Joe Sullivan (Internet security expert)

Sullivan was born in 1968 in Rutland, Vermont.{{cite web|url=https://fortune.com/2014/07/02/10-questions-joe-sullivan-chief-security-officer-facebook/|title=10 Questions: Joe Sullivan, chief security officer, Facebook|last=Bessette|first=Chanelle|work=Fortune|date=2014-07-02|archive-url=https://web.archive.org/web/20200719224141/http://fortune.com/2014/07/02/10-questions-joe-sullivan-chief-security-officer-facebook/|archive-date=2020-07-19|access-date=2021-12-29}}{{subscription required}}{{cite journal|url=https://issuu.com/irishamerica/docs/ia_december_january_2017/76|title=31st Annual Irish America Business 100|journal=Irish America|date=December 2016 |page=76|issue=January 2017|via=Issuu|access-date=2021-12-29}} He grew up in Cambridge, Massachusetts.{{cite web|url=https://www.forbes.com/sites/kashmirhill/2012/02/22/facebooks-top-cop-joe-sullivan/|title=Facebook's Top Cop: Joe Sullivan|last=Hill|first=Kashmir|work=Forbes|date=2012-02-22|archive-url=https://web.archive.org/web/20201219212752/https://www.forbes.com/sites/kashmirhill/2012/02/22/facebooks-top-cop-joe-sullivan/|archive-date=2020-12-19|access-date=2021-12-29}} Sullivan graduated from Matignon High School in 1986, earned his Bachelor of Arts degree at Providence College in 1990, and graduated from the University of Miami School of Law in 1993.

After law school, Sullivan spent the first eight years of his career in the Department of Justice, having started as an intern at the DOJ Miami office in 1992 and then ultimately working at the San-Francisco office with Robert Mueller.{{cite web|url=https://www.law.miami.edu/news/2015/october/joseph-sullivan-jd-’93-guards-against-security-threats|title=Joseph Sullivan, J.D. '93, Guards Against Security Threats|last=Westlund|first=Richard|publisher=University of Miami School of Law|date=2015-10-14|archive-url=https://web.archive.org/web/20151220152515/https://www.law.miami.edu/news/2015/october/joseph-sullivan-jd-%E2%80%9993-guards-against-security-threats|archive-date=2015-12-20|access-date=2022-01-05}} From 1997 to 1999, he served as Assistant United States Attorney at the District of Nevada in Las Vegas.

From 2000 to 2002, Sullivan worked as Assistant US Attorney at the Northern District of California.{{cite web|url=https://docs.cpuc.ca.gov/PublishedDocs/Efile/G000/M190/K624/190624373.PDF|title=Reply Comments of Rasier Ca, LLC on Phase III.B Scoping Memo and Ruling of Assigned Commissioner Track I|page=2|publisher=California Public Utilities Commission|date=2017-05-15|archive-url=https://web.archive.org/web/20220108085916/https://docs.cpuc.ca.gov/PublishedDocs/Efile/G000/M190/K624/190624373.PDF|archive-date=2022-01-08|access-date=2022-01-08}} He was a founding member of the Computer Hacking and Intellectual Property unit at the Northern District of California.{{cite web|url=https://www.cnet.com/tech/services-and-software/at-facebook-defense-is-offense/|title=At Facebook, defense is offense|last=Mills|first=Elinor|website=CNET|date=2011-01-31|archive-url=https://web.archive.org/web/20220108182039/https://www.cnet.com/tech/services-and-software/at-facebook-defense-is-offense/|archive-date=2022-01-08|access-date=2022-01-08}} In 2001 and 2002, together with Scott Frewing he represented the U.S. government in United States v. Elcom Ltd. case, the first prosecution in the U.S. under the Digital Millennium Copyright Act.{{cite press release|url=https://www.justice.gov/archive/criminal/cybercrime/press-releases/2001/sklyarovAgree.htm|title=Russian National Enters into Agreement with the United States on First Digital Millennium Copyright Act Case|publisher=United States Department of Justice|date=2001-12-13|archive-url=https://web.archive.org/web/20210401001458/https://www.justice.gov/archive/criminal/cybercrime/press-releases/2001/sklyarovAgree.htm|archive-date=2021-04-01|access-date=2022-01-08}}{{cite magazine|url=https://www.wired.com/2002/04/adobe-hack-lawyers-toss-the-case/|title=Adobe-Hack Lawyers: Toss the Case|last=Manjoo|first=Farhad|magazine=Wired|date=2002-04-01|archive-url=https://web.archive.org/web/20210410183434/http://www.wired.com/2002/04/adobe-hack-lawyers-toss-the-case/|archive-date=2021-04-10|access-date=2022-01-08}} Sullivan also worked on multiple cybercrime cases including digital evidence aspects of the 9/11 investigation, economic espionage and child predator cases.{{cite magazine|url=https://www.wired.com/2015/04/facebook-security-chief-joe-sullivan-join-uber/|title=Uber Just Poached Facebook's Security Chief Joe Sullivan|last=Hempel|first=Jessi|magazine=Wired|date=2015-04-02|archive-url=https://web.archive.org/web/20150402174537/https://www.wired.com/2015/04/facebook-security-chief-joe-sullivan-join-uber|archive-date=2015-04-02|access-date=2022-01-08}}

