(Bloomberg) — When Joe Sullivan was fired from his job as Uber Technologies Inc.’s security chief, the ride-hailing giant declared a clean break from its problematic past.
Now, five years later, as he faces criminal charges stemming from an alleged coverup of a massive data breach, Sullivan wants to put the company, its current chief executive officer and its prior management team on trial with him.
Fighting charges that he concealed a 2016 theft of personal data of 50 million customers and 7 million drivers, Sullivan claims Uber’s legal department and other managers were aware of the incident before it blew up publicly. He also argues that Dara Khosrowshahi, who took over as CEO in 2017, had him fired in an effort to close a $9 billion investment deal with SoftBank Group Corp.
Read More: Uber to Pay $148 Million in Settlement Over 2016 Data Breach
As the case heads toward a September trial in San Francisco, prosecutors and Uber are aligned in arguing that Sullivan was a rogue employee. Uber’s attorney accused Sullivan’s lawyers of manufacturing a “conspiracy theory” about the company serving him up to the US Justice Department.
“It’s their own theory,” Douglas Sprague told US District Judge William Orrick at a February hearing.
Sullivan, a former federal prosecutor and longtime Silicon Valley fixture who previously headed security for Facebook, faces as long as 20 years in prison if convicted of the most serious charges against him — though his sentence would likely be far less.
He spent 2 1/2 years at Uber and gained a reputation as a fixer for then-CEO Travis Kalanick before a series of scandals drove the co-founder out of his job. Khosrowshahi then set out to clean house.
“We are changing the way we do business,” the new CEO wrote in a November 2017 blog post disclosing the data breach, the same week Uber fired Sullivan and another executive.
Uber’s Drive to Clean Up Its Act En Route to an IPO: QuickTake
Prosecutors first charged Sullivan in 2020. They alleged he entered into an agreement with the hackers designed to create a “misleading documentary record” to justify not disclosing the 2016 breach. Sullivan misrepresented the hack in an email to Khosrowshahi, minimizing its scope and how he resolved it, according to the government.
Sullivan says he has since learned from records disclosed in pretrial information sharing that Khosrowshahi apparently learned of the attack on the company’s servers when he joined Uber in August 2017.
Sullivan says that starting that same month, he sat for three interviews as part of the company’s investigation.
Uber was in negotiations with SoftBank at the time and hadn’t yet determined if it was required to disclose the 2016 hack — until the investment company learned some details and demanded it, according to court filings by Sullivan.
“SoftBank, in effect, put a gun to Uber’s head and required this disclosure,” John Cline, a lawyer for Sullivan, said during the February hearing.
The challenge for Sullivan is to back up that version of events at trial. He recently won court approval to subpoena Uber’s internal investigation of the breach and SoftBank’s records of its dealings with the company. Sullivan’s demand to see those documents is hotly contested.
“If Sullivan’s narrative wins out before the jury, and it turns out there were numerous executives who knew about the breach and sat on it, that doesn’t bode well for Uber,” said Michael Weinstein, a former federal prosecutor turned white-collar defense lawyer at Cole Schotz in New Jersey.
A win for Sullivan would erode Uber’s restored reputation and cast a new cloud on how it handles sensitive driver and customer data, such as home addresses, ride destinations, credit card numbers, Weinstein said. It also weakens the company’s position against regulators “overseeing what it does and how it does it,” he said.
On Thursday, lawyers for Sullivan will attempt to knock out three charges prosecutors added late last year, alleging he defrauded Uber drivers by failing to disclose the hack. If successful, that would pare the indictment to the two original counts alleging Sullivan obstructed an investigation and concealed the hack.
The additional charges amount to an attempt by prosecutors to dress-up an otherwise “unappealing” case into a “full-fledged fraud case with sympathetic victims,” Sullivan’s lawyers argued in a court filing.
Uber spokesman Matt Kallman declined to comment. Sullivan’s lawyer, Cline, and Abraham Simmons, a spokesman for the U.S. Attorney’s Office in San Francisco, declined to comment. A SoftBank spokesperson also declined to comment.
The case is U.S. v. Sullivan, 20-cr-00337, U.S. District Court, Northern District of California (San Francisco).
More stories like this are available on bloomberg.com
©2022 Bloomberg L.P.
