USA v. SullivanUSA v. Sullivan
SUMMARY*
Criminal Law
The panel affirmed Joseph Sullivan‘s jury conviction for obstruction of justice and misprision of a felony arising from his efforts, while the Chief Security Officer for Uber Technologies, to cover up a major data breach even as Uber underwent investigation by the Federal Trade Commission into the company‘s data security practices.
Sullivan argued that the district court erred in rejecting two of his proposed jury instructions regarding the obstruction charge.
- The panel held that United States v. Bhagat, 436 F.3d 1140 (9th Cir. 2006), forecloses Sullivan‘s argument that the district court erred by rejecting an instruction that would have required the jury to find that there was a “nexus” between his conduct and the pending FTC proceeding. The panel explained that Supreme Court cases cited by Sullivan are not clearly irreconcilable with Bhagat.
- Regarding Sullivan‘s contention that the district court erred by rejecting his “duty to disclose” instruction, the panel observed that the tandem prosecution under
18 U.S.C. § 1505 (the substantive obstruction statute) and18 U.S.C. § 2(b) (causing an act to be done) presented conjunctive theories of liability. Noting that Section 2(b) does not require a
* This summary constitutes no part of the opinion of the court. It has been prepared by court staff for the convenience of the reader.
defendant to have a duty to disclose if prosecuted for inaction, and that Sullivan conceded that Uber was duty-bound to respond to formal FTC inquiries issued to Uber, the panel held that the validity of the Section 2(b) theory rendered the omission of the duty-to-disclose instruction proper.
Sullivan argued that the evidence of his alleged misprision was insufficient as a matter of law. Misprision is the crime of “having knowledge of the actual commission of a felony” and “conceal[ing]” or failing to “as soon as possible make known the same to some judge or other person in civil or military authority under the United States.” To establish misprision, the government is obliged to show that the principal committed and completed the felony alleged. Here, that meant proving that hackers had intentionally accessed Uber‘s computers without authorization and thereby obtained information from those protected computers, in violation of the Computer Fraud and Abuse Act (CFAA).
- The panel held that the hackers’ illegal conduct could not be laundered through Uber‘s post hoc authorization, via a non-disclosure agreement (NDA), of their computer access.
- The panel held that the evidence does not support Sullivan‘s claim that, even if the hackers were unauthorized within the meaning of the CFAA, he reasonably believed that the NDA cleansed the felonious access of its illegality.
- The panel held that a rational jury could have found that Sullivan, who had been an Assistant U.S. Attorney in a “Computer Hacking and IP Unit,”
knew that the conduct in question was a felony punishable by more than a year in prison.
The panel held that the district court did not abuse its discretion in permitting
COUNSEL
Ross D. Mazer (argued) and Andrew F. Dawson, Assistant United States Attorneys; Merry Jean Chan, Chief, Appellate Section, Criminal Division; Matthew M. Yelovich, Attorney for the United States Acting Under Authority Conferred
Christopher J. Cariello (argued), Orrick Herrington & Sutcliffe LLP, New York, New York; Aravind Swaminathan, Orrick Herrington & Sutcliffe LLP, Seattle, Washington; Amari L. Hammonds, Orrick Herrington & Sutcliffe LLP, Los Angeles, California; for Defendant-Appellant.
Jeffrey R. Babbin and Nathan J. Guevremont, Wiggin & Dana LLP, New Haven, Connecticut; Anjali Dalal, Wiggin and Dana LLP, New York, New York; Gia L. Cincone, NACDL Amicus Committee, San Francisco, California; for Amici Curiae National Association of Criminal Defense Lawyers and Due Process Institute.
Nathan R. Morales, Stoel Rives LLP, Portland, Oregon; Matthew D. Segal, Stoel Rives LLP, Sacramento, California;
for Amici Curiae Cloud Security Alliance and Security Innovation Network.
McKEOWN, Circuit Judge:
Cybersecurity has become a major preoccupation of businesses as network hacks and data breaches multiply. Companies now turn to seasoned experts to address these challenges. Among the ranks of these experts is Joseph Sullivan, who served as the Chief Security Officer (“CSO“) for Uber Technologies (“Uber“) from 2015 to 2017. When he began at Uber, Sullivan‘s reputation was that of a “world-class” cybersecurity expert, with a stint as an Assistant U.S. Attorney and several years of private-sector leadership experience under his belt. This case arose from choices Sullivan made as Uber‘s CSO in the wake of a major data breach—specifically, his efforts to cover up that breach, even as Uber underwent investigation by the Federal Trade Commission (“FTC“) into the company‘s data security practices.