In April 2002, Sullivan joined eBay in as Senior Director of Trust and Safety.{{cite press release|url=https://obamawhitehouse.archives.gov/the-press-office/2016/04/13/president-obama-announces-more-key-administration-posts|title=President Obama Announces More Key Administration Posts|publisher=Executive Office of the President of the United States|location=Washington, D.C.|date=2016-04-13|archive-url=https://web.archive.org/web/20210322141834/https://obamawhitehouse.archives.gov/the-press-office/2016/04/13/president-obama-announces-more-key-administration-posts|archive-date=2021-03-22|access-date=2021-12-31}}{{cite web|url=https://www.law.com/almID/900005530164/?slreturn=20220008043242|title=Assistant U.S. Attorney Takes Job With EBay|last=Hoppin|first=Jason|website=Law.com|date=2002-05-07|archive-url=https://web.archive.org/web/20210301064145/https://www.law.com/almID/900005530164/|archive-date=2021-03-01|access-date=2022-01-08}} In a September 2006 United States congressional hearing, he described his duties as "overseeing company relations with law enforcement and regulatory agencies in the United States and Canada, directing the company's Fraud Investigations team and determining policies related to listing of items on eBay".{{cite book|url=https://books.google.com/books?id=-MqDe6avQDgC&pg=PA66|title=Deleting Commercial Pornography Sites from the Internet: The U.S. Financial Industry's Efforts to Combat this Problem: Hearing Before the Subcommittee on Oversight and Investigations of the Committee on Energy and Commerce, House of Representatives, One Hundred Ninth Congress, Second Session|date=September 21, 2006|page=66|volume=4|publisher=United States Government Publishing Office|isbn=9780160783104 |via=Google Books|access-date=2021-12-31}} In 2003, he was criticized by Yuval Dror at the Haaretz newspaper for being willing to share eBay user's personal data with law-enforcement agencies potentially without proper legal framework.{{cite news|url=https://www.haaretz.com/1.4900415|title=Big Brother Is Watching You - and Documenting|last=Dror|first=Yuval|newspaper=Haaretz|date=2003-02-20|archive-url=https://web.archive.org/web/20211115014150/https://www.haaretz.com/1.4900415|archive-date=2021-11-15|access-date=2021-12-31}}{{cite book|url=https://books.google.com/books?id=egJ-DwAAQBAJ&pg=PA417|title=Mathematics for the Environment|last=Walter|first=Martin|publisher=CRC Press|year=2011|page=417|isbn=9781439834732|via=Google Books|access-date=2021-12-31}} From 2006 to 2008 he was an Associate General Counsel at PayPal. One of his top priorities was preventing phishing scams.{{cite web|url=https://www.networkworld.com/article/2296999/paypal-asking-e-mail-services-to-block-messages.html|title=PayPal asking e-mail services to block messages|last=Kirk|first=Jeremy|website=networkworld.com|date=2007-03-27|archive-url=https://archive.today/20211231142556/https://www.networkworld.com/article/2296999/paypal-asking-e-mail-services-to-block-messages.html|archive-date=2021-12-31|access-date=2021-12-31}}

