“He took many steps to keep the F.T.C. and others from finding out about it,” Benjamin Kingsley, an assistant U.S. attorney, said during closing arguments on Friday. “This was a deliberate withholding and concealing of information.”
Mr. Sullivan did not reveal the 2016 hack to Uber’s general counsel, according to court testimonies and documents. He did discuss the breach with another Uber lawyer, Craig Clark.
Like Mr. Sullivan, Mr. Clark was fired by Mr. Khosrowshahi after the new chief executive learned about the details of the breach. Mr. Clark was given immunity by federal prosecutors in exchange for testifying against Mr. Sullivan.
Mr. Clark testified that Mr. Sullivan had told the Uber security team that they needed to keep the breach secret and that Mr. Sullivan had changed the nondisclosure agreement signed by the hackers to make it falsely seem that the hack was white-hat research.
Mr. Sullivan said he would discuss the breach with Uber’s “A Team” of top executives, according to Mr. Clark’s testimony. He shared the matter with only one member of the A Team: the chief executive at the time, Travis Kalanick. Mr. Kalanick approved the $100,000 payment to the hackers, according to court documents.
Lawyers for Mr. Sullivan argued that he had merely been doing his job.
They argued that Mr. Sullivan and others had used the bug bounty program and the nondisclosure agreement to prevent user data from being leaked — and to identify the hackers — and that Mr. Sullivan had not concealed the incident from the F.T.C.