November 14, 2016. Ten days after Sullivan swore to the FTC that Uber had fixed its data security.
Picture the email landing in Joseph Sullivan’s inbox. Uber’s chief security officer opens it and finds two hackers telling him they’ve pulled data on 57 million riders and drivers out of an AWS account, and they want to be paid to make it go away.
Ten days earlier, Sullivan had testified under oath to the Federal Trade Commission, on November 4, 2016, about the steps Uber had taken to secure customer data. That testimony was tied to the FTC’s investigation of an earlier, 2014 breach. Here’s the detail that should stop you cold: the gap the 2016 hackers exploited traced back to the same root problem as 2014: AWS credentials sitting exposed in a GitHub repository used by Uber engineers. It wasn’t a carbon copy: in 2014 the key sat in a public repo anyone could read, while in 2016 the hackers first had to steal an Uber engineer’s GitHub login through credential stuffing before they could reach the private repo holding the AWS keys. Same failure mode, one extra step, and it still put them straight into the storage bucket holding the records.
Sullivan did not go to the FTC. He did not go to the board. According to prosecutors, he told a subordinate the incident had to be “tightly controlled,” and that outside the security team, “this investigation does not exist.”
Instead, he arranged for Uber to pay the two hackers $100,000, not as a ransom, but through Uber’s HackerOne-run bug-bounty program, the very channel the company used to reward researchers who reported vulnerabilities responsibly. The hackers were required to sign a non-disclosure agreement, including a representation that they had not taken or retained any data. On paper, a felony data theft had just become a paid bug report. (Walter White would call this a car wash.)
That paperwork outlived the story it was meant to bury. The breach stayed hidden for about a year, until Uber’s new CEO, Dara Khosrowshahi, discovered it and disclosed it to the FTC and the public in November 2017. Uber later paid $148 million to settle claims from all 50 states and the District of Columbia over the concealment. Sullivan was indicted in 2020, tried in 2022, and on October 5, 2022 a jury convicted him of obstructing the FTC’s proceeding and of misprision of felony (failing to report a crime he knew about). Wire fraud charges the government had also brought were dismissed before trial. In May 2023, Judge William Orrick sentenced him to three years of probation, 200 hours of community service, and a $50,000 fine. He served no prison time, despite prosecutors asking for roughly 15 months. The Ninth Circuit affirmed the conviction in March 2025.
The artifact: not the breach, the record of how it was handled
Strip away the drama and the hack itself was almost incidental to the prosecution. The two people who actually broke into the AWS account, Brandon Glover and Vasile Mereacre, pleaded guilty and cooperated with the government, later testifying at Sullivan’s trial. The case against Sullivan was never really about the intrusion. It was built on what happened after: the ticket in the bug-bounty system, the size and routing of the payment, the wording of the NDA, and the internal messages describing how the incident should be discussed.
Even the cover-up left its own fingerprints. Uber’s bug-bounty NDA was signed electronically through AdobeSign, and the platform’s own audit metadata (including an IP address tied to the signature) was exactly what Uber’s own security investigators used to track the “researchers” back to the real intrusion, a detail that resurfaced as evidence at Sullivan’s trial. The very system built to make the payout look routine kept a precise log of exactly who received it. It was working exactly as designed, and that was the problem. (Turns out the cloud remembers everything, even the things you paid it to forget.)
That is the pattern a court-appointed software expert has to work with in a breach-response case: not one hack, but a stack of systems, the bug-bounty platform, the e-signature service, email, Slack, the ticketing tool, each quietly producing its own record, whether anyone intended it to or not.
Why this needs an expert witness, not a lawyer alone
A generalist reading this case sees a fraud story: pay the hackers, hide the breach, get caught. A court-grade software expert reads it as an evidence-architecture problem: which systems generated a record of the incident, in what order, who could access and alter the classification, and whether the sequence of tickets, payments, and signatures matches the sequence of events the company later told regulators.
That’s a narrow technical question, not a legal judgment call: define what the bug-bounty ticket, the NDA, and the payment record actually show; establish in what order they were created and modified; list the systems and logs that must be preserved before anyone “cleans up” an incident channel; apply a repeatable method for reconstructing the timeline; and be ready to defend that reconstruction under cross-examination.
Security teams and their counsel who wait until the regulator asks are already behind. On day one of any material incident, the question isn’t “how do we message this.” It’s “what does the record say happened, and can we prove it.”
This is where a source code expert witness earns its place — a document that explains the finding rather than just presenting it.
For Israeli GCs and CISOs
Israeli companies run bug-bounty and vulnerability-disclosure programs on the same platforms Uber did. A payout ticket, an NDA template, and a chat thread deciding “who needs to know” look like operational paperwork. If a breach becomes a regulatory or civil matter, they become the evidence.
Sullivan’s case isn’t a lesson about avoiding bug bounties. The moment a security incident starts generating tickets, approvals, and signed documents, treat that trail as if a court will read it, because it might.
The above is general information only and does not constitute legal advice. Specific facts of the case cited are drawn from the sources listed.