When the breach and its cover-up came to light after having remained hidden for over a year, the government brought criminal charges against Sullivan. A jury convicted him of obstruction of justice and misprision of a felony. On appeal, Sullivan challenges several jury instructions, the sufficiency of the evidence, and an evidentiary ruling. We affirm.
Background
In 2014, Uber experienced a data breach. A hacker discovered an Amazon Web Services (AWS) “key“—a type of log-in—embedded in code displayed publicly on GitHub, a platform on which developers store and sometimes share code. The hacker used the key to access the troves of data that Uber stored privately on AWS. From the AWS database, the hacker downloaded sensitive information pertaining to tens of thousands of Uber drivers.
In 2015, Uber hired Sullivan as its CSO. In August 2016, Sullivan took on the additional title of Deputy General Counsel. By then, Sullivan was very involved in Uber‘s response to the FTC‘s ongoing investigation: He made a presentation to FTC staff on Uber‘s data security program, and he testified before the Commission in an investigational hearing, including on Uber‘s practices of data encryption. He also supervised the preparation of at least two of Uber‘s official statements to the FTC.
Another data breach occurred in October 2016. Hackers gained access to Uber‘s private account on GitHub—the same platform as in the 2014 attack. Embedded in the code stored in that account, the hackers found AWS keys—the same types of keys, discovered in a similar way, as in the 2014 attack. The hackers used the keys to access Uber‘s AWS datastore and download the names and driver‘s license numbers of some 600,000 individuals—the same type of
breach on the same infrastructure, at an even larger scale, as in the 2014 attack. The downloaded data was unencrypted.
Despite the similarities between the 2016 incident and the 2014 incident that the FTC was already investigating, no one at Uber informed the FTC of this new breach. Instead, unbeknownst to federal officials, Sullivan and a group of Uber staffers decided to track down the hackers and pressure them into signing a non-disclosure agreement (“NDA“) that purported to re-characterize the hack as “research” into “vulnerabilities” under Uber‘s Bug Bounty Program.
Through bug bounty programs, companies solicit and reward
Sullivan also did not correct old statements, and instead signed off on new statements, to the FTC that Uber‘s stores of private data on AWS were encrypted, even though the breach had exposed the fact that some of this data was unencrypted. Sullivan did so despite his and his team‘s
awareness that he “was just deposed on this specific topic” and that news of the breach would “play very badly based on previous assertions” to the FTC about data encryption. In the fall of 2017, Uber hired a new CEO, Dara Khosrowshahi. Soon after, Sullivan informed Khosrowshahi of the hack, but he omitted and misrepresented key details: He falsely stated that no data had been downloaded; mischaracterized the timing of the payment to the hackers; and omitted the magnitude of the breach and the amount of money paid to resolve it. When Khosrowshahi discovered
Upon learning of the breach, the FTC revised its complaint against Uber, withdrew acceptance of its original consent agreement with Uber, and prepared a new consent agreement that would impose additional reporting obligations on Uber. The revised complaint specifically referenced the 2016 data breach and the state of Uber‘s data security as of November 2016.
Meanwhile, federal prosecutors brought felony charges against one of the hackers, Vasile Mereacre, for violating the Computer Fraud and Abuse Act (“CFAA“),
Analysis
I. The Jury Instructions—Obstruction Conviction
Sullivan claims error with respect to two of his proposed jury instructions regarding the obstruction conviction—the “nexus” instruction and the “duty to disclose” instruction.
A. Nexus Instruction
We review de novo the district court‘s rejection of Sullivan‘s proposed “nexus” instruction, which would have required the jury to find that “there was a nexus between the defendant‘s conduct
Section 1505 provides that “[w]hoever corruptly, or by threats or force, or by any threatening letter or communication influences, obstructs, or impedes or endeavors to influence, obstruct, or impede the due and proper administration of the law under which any pending proceeding is being had before any department or agency of the United States . . . [s]hall be fined under this title, imprisoned not more than 5 years or, if the offense involves international or domestic terrorism (as defined in [S]ection 2331), imprisoned not more than 8 years, or both.”
