There has to be more to this story. I feel like he was probably railroaded by Uber's legal team/CEO and they did things he may not have been fully aware of. That's the only explanation I can come up with.
I look forward to him having his day in court to vindicate himself.
When we see accounts of someone that strongly conflict with our accounts of that person, our inclination is to believe that our view of that person is the "right" one. This is just an artifact of human's natural sensory self-centrism: you can only see him as the person you have seen him as.
The likely truth, about everyone, is that like a 3D object viewed from a single vantage point, that no one person ever truly knows another.
And obviously, everyone deserves their day in court.
1) https://web.archive.org/web/20200414123312/http://www.ubersc...
2) https://arstechnica.com/tech-policy/2017/12/new-letter-top-u...
I don't know whether Uber had a proper bug bounty program setup at the time this happened, nor whether this could be considered one, so I can't comment on the specifics.
In particular, part of Sullivan's cover-up efforts included passing the breach off as a $100,000 bug (their largest at the time) in the bounty program and trying to sign secret NDAs with the hackers. He also paid them a bitcoin ransom.
> Witnesses reported SULLIVAN was visibly shaken by the events.
It's a good read.
Puzzling case, as the hackers apparently moved on from Uber to hack other companies. Not something within Uber's control.
What appears to be making this a big deal is that Uber had been hacked several years prior, and was negotiating with the FTC over the breach; the 2016 breach was not timely disclosed to the FTC, despite formal statements being provided after the breach occurred.
Misleading the FTC is pretty clearly something that was under Uber's control.
With the hackers' identities known, Uber or Sullivan is able to use the threat of exposing their crime as leverage if they should notice that the PII is being exploited. The 100k doesn't make single-game game-theoretic sense but can guard against people who expect a tit-for-tat.