Opinion
20-cr-00337-WHO-1
01-11-2023
UNITED STATES OF AMERICA, Plaintiff, v. JOSEPH SULLIVAN, Defendant.
ORDER DENYING MOTION FOR JUDGMENT OF ACQUITTAL AND NEW TRIAL
RE: DKT. NO. 242
WILLIAM ORRICK UNITED STATES DISTRICT JUDGE
Defendant Joseph Sullivan, who was convicted of obstruction of proceedings before a United States agency in violation of 18 U.S.C. § 1505 and misprision of felony in violation of 18 U.S.C. § 4, moves for a judgment of acquittal on both counts or, alternatively, for a new trial. Sullivan's arguments, which were largely raised and considered in various rounds of briefing and argument on jury instructions, read into both statutes elements that the Ninth Circuit has rejected or that are otherwise unsupported by the case law. Construing the evidence in the light most favorable to the prosecution, as I must on a motion for a judgment of acquittal, any rational juror could have found the essential elements of the crimes beyond a reasonable doubt. That evidence also does not preponderate sufficiently heavily against the verdict so that a serious miscarriage of justice may have occurred, as required to set aside the verdict and grant a new trial. Sullivan's motion is DENIED.
BACKGROUND
This case arises from a November 2016 data breach at Uber Technologies, Inc. (“Uber”), in which the personally identifiable information of Uber users and drivers was accessed, including approximately 600,000 driver's license numbers. See Superseding Indictment (“SI”) [Dkt. No. 71] ¶ 4. At the time, Sullivan was Uber's Chief Security Officer. See Tr. at 364:14-17.
The 15 volumes of trial transcript can be found at Docket Nos. 197-205 and 230-236.
On September 3, 2020, Sullivan was charged by indictment with obstruction of proceedings before a department or agency of the United States in violation of 18 U.S.C. § 1505 and misprision of a felony in violation of 18 U.S.C. § 4. Dkt. No. 13. On December 22, 2021, the grand jury returned a superseding indictment adding three counts of wire fraud in violation of 18 U.S.C. § 1343. Dkt. No. 71. Sullivan filed a motion to dismiss the wire fraud counts, which I denied. Dkt. Nos. 107, 129. However, the government later dismissed those counts, leaving only the section 1505 and section 4 charges for trial. See Dkt. No. 134.
At trial, the government established that at the time of the November 2016 breach, the United States Federal Trade Commission (“FTC”) was evaluating Uber's data security program and practices in response to another data breach that the company experienced in 2014. See, e.g., Tr. at 298:7-22. The FTC deposed Sullivan as part of that investigation on November 4, 2016. See id. at 357:11-13. During that deposition, Sullivan described Uber's data security practices, including the storage of access keys, use of Amazon Web Services, and certain vulnerabilities. See, e.g., id. at 357:4-17; 358:24-359:3; 369:17-21; 374:23-375:12; 380:1-381:11; 383:1-387:7.
Ten days after Sullivan testified to the FTC, he received an email from an “unknown actor” that ultimately revealed that hackers had accessed Uber's data. See id. at 577:16-21. Uber's incident response team then worked to handle the breach, in part by communicating with the hackers to confirm the breach was not a hoax and then to determine its scope. See, e.g., id. at 578:9-22. The response team logged its actions, along with outstanding issues and questions, in a document called the “Preacher Central Tracker.” Id. at 685:9-21. That document included comments comparing the nature of the 2016 breach with Sullivan's testimony to the FTC about Uber's data security practices. See, e.g., id. at 796:22-798:3 (testifying that the document included the comment from Sullivan that “[t]his may also play very badly based on previous assertions” and that this referenced “the FTC assertions” regarding data access and encryption); id. at 629:1630:6 (“Joe was just deposed on this specific topic and what the best or minimum practices that any company should follow in this area.”).
As the Uber team responded to the incident, Sullivan stressed the need for secrecy. He told one of his direct reports, “This can't get out.” See id. at 603:7-605:10. He also told the response team that “we need to keep this tightly controlled” and that he was “communicating directly to the A Team,” a nickname for Uber's senior executives who reported directly to its chief executive officer. See, e.g., id. at 533:14-20 (describing the A Team); 635:17-636:15 (describing comments on the Preacher Central Tracker).