In 2008, he started at Facebook first as an attorney, and next as its Chief Security Officer (2010-2015). Sullivan assembled a security team to handle requests from law enforcement agencies globally and fight various types of cybercrime within the social network. He introduced a practice of security hackathons and bug bounty programs both internally and externally, encouraging coders to find vulnerabilities.{{cite web|url=https://money.cnn.com/2011/08/30/technology/facebook_bug_bounty/index.htm|title=Facebook pays $40,000 to bug spotters|last=Segall|first=Laurie|website=CNN Money|date=2011-08-30|archive-url=https://web.archive.org/web/20111015043425/https://money.cnn.com/2011/08/30/technology/facebook_bug_bounty/index.htm|archive-date=2011-10-15|access-date=2022-01-15}}{{cite web|url=https://techcrunch.com/2014/03/18/facebook-security|title=Inside Facebook's Efforts To Fortify Security In A Post-Snowden World|last=Constine|first=Josh|website=TechCrunch|date=2014-03-18|archive-url=https://web.archive.org/web/20210415113229/https://techcrunch.com/2014/03/18/facebook-security/|archive-date=2021-04-15|access-date=2022-01-15}} His team was handling complicated and large-scale security issues such as an attempt to hack the accounts of Tunisian Facebook users in the 2011 "Arab Spring" during the Tunisian Revolution.{{cite web|url=https://www.businessinsider.com/tunisia-facebook-2011-1|title=How The Tunisian Government Tried To Steal The Entire Country's Facebook Passwords|last=Gobry|first=Pascal-Emmanuel|website=Business Insider|date=2011-01-24|archive-url=https://web.archive.org/web/20201111231423/https://www.businessinsider.com/tunisia-facebook-2011-1?r=DE&IR=T|archive-date=2020-11-11|access-date=2022-01-15}}{{cite web|url=https://www.theatlantic.com/technology/archive/2011/01/the-inside-story-of-how-facebook-responded-to-tunisian-hacks/70044/|title=The Inside Story of How Facebook Responded to Tunisian Hacks|last=Madrigal|first=Alexis C.|work=The Atlantic|date=2011-01-24|archive-url=https://web.archive.org/web/20211211203858/https://www.theatlantic.com/technology/archive/2011/01/the-inside-story-of-how-facebook-responded-to-tunisian-hacks/70044/|archive-date=2021-12-11|access-date=2022-01-15}}

Sullivan also gained a reputation as an expert at fighting online bullying. He testified on this subject before Congress in 2010,{{cite web|url=https://www.govinfo.gov/content/pkg/CHRG-111hhrg57673/html/CHRG-111hhrg57673.htm|title=Hearing before the Subcommitee on Crime, Terrorism, and Homeland Security of the Committee on the Judiciary House of Representatives|publisher=United States Government Publishing Office|date=2010-07-28|archive-url=https://web.archive.org/web/20220121184409/https://www.govinfo.gov/content/pkg/CHRG-111hhrg57673/html/CHRG-111hhrg57673.htm|archive-date=2022-01-21|access-date=2022-01-21}} and was invited to the first White House Conference on Bullying Prevention in 2011.{{cite web|url=https://edition.cnn.com/2011/POLITICS/03/10/obama.bullying/index.html|title=White House conference tackles bullying|last=Shepherd|first=Shawna|publisher=CNN|date=2011-03-10|archive-url=https://web.archive.org/web/20110313095415/http://edition.cnn.com/2011/POLITICS/03/10/obama.bullying/index.html|archive-date=2011-03-13|url-status=live|access-date=2022-01-21}}

