How the Uber data breach cover-up case unfolded

Hackers contact Sullivan about the breach, ten days after he testified to the FTC on 2016-11-04, according to prosecutors

Uber publicly discloses the 2016 incident

Federal charges against Sullivan announced

Uber non-prosecution agreement announced

Non-prosecution agreement with Uber Technologies, Inc.. According to the office's announcement, Uber admitted to and accepted responsibility for the acts of its officers, directors, employees and agents in concealing the 2016 breach from the FTC, and admitted that its personnel failed to report the breach while an FTC investigation was pending. The office cited Uber's cooperation, a new leadership team's disclosure of the breach in late 2017, remediation, an October 2018 FTC order and a $148 million settlement with all 50 states and the District of Columbia.

Sullivan sentenced to probation

Sentence, United States v. Joseph Sullivan. Three years of probation and a $50,000 fine. Reporting states 200 hours of community service were also ordered and that prosecutors had sought 15 months in prison.

Ninth Circuit affirms

Opinion, United States v. Sullivan, No. 23-927. Affirmed the conviction. Held that circuit precedent forecloses a separate nexus instruction for 18 U.S.C. 1505, that any error in the duty to disclose instruction was harmless, that the evidence supported the misprision count and that admitting a hacker's plea agreement was not an abuse of discretion.

Amended opinion issued and rehearing denied

Order and amended opinion, No. 23-927. Issued an amended opinion, again affirming, and denied rehearing en banc.