In accord with the statutory language, the jurors were instructed: “For the defendant to be found guilty [under Section 1505], the government must prove each of the following elements beyond a reasonable doubt: First, there was a proceeding pending before a department or agency of the United States; Second, the defendant was aware of the proceeding; and Third, the defendant intentionally endeavored corruptly to influence, obstruct, or impede the pending proceeding.” This instruction precisely mirrors the elements of Section 1505, as spelled out in United States v. Price, 951 F.2d 1028, 1031 (9th Cir. 1991) (“First, there must be a proceeding pending before a department or agency of the United States. Second, the defendant must
Ninth Circuit precedent forecloses Sullivan‘s argument. We held in United States v. Bhagat that there is no “need to supplement the Price instructions with additional elements,” including a “nexus” element, for a conviction under Section 1505. 436 F.3d 1140, 1148 (9th Cir. 2006).
Sullivan‘s counsel candidly acknowledged: “the Ninth Circuit has held in a [Section] 1505 case that Aguilar‘s nexus requirement did not require a separate jury instruction to that effect.” Sullivan asks us to overrule Bhagat, claiming that we have authority to do so because the case is “clearly irreconcilable” with intervening Supreme Court precedent. Miller v. Gammie, 335 F.3d 889, 900 (9th Cir. 2003) (en banc). Sullivan cites three cases that he construes as irreconcilable: United States v. Aguilar, 515 U.S. 593 (1995); Arthur Andersen LLP v. United States, 544 U.S. 696 (2005); and Marinello v. United States, 584 U.S. 1 (2018).
Although these cases support either a “nexus” requirement or “nexus” instruction in their respective contexts, none is clearly irreconcilable with Bhagat. To begin, none of the cases concerns Section 1505. And, in each case, the statutes, facts, or jury instructions created ambiguities that called for clarification as to the existence of a “nexus.” No such ambiguities exist in Bhagat or here.
The Section 1503 charge in Aguilar involved a defendant‘s statement in an investigation that was “ancillary” to the proceeding covered by the statute. Aguilar, 515 U.S. at 599–601. The
Nor are the other cases cited by Sullivan irreconcilable with Bhagat. In Marinello the prosecution was brought under the Omnibus Clause of
1512 case erroneously conveyed that the defendant need not even have “ha[d] in contemplation any particular official proceeding.” 544 U.S. at 708.
The text of Section 1505, the wording of the Price instructions, and the factual relevance of only one proceeding distinguish Bhagat from Aguilar, Marinello, and Arthur Andersen. Like Bhagat, this case involved only one proceeding, of which the defendant was undisputedly aware. Under Bhagat, the Price elements require a nexus by implication, and no other jury instruction given here undermined or contradicted
B. The “Duty to Disclose” Instruction
Sullivan also claims that the district court erred by rejecting his proposed “duty to disclose” instruction: that, if the basis of the obstruction-of-justice conviction was Sullivan‘s “withholding of information, the government must prove beyond a reasonable doubt that [he] had a duty
to disclose that information to the FTC.” Sullivan contends that, without this instruction, the jury may have convicted on a theory that was invalid under Section 1505—that is, inaction by a defendant under no duty to disclose. He urges application of the Yates rule that “a verdict [is required] to be set aside in cases where the verdict is supportable on one ground, but not on another, and it is impossible to tell which ground the jury selected.” Yates v. United States, 354 U.S. 298, 312 (1957), overruled on other grounds by Burks v. United States, 437 U.S. 1 (1978).
The Yates rule applies only to disjunctive charges and theories of culpability. United States v. Edwards, 303 F.3d 606, 641 (5th Cir. 2002) (“disjunctive legal theories“); Banks v. Workman, 692 F.3d 1133, 1139 (10th Cir. 2012), cert. denied sub nom. Banks v. Trammell, 569 U.S. 997 (2013) (“disjunctive charges“). Thus, if multiple “ways in which an offense may be committed” are alleged conjunctively in one count, then “proof of any one of those acts conjunctively charged may establish guilt,” and Yates is inapplicable. United States v. Bonanno, 852 F.2d 434, 441 (9th Cir. 1988).
