Mum's The Word? Think Again

The Department of Justice (DOJ) recently announced that Joe Sullivan, Uber's former Chief Security Officer, was charged with obstruction of justice and misprision of a felony in connection with a 2016 data breach at Uber and his actions in responding to the incident. DOJ's decision to prosecute Sullivan surprised many of us on our first read. The case appears to be one of the few times an American corporate executive has faced federal criminal charges and prison time for his or her response (or lack of response) to a data breach. Raising eyebrows further, some of the more muscular rhetoric coming out of DOJ—that the Department expects "prompt reporting of criminal conduct"—appeared to suggest that it decided to go after Sullivan because he failed to disclose a crime that someone else committed. Puzzling indeed, especially in light of the usual rule of thumb that failing to disclose a crime, without something more (such as an affirmative act of concealment), is