@mabb0tt: .@joesu11ivanhas graciously has given his time the past couple of years to chat with us in cs153 @CS153Systems to discu…

.@joesu11ivanhas graciously has given his time the past couple of years to chat with us in cs153 @CS153Systems to discuss not only his incredible journey from being the first us attorney to prosecute hacking and the first domain seizure - to first ciso @facebook - to ciso@uber whereby he was charged with a felony for the company not being transparent with the government - to cloudflare where @eastdakota supported and advocated for him with the case! and he is now bringing laptops routinely to students in the ukraine. such an inspiring, amazing story with an amazing person. please enjoy- >

TL;DR

Former Uber CSO Joe Sullivan recounts his two-decade journey at the intersection of government and Big Tech, from prosecuting cybercrime to building trust & safety teams, and why radical transparency—even when it hurts—is the only way forward.

From Federal Prosecutor to Silicon Valley’s Trust Builder

Joe Sullivan started his career in the mid‑1990s at the US Department of Justice in San Francisco. When he asked for a direct internet connection on his desk, the DOJ refused: “Our network must never touch the internet.” He eventually got a separate computer with internet access, making him the only person in the office with a connected machine — and the de facto gatekeeper for everything digital.

After eight years at DOJ, he joined eBay in 2002, just after the company acquired PayPal. His focus was trust and safety: eBay’s model was still “find an item, win the bid, mail cash in an envelope, hope the seller ships.” He visited 46 of 50 US states to educate regulators and trained law enforcement in about a dozen countries on how to prosecute bad actors on the platform.

In 2008 he moved to Facebook, then smaller than MySpace, working out of scattered offices in downtown Palo Alto. He inherited three engineers and built a large team. During the Snowden revelations, he became Facebook’s de facto liaison with the NSA, managing the relationship when the public believed Silicon Valley was sharing everyone’s data — which was not the truth.

He joined Uber in 2015 as its first head of security, again starting with three engineers and scaling to hundreds. In 2018 he went to Cloudflare, inherited three engineers, and scaled again. Today he consults for cybersecurity startups, serves as a venture partner at Costa Nova Ventures, and runs a non‑profit helping Ukrainian children.

The Uber Incident That Changed Everything

In late 2017, while on a family vacation in Lake Tahoe, Sullivan received a text from Bloomberg reporter Eric Newcomer asking about his firing from Uber. He had no idea. Then the article dropped: “Uber paid hackers to delete stolen data of 57 million users.” Global media frenzy. His phone exploded. Then, suddenly, the signal died — Uber’s IT team had locked his phone and laptop remotely. The company had decided to fire him.

He became the most famous person in cybersecurity for the wrong reasons. For two months he hid, grew a beard, and avoided public attention. When he started looking for a new role in early 2018, three companies reached out first: Huawei, WeWork, and ByteDance. They welcomed him despite the controversy. But he chose a small startup called Cloudflare.

Cloudflare’s Radical Transparency

Cloudflare CEO Matthew Prince did thorough due diligence, calling Travis Kalanick and others. He decided to take the risk. Sullivan started in spring 2018.

Almost immediately, he faced a security incident. He called Prince on a Friday evening (security incidents always happen on Fridays, he notes). “We have a security incident,” Sullivan said. “Who’s writing the blog post?” Prince replied. Sullivan was stunned: “We’re bleeding. I need to stop the bleeding and keep customers safe.” Prince insisted. Minutes later, Cloudflare’s CTO John Graham-Cumming appeared on Zoom. “I’m writing the blog post,” he said. The CEO had directed the CTO to join the incident response room solely to document everything for transparency.

A year later, a major outage hit: a bad WAF rule pushed by the London team took down half the internet. Fortunately, most of the US was asleep. Sullivan and John called every major customer and published a detailed postmortem. Instead of being vilified for breaking the internet, Cloudflare was praised for its transparency. Sullivan argues that the tech industry needs to tilt increasingly toward that model.

The FBI Announcement and Federal Trial

In 2020, the FBI issued a press release saying they had arrested Sullivan. His eldest daughter was moving into her dorm at UT Austin when friends told her they heard on NPR that her father was arrested. He was not arrested — but he was charged with obstruction of justice and felony misprision (knowingly failing to report a crime). The charge was personal: the government held him responsible because Uber, in 2016/2017, had not been transparent with regulators about that earlier breach.

Sullivan went to trial in September 2022. During the trial, Uber’s chief privacy officer and legal regulatory affairs lead testified: “Our team was responsible for reporting security incidents to the government. We took responsibility. Yes, I knew about the incident. Yes, we did not tell the investigating agency.” Yet Sullivan was the defendant, sitting in court in a mask (still the pandemic). The jury never saw his face — only a man in a suit and mask.

Sullivan deeply believes in “responsible disclosure.” In 2007 at PayPal, his team published the first formal vulnerability disclosure policy: “Tell us about bugs. We won’t sue you. We won’t report you. We want open dialogue.” Other companies copied it. When he moved to Facebook in 2008, he immediately implemented the same policy. Years later, hackers started asking for bounties — and the bug bounty industry was born.

The Arc of Government and Tech

Sullivan sees a clear trajectory: from the DOJ’s “no internet” in 1995, through eBay’s early trust challenges, to Facebook’s Snowden‑era scrutiny, to Uber’s mobile‑first explosion, and now to Cloudflare’s transparency‑first culture. Government and tech have moved from mutual suspicion to active engagement. But the tension between transparency and opacity remains. In his own case, being open about what happened — even when it was painful — ultimately earned him trust at Cloudflare and beyond.

He advises startups: “When you have a security incident, the first question shouldn’t be ‘How do we contain this?’ It should be ‘Who’s writing the blog post?’”

Source: YouTube Video @mabb0tt – Joe Sullivan’s Talk