EXECUTIVE LEGAL RISK & GOVERNANCE

CISO & Officer Personal Liability

A legal analysis of landmark federal actions against individual Chief Information Security Officers and corporate executives for breach concealment, fraudulent disclosures, and systemic security governance failures.

Key Facts

Federal prosecutors and regulators increasingly pierce the corporate veil to target individual cybersecurity officers.
Mischaracterizing extortion payments as white-hat bug bounties constitutes federal criminal obstruction.
SEC enforcement targets discrepancies between public marketing statements and internal CISO risk registers.
Directors and Officers (D&O) insurance policies may not cover fines or legal defense costs for intentional concealment.

Joseph Sullivan (Former Chief Security Officer, Uber)

Federal Criminal Prosecution (DOJ)

Forum: U.S. District Court for the Northern District of California (No. 3:20-cr-00337-WHO)

Allegations & Statutes: Obstruction of Justice (18 U.S.C. § 1505) & Misprision of a Felony (18 U.S.C. § 4)

Judicial / Regulatory Disposition: Guilty Verdict (3 Years Probation, 200 Hours Community Service, $50,000 Fine)

Legal Context: Historic first criminal prosecution and conviction of a corporate CISO for breach response conduct. Sullivan arranged a $100,000 Bitcoin payment to hackers through HackerOne bug bounty, having them sign NDAs falsely certifying no data was copied while concealing the intrusion from the FTC.

Governance Takeaway: Concealing unauthorized data exfiltration as a bug bounty creates direct federal criminal exposure. CISOs cannot withhold material breach facts from corporate legal counsel or federal regulators.

Associated Case Record: View Case Dossier →

Timothy G. Brown (Chief Information Security Officer, SolarWinds)

Civil Securities Fraud Enforcement (SEC)

Forum: U.S. District Court for the Southern District of New York (No. 1:23-cv-09518-PAE)

Allegations & Statutes: Securities Fraud (Exchange Act § 10(b), Rule 10b-5) & Securities Act § 17(a)

Judicial / Regulatory Disposition: Core Claims Sustained Against CISO; Motion to Dismiss Denied on Public Security Statement

Legal Context: First time the SEC sued an individual CISO for securities fraud. The SEC alleged Brown made misleading statements in SolarWinds public Security Statement that contradicted internal presentations warning internal systems were vulnerable to widespread exploitation.

Governance Takeaway: Public-facing corporate security statements must align strictly with internal risk assessments. CISOs who sign or author marketing materials inconsistent with internal risk registers face personal SEC liability.

Associated Case Record: View Case Dossier →

James Cory Rellas (Chief Executive Officer, Drizly)

Federal Trade Commission Administrative Consent Order

Forum: FTC Bureau of Consumer Protection (File No. 202-3185)

Allegations & Statutes: Unfair Trade Practices (FTC Act § 5) for Grossly Inadequate Security Oversight

Judicial / Regulatory Disposition: Binding 10-Year Personal Consent Order Following Corporate Acquisition

Legal Context: The FTC named the CEO personally, requiring him to implement comprehensive information security programs at any future business he leads, controls, or holds a majority ownership interest in for the next decade.

Governance Takeaway: C-suite executives cannot delegate away ultimate data security responsibility. The FTC enforces cross-corporate personal remedies that follow executives to subsequent employers.

Associated Case Record: View Case Dossier →