A tandem prosecution under Section 2(b) and a substantive criminal statute presents conjunctive theories of culpability. In this context, Section 2(b) “is considered embodied in full in every federal indictment.” United States v. Michaels, 796 F.2d 1112, 1118 (9th Cir. 1986), cert. denied 479 U.S. 1038 (1987); United States v. Singh , 979 F.3d 697, 717 (9th Cir. 2020) (concerning jury instruction and indictment under Section 2(b) “in conjunction with” the substantive statute). Therefore, if a theory based on the inaction of a defendant under no duty to disclose would be valid under either Section 2(b) or Section 1505, then the instruction was not in error.
Section 2(b) states: “[w]hoever willfully causes an act to be done which if directly performed by him or another would be an offense against the United States, is punishable as a principal.”
We need not reach the question of validity under Section 1505. Because the legal theories under Section 1505 and Section 2(b) are conjunctive, the validity under Section 2(b) alone renders the omission of a duty-to-disclose instruction proper.
II. Sufficiency of the Evidence—Misprision Conviction
We now turn to Sullivan‘s argument that the evidence of his alleged misprision was insufficient as a matter of law. We review de novo. See Munoz, 412 F.3d at 1048. We must determine “whether, after viewing the evidence in the light
most favorable to the prosecution, any rational trier of fact could have found the essential elements of the crime beyond a reasonable doubt.” United States v. Laney, 881 F.3d 1100, 1106 (9th Cir. 2018) (quoting United States v. Atkinson, 990 F.2d 501, 502 (9th Cir. 1993) (en banc)).
Sullivan argues that Uber‘s post hoc authorization, via the NDA, retroactively rendered the hackers’ access authorized—thereby erasing their felony. But this is a false premise, inconsistent with the most plain and natural reading of the CFAA. In the statute, “without authorization” modifies the present-tense verb “accesses.”
access was unauthorized. Their illegal conduct could not be laundered through an NDA.
The government also needed to show that Sullivan had “full knowledge” “that the principal[] had committed and completed the felony alleged.” Lancey v. United States, 356 F.2d 407, 409 (9th Cir. 1966). Sullivan claims that, even if the hackers were unauthorized within the
The evidence does not support this argument. By November 15, 2016, Sullivan knew that an unauthorized actor had “compromised” Uber‘s accounts and potentially “acquired” data. According to his own arguments, he “believed that the hackers’ conduct was unauthorized at the time it occurred,” and he “view[ed] the legality of
Finally, the government had to show that Sullivan knew that the conduct in question was a felony punishable by more
than a year in prison. “The defendant need not know the precise term of imprisonment authorized by law, but at least [he] must know the potential punishment exceeds one year in prison.” United States v. Olson, 856 F.3d 1216, 1224 (9th Cir. 2017). Sullivan had been an Assistant U.S. Attorney in a “Computer Hacking and IP Unit.” He had helped prosecute a CFAA violation; the plea agreement, which he signed, noted a maximum sentence of five years. Sullivan‘s unusual “sophistication” could also be inferred “from [his] experience” as a prosecutor and cybersecurity professional. Id.
As detailed above, a rational juror could have found each essential element of misprision beyond a reasonable doubt.
III. Admission of Guilty Plea
Finally, we address Sullivan‘s contention that the district court abused its discretion in permitting the introduction of the guilty plea agreement signed by one of the hackers. We review for abuse of discretion a district court‘s evidentiary ruling under Federal Rule of Evidence 403, which is not to be overturned unless it is “manifestly erroneous.” United States v. Tsarnaev, 595 U.S. 302, 322–23 (2022) (quoting Gen. Elec. Co. v. Joiner, 522 U.S. 136, 142 (1997))
There is no manifest error here. In providing that a court “may exclude relevant evidence if its probative value is substantially outweighed by a danger of . . . unfair prejudice,” Rule 403 gives the district court considerable leeway.
agreement‘s probative value only “relative to the other evidence in the case,” such as the hacker‘s testimony, that value is still significant. Old Chief v. United States, 519 U.S. 172, 185 (1997).
Any unfair prejudice to the defendant resulting from the plea‘s admission into evidence does not substantially outweigh
We conclude that the court did not abuse its discretion in admitting the plea and therefore decline to reach the question of harmlessness.
Conclusion
The jury‘s verdict in this case underscores the importance of transparency even in failure situations—especially when such failures are the subject of federal investigation. The verdict is not tainted by any of the claimed
instructional or evidentiary errors, nor can it be overturned for insufficiency of the evidence. We affirm the district court in all relevant respects.
AFFIRMED.