While he directed the response to the two hackers, Sullivan kept many others at the company apprised, including a lawyer on Sullivan’s team, Craig Clark. Evidence showed that Sullivan told Kalanick, Uber’s CEO at the time, and that Kalanick approved Sullivan’s strategy. The company’s chief privacy lawyer, who was overseeing the response to the FTC, was informed, and the head of the company’s communications team also had details.

Clark, the designated legal lead on breaches, was given immunity to testify against his former boss. On cross-examination, he acknowledged advising the team that the attack would not have to be disclosed if the hackers were identified, agreed to delete what they had taken and could convince the company that they had not spread the data further, all of which eventually came to pass.

Prosecutors were left to challenge “whether Joe Sullivan could have possibly believed that,” as one of them put it in closing arguments. In his remarks Thursday, Sullivan said he should have gotten an outside legal opinion instead of being relieved at getting internal cover to avoid disclosure.

After Kalanick was forced out of the company for unrelated scandals, his successor, Dara Khosrowshahi, came in and learned of the breach. Sullivan described it as a routine bug bounty payout, prosecutors said, editing from one email the amount of the payoff and the fact that the hackers had obtained unencrypted data, including phone numbers, on tens of millions of riders. After a later investigation turned up the full story, Khosrowshahi testified, he fired Sullivan for not telling him more, sooner.

Eager to show that it was operating in a new era, the company helped the U.S. attorney’s office build a case against Sullivan. And the prosecutors in turn unsuccessfully pressed Sullivan to implicate Kalanick, who would have been a far bigger prize but was not damned by the surviving written evidence, according to people familiar with the process.

Top 10 nonfiction books of 2019, Hudson Booksellers

Top 10 nonfiction books of 2010, Hudson Booksellers

Book of the year finalist in 2003, Investigative Reporters & Editors 

Best in Business awards in 2017 and other years, Society for Advancing Business Editing and Writing

Gerald Loeb Awards finalist in 2017 and other years

Cult of the Dead Cow: How the Original Hacking Supergroup Might Just Save the World

Fatal System Error: The Hunt for the New Crime Lords who are Bringing Down the Internet

All the Rave: The Rise and Fall of Shawn Fanning's Napster

Harvard College, A.B. in English

Joseph Menn joined The Post in 2022 after two decades covering technology for Reuters, the Financial Times and the Los Angeles Times. His books include "Cult of the Dead Cow: How the Original Hacking Supergroup Might Just Save the World" (2019) and "Fatal System Error: The Hunt for the New Crime Lords who are Bringing Down the Internet" (2010). 