In Spring 2015, Sullivan joined Uber as its first CSO, at the time when the company was experiencing multiple safety and security issues.{{cite book|url=https://books.google.com/books?id=l-RoDwAAQBAJ&pg=PA122|title=Hacking and Data Privacy: How Exposed Are We?|author=The New York Times Editorial Staff|page=122|publisher=Rosen Publishing|year=2018|isbn=9781642820836|via=Google Books}}{{cite web|url=https://www.nytimes.com/2015/04/03/technology/uber-hires-a-security-chief-from-facebook.html|title=Uber Hires a Security Chief From Facebook|last=Isaac|first=Mike|newspaper=The New York Times|date=2015-04-02|archive-url=https://web.archive.org/web/20150405005420/https://www.nytimes.com/2015/04/03/technology/uber-hires-a-security-chief-from-facebook.html|archive-date=2015-04-05|access-date=2022-01-21}} His primary focus was on safety of riders and drivers, both in the digital space and in the physical world.{{cite book|url=https://books.google.com/books?id=HiP6DAAAQBAJ&pg=PA142|title=Wild Ride: Inside Uber's Quest for World Domination|last=Lashinsky|first=Adam|page=142|publisher=Penguin Books|year=2017|isbn=9780735211407|via=Google Books}} As an example, he was involved in investigating the 2016 Kalamazoo shootings.{{cite news|url=https://www.theguardian.com/technology/2016/feb/22/uber-driver-shooting-spree-kalamazoo-michigan-ride-share-safety|title=Kalamazoo shooting spree puts Uber in spotlight over safety concerns|last=Bowles|first=Nellie|location=San Francisco|newspaper=The Guardian|date=2016-02-22|archive-url=https://web.archive.org/web/20210618212311/https://www.theguardian.com/technology/2016/feb/22/uber-driver-shooting-spree-kalamazoo-michigan-ride-share-safety|archive-date=2021-06-18|access-date=2022-01-21}}

In November 2017, Sullivan and Craig Clark, a senior lawyer at the company, were fired for allegedly covering up a major data breach in 2016 and paying hackers $100,000.{{cite web|url=https://www.usatoday.com/story/tech/2017/11/21/uber-kept-mum-year-hack-info-57-million-riders-and-drivers/887002001/|title=Uber paid hackers $100,000 to hide year-old breach of 57 million users|last=Weise|first=Elizabeth|newspaper=USA Today|date=2017-11-27|archive-url=https://web.archive.org/web/20211127212444/https://eu.usatoday.com/story/tech/2017/11/21/uber-kept-mum-year-hack-info-57-million-riders-and-drivers/887002001/|archive-date=2021-11-27|access-date=2022-01-21}}{{cite news|url=https://www.nytimes.com/2018/01/12/technology/uber-hacker-payment-100000.html|title=Inside Uber's $100,000 Payment to a Hacker, and the Fallout|location=San Francisco|last1=Perlroth|first1=Nicole|last2=Isaac|first2=Mike|newspaper=The New York Times|date=2018-01-12|archive-url=https://web.archive.org/web/20210403153421/https://www.nytimes.com/2018/01/12/technology/uber-hacker-payment-100000.html|archive-date=2021-04-03|access-date=2022-01-21}} Later in 2018, Reuters reported that the decision not to disclose the breach was made by the company's legal department.{{cite web|url=https://www.reuters.com/article/us-uber-sullivan-exclusive/exclusive-current-and-former-uber-security-staffers-cast-doubt-on-spying-claims-idUSKBN1F200Q|title=Exclusive: Current and former Uber security staffers cast doubt on spying claims|last1=Menn|first1=Joseph|last2=Somerville|first2=Heather|work=Reuters|date=2018-01-13|archive-url=https://web.archive.org/web/20200719155624/https://www.reuters.com/article/us-uber-sullivan-exclusive/exclusive-current-and-former-uber-security-staffers-cast-doubt-on-spying-claims-idUSKBN1F200Q|archive-date=2020-07-19|access-date=2022-01-21}}

