US jury convicts former Uber security chief of covering up hack

A jury on Wednesday found Uber's former security chief guilty of federal crimes for covering up a massive hack that compromised personal information of users and drivers, according to US media reports.

Joseph Sullivan was found guilty of obstructing the work of the Federal Trade Commission and of failing to let authorities know about a crime when he hid a 2016 hack instead of reporting it, according to news outlets.

Sullivan could be sentenced to prison time.

Sullivan sought to pay off the hackers by funnelling money through a "bug bounty" program that rewards developers for revealing security vulnerabilities without doing any harm, according to the criminal complaint.

Uber paid the hackers $100,000 in bitcoin cryptocurrency in December 2016, and Sullivan wanted them to sign non-disclosure agreements promising to keep mum about the affair, prosecutors said.

Sullivan was Uber chief security officer from April 2015 to November 2017.

The criminal complaint maintains that Sullivan deceived Uber's new chief executive Dara Khosrowshahi, appointed in mid-2017 to replace Travis Kalanick, about the breach.

"Silicon Valley is not the Wild West," US Attorney David Anderson for the Northern District of California said in a statement when the charges were filed.

"We will not tolerate corporate cover-ups. We will not tolerate illegal hush money payments."

Two members of the Uber information security team who "led the response" that included not alerting users about the data breach were let go from the San Francisco-based company, according to Khosrowshahi.

The Uber chief said he had learned that outsiders broke into a cloud-based server used by the company for data and downloaded a significant amount of information.

"It highlights the personal liability involved in being a CISO in a dynamic policy, legal, and attacker environment."