Craig Clark, then an attorney for Uber and another one of Sullivan's reports, testified that after the response team learned that driver's license numbers had been accessed, Sullivan asked him, “How can we fit this into bug bounty?”, which Clark understood to be a directive to find a way to bring the 2016 data breach within Uber's bug bounty program-a type of program used by companies to incentivize outsiders to report vulnerabilities in the company's security protocols. See id. at 498:8-13 (describing the nature of bug bounty programs); 732:9-733:13 (same); 1319:18-1320:24 (Clark's testimony). According to Clark, Sullivan later told him that “we're going to treat it as a bug bounty.” Id. at 1324:10-25.
One of the hackers testified that he negotiated with one of Uber's employees for a payment of $100,000-more than Uber's typical maximum bug bounty payout of $10,000-and in exchange, signed a non-disclosure agreement (“NDA”). See id. at 899:2-12; 965:13-19. The NDA stated that Uber would pay the hackers the $100,000 if they promised that they “did not take or store any data during or through [their] research” and “delivered to [Uber] or forensically destroyed all information about and/or analyses of the vulnerabilities.” See id. at 900:5-901:16, 970:1-972:2. The NDA also required the hackers to promise that they “have not and will not disclose anything about the vulnerabilities or [their] dialogue with [Uber] to anyone for any purpose without [Uber's] written permission.” Id. at 899:7-12. In exchange, the NDA promised that Uber would “not seek civil or criminal remedies” against the hackers for their “activity and research” unless they had broken any of their own promises. Id. at 900:8-18.
Various exhibits showed edits made to the NDA that were attributed to Sullivan. See, e.g., Exs. 100-115. Clark also testified about those edits, including that certain language-“You promise that you did not take or store any data during or through your research and that you've delivered to us or forensically destroyed all information about and/or analyses of the vulnerabilities”-was “Joe's idea,” and that when Clark noted that the language was incorrect, Sullivan told him “[t]hat it would stay.” See id. at 1340:20-25, 1344:16-1345:20.
The jury found Sullivan guilty of violating both section 1505 and section 4. Dkt. No. 224.
LEGAL STANDARD
Under Federal Rule of Criminal Procedure 29, upon a motion from the defendant, the court “must enter a judgment of acquittal of any offense for which the evidence is insufficient to sustain a conviction.” In deciding whether the evidence sufficiently sustains a conviction, the court must “construe the evidence ‘in the light most favorable to the prosecution,' and only then determine whether ‘any rational trier of fact could have found the essential elements of the crime beyond a reasonable doubt.'” United States v. Nevils, 598 F.3d 1158, 1161 (9th Cir. 2010) (en banc) (citation omitted); see also United States v. McCarron, 30 F.4th 1157, 1162 (9th Cir. 2022) (affirming the test articulated in Nevils). At the second step, “a reviewing court may not ask itself whether it believes that the evidence at trial established guilt beyond a reasonable doubt, only whether any rational trier of fact could have made that finding.” Nevils, 598 F.3d at 1164 (citations and quotation marks omitted) (emphasis in original). As the Ninth Circuit has noted, “[t]he hurdle to overturn a jury's conviction based on a sufficiency of the evidence challenge is high.” United States v. Rocha, 598 F.3d 1144, 1153 (9th Cir. 2010).
A defendant may also move for a new trial under Federal Rule of Criminal Procedure 33(a), which provides that “the court may vacate any judgment and grant a new trial if the interest of justice so requires.” When considering a motion for a new trial, the district court “is not obliged to view the evidence in the light most favorable to the verdict, and it is free to weigh the evidence and evaluate for itself the credibility of the witnesses.” United States v. Kellington, 217 F.3d 1084, 1097 (9th Cir. 2000) (citation omitted). If, “despite the abstract sufficiency of the evidence to sustain the verdict,” the court concludes that the evidence “preponderates sufficiently heavily against the verdict that a serious miscarriage of justice may have occurred,” it may set aside the verdict and grant a new trial. Id. (citation omitted). The Ninth Circuit has stated that a motion for a new trial should be granted only in “exceptional circumstances in which the evidence weighs heavily against the verdict.” United States v. Del Toro-Barboza, 673 F.3d 1136, 1153 (9th Cir. 2012) (citing United States v. Pimentel, 654 F.2d 538, 545 (9th Cir. 1981)).