In May 2018, Sullivan joined Cloudflare as the company's first chief security officer.{{cite web|url=https://www.cnbc.com/2018/05/16/fired-uber-cybersecurity-chief-joe-sullivan-joins-start-up-cloudflare.html|title=Fired Uber cybersecurity chief Joe Sullivan was just hired to run security at start-up Cloudflare|last=Aiello|first=Chloe|publisher=CNBC|date=2018-05-16|archive-url=https://web.archive.org/web/20210226172729/https://www.cnbc.com/2018/05/16/fired-uber-cybersecurity-chief-joe-sullivan-joins-start-up-cloudflare.html|archive-date=2021-02-26|access-date=2022-01-01}} In December 2021, he was among the top Internet security experts who were exploring the Log4Shell vulnerability.{{cite web|url=https://thehill.com/policy/cybersecurity/585370-officials-experts-sound-the-alarm-about-critical-cyber-vulnerability|title=Officials, experts sound the alarm about critical cyber vulnerability|last=Miller|first=Maggie|website=The Hill|date=2021-12-10|archive-url=https://web.archive.org/web/20211220021005/https://thehill.com/policy/cybersecurity/585370-officials-experts-sound-the-alarm-about-critical-cyber-vulnerability|archive-date=2021-12-20|access-date=2022-01-01}}

Over the years, Sullivan has held several positions at government agencies and national organizations. From 2011 to 2016, he served as a commissioner at National Cyber Security Alliance, a non-profit organization that promotes cybersecurity and privacy education,{{cite web|url=https://securitytoday.com/articles/2011/02/07/facebook-chief-security-officer-joins-national-cybersecurity-alliance-board.aspx|title=Facebook Chief Security Officer Joins National Cyber Security Alliance Board|website=securitytoday.com|date=2011-02-07|archive-url=https://archive.today/20220101192759/https://securitytoday.com/articles/2011/02/07/facebook-chief-security-officer-joins-national-cybersecurity-alliance-board.aspx|archive-date=2022-01-01|access-date=2022-01-01}}{{cite web|url=https://www.nist.gov/cybercommission/joseph-sullivan|title=Joseph Sullivan|website=National Cyber Security Alliance|date=26 April 2016 |archive-url=https://archive.today/20220101193833/https://www.nist.gov/cybercommission/joseph-sullivan|archive-date=2022-01-01|access-date=2022-01-01}} where he ran a number of cyber security awareness initiatives.{{cite web|url=https://techcrunch.com/2012/10/22/in-recognition-of-its-efforts-in-fighting-cybercrime-facebook-donates-250000-to-university-of-alabama-using-money-acquired-from-spammers/|title=Facebook Donates $250,000 To The University of Alabama At Birmingham Using Money Acquired From Spammers|last=Perez|first=Sarah|website=TechCrunch|date=2012-10-22|archive-url=https://web.archive.org/web/20220101202509/https://techcrunch.com/2012/10/22/in-recognition-of-its-efforts-in-fighting-cybercrime-facebook-donates-250000-to-university-of-alabama-using-money-acquired-from-spammers/|archive-date=2022-01-01|access-date=2022-01-03}}{{cite web|url=https://www.upi.com/Defense-News/2014/10/01/Nashville-event-kicks-off-National-Cyber-Security-Awareness-Month/6961412181419/|title=Nashville event kicks off National Cyber Security Awareness Month|last=Tomkins|first=Richard|work=United Press International|date=2014-10-01|archive-url=https://web.archive.org/web/20201111203021/https://www.upi.com/Defense-News/2014/10/01/Nashville-event-kicks-off-National-Cyber-Security-Awareness-Month/6961412181419/|archive-date=2020-11-11|access-date=2022-01-03}} In 2012, he became a board member for the National Action Alliance for Suicide Prevention and co-authored the "2012 National Strategy for Suicide Prevention".{{cite web|url=https://www.johnjordanphd.com/pdf/NSSP%20Final.pdf|title=2012 National Strategy for Suicide Prevention: Goals and Objectives for Action|year=2012|publisher=Surgeon General of the United States|archive-url=https://web.archive.org/web/20180820034513/http://johnjordanphd.com/pdf/NSSP%20Final.pdf|archive-date=2018-08-20|access-date=2021-01-03}}

In April 2016, President Obama appointed him as a commissioner on the Commission on Enhancing National Cybersecurity, a government body that was dissolved in December 2016 after releasing recommendations to the White House on how to address the nation's cybersecurity issues.{{cite web|url=https://fcw.com/security/2016/12/53-steps-to-stronger-cybersecurity/220419/|title=53 steps to stronger cybersecurity|last=Rockwell|first=Mark|website=Federal Computer Week|date=2016-12-02|archive-url=https://archive.today/20220101184737/https://fcw.com/security/2016/12/53-steps-to-stronger-cybersecurity/220419/|archive-date=2022-01-01|access-date=2022-01-01}}

In August 2020, the US Department of Justice announced criminal charges against Sullivan for obstruction of justice for his handling of the 2016 data breaches at Uber. The criminal complaint said Sullivan arranged, with CEO Travis Kalanick's knowledge, to pay a ransom for the breach as a "bug bounty" to conceal its true nature, and to falsify non-disclosure agreements with the hackers to say they had not obtained any data.{{Cite news |url=https://www.npr.org/2020/08/20/904113981/former-uber-executive-charged-with-paying-hush-money-to-conceal-massive-breach|title=Former Uber Executive Charged With Paying 'Hush Money' To Conceal Massive Breach|first=Shannon|last=Bond|publisher=NPR|date=2020-08-20|archive-url=https://web.archive.org/web/20220121203321/https://www.npr.org/2020/08/20/904113981/former-uber-executive-charged-with-paying-hush-money-to-conceal-massive-breach|archive-date=2022-01-21|access-date=2022-01-21}} In December 2021, he faced additional charges of wire fraud.{{cite web|url=https://www.bloomberg.com/news/articles/2021-12-23/uber-ex-security-chief-faces-additional-charges-of-wire-fraud|title=Uber Ex-Security Chief Faces Additional Charge|last=Shneider|first=Joe|work=Bloomberg News|date=2021-12-23|archive-url=https://archive.today/20211226221936/https://www.bloomberg.com/news/articles/2021-12-23/uber-ex-security-chief-faces-additional-charges-of-wire-fraud|archive-date=2021-12-26|access-date=2022-01-21}}

On October 6, 2022, Sullivan was convicted of one count of obstruction of justice, and one count of misprision of felony.{{cite news|url=https://www.washingtonpost.com/technology/2022/10/05/uber-obstruction-sullivan-hacking/|title=Former Uber security chief convicted of covering up 2016 data breach|last=Menn|first=Joseph|newspaper=Washington Post|date=2022-10-06|archive-url=https://archive.today/20221005215258/https://www.washingtonpost.com/technology/2022/10/05/uber-obstruction-sullivan-hacking/|archive-date=2022-10-05|access-date=2022-10-06}}{{cite magazine |last1=Newman |first1=Lily Hay |title=The Uber Data Breach Conviction Shows Security Execs What Not to Do |url=https://www.wired.com/story/uber-joe-sullivan-conviction/ |magazine=Wired |access-date=17 November 2022}} He was sentenced to three years probation on May 4, 2023.{{cite news |last1=Menn |first1=Joseph |title=Former Uber security chief Sullivan avoids prison in data breach case |url=https://www.washingtonpost.com/technology/2023/05/04/sullivan-sentencing-uber-executive/ |access-date=May 5, 2023 |newspaper=Washington Post |date=May 4, 2023}} The trial of Sullivan represented the first United States federal prosecution of a corporate executive for the handling of a data breach.{{cite web |title=The Fallout From the First Trial of a Corporate Executive for 'Covering Up' a Data Breach |url=https://www.lawfaremedia.org/article/fallout-first-trial-corporate-executive-covering-data-breach |website=Lawfare |access-date=17 November 2022 |language=en |date=19 October 2022}}

• {{cite book|title=Super Pumped|last=Isaac|first=Mike|year=2019|publisher=W. W. Norton & Company|isbn=978-0-393-65224-6}}

{{reflist}}

{{Authority control}}

{{DEFAULTSORT:Sullivan, Joe}}

Category:Assistant United States attorneys

Category:People from Rutland (city), Vermont

Category:American people of Irish descent

Category:Providence College alumni

Category:University of Miami School of Law alumni

Category:EBay employees

Category:PayPal people

Category:Cloudflare people

Category:Facebook employees

Category:Chief security officers

Category:1968 births

Category:Living people