DISCUSSION
I. MOTION FOR JUDGMENT OF ACQUITTAL
A. Elements of the Offenses
Sullivan's arguments regarding the sufficiency of the evidence heavily-if not entirely- rely on the elements of each offense. For example, he asserts that the evidence is insufficient to sustain a conviction under section 1505 because section 1505 “requires the government to establish a ‘nexus' between the defendant's conduct and the relevant proceeding.” Mot. [Dkt. No. 242] 5:14-16. Sullivan argued this initially when the parties proposed jury instructions, and requested that I include in the section 1505 instruction “a fourth element”: that “there was a nexus between the defendant's conduct and the pending FTC proceeding.” See Proposed Jury Instrs. [Dkt. No. 156] 45-46. In so arguing, Sullivan “recognize[d] . . . that the Ninth Circuit has rejected a ‘nexus' requirement for § 1505” and “request[ed] this addition to the instruction solely to preserve the record for any further proceedings.” See id. at 46:14-19. I denied the request and instructed the jury without any nexus requirement. See Final Jury Instrs. [Dkt. No. 219] 17.
Similarly, Sullivan has already argued that in order to convict a defendant for an omission under section 1505, the government must show that he had a specific legal duty to disclose the information withheld. See Mot. at 20:20-27. This was raised when the parties first proposed jury instructions, and Sullivan continued to argue for a duty requirement in additional arguments and briefing on those instructions. See Proposed Jury Instrs. at 49-60; Dkt. Nos. 194, 195 (supplemental briefing); Tr. at 2128:9-2139:11 (additional argument). Again, I denied his request and instructed the jury without any duty requirement. See Final Jury Instrs. at 18.
As the Ninth Circuit has stated, “[a] Rule 29 motion for judgment of acquittal . . . is not the proper vehicle for raising an objection to jury instructions” as “the very nature of a Rule 29 motion for judgment of acquittal is to question the sufficiency of the evidence to support a conviction.” United States v. Crowe, 563 F.3d 969, 972 n.5 (9th Cir. 2009) (citations and quotation marks omitted). Most, if not all, of Sullivan's arguments regarding these points have been asked and answered by this court. They remain unpersuasive, for reasons that I have already stated and for additional reasons articulated below.
1. Nexus Requirement
To convict a defendant under section 1505, the government must prove three elements: “(1) that there was an agency proceeding; (2) that the defendant was aware of that proceeding; and (3) that the defendant ‘intentionally endeavored corruptly to influence, obstruct, or impede the pending proceeding.'” United States v. Bhagat, 436 F.3d 1140, 1147 (9th Cir. 2006) (citing United States v. Price, 951 F.2d 1028, 1031 (9th Cir. 1991)). In Bhagat, the Ninth Circuit expressly rejected adding a nexus requirement to the elements articled in Price, distinguishing the agency proceeding at hand from the judicial proceeding at the heart of United States v. Aguilar, 515 U.S. 593 (1995), where the Supreme Court added a nexus requirement to 18 U.S.C. § 1503's “catchall” provision. See Bhagat, 436 F.3d at 1147-48. In so doing, the Ninth Circuit held that “[b]ecause Bhagat was charged under section 1505 with obstructing an agency proceeding and not a judicial one, there was no need to create a causal nexus and, consequently, no need to supplement the Price instructions with additional elements.” Id. at 1148.
From the start, Sullivan acknowledged the Ninth Circuit's holding in Bhagat. See Proposed Jury Instrs. at 46:14-19 (recognizing that “the Ninth Circuit has rejected a ‘nexus' requirement for §1505” and citing Bhagat, 436 F.3d at 1147-48). In this motion, he attempts to distinguish Bhagat and analogize to other cases where a nexus was required, namely Aguilar and Marinello v. United States, 138 S.Ct. 1101, 1106 (2018). See Mot. at 5:14-6:21. Those cases, however, dealt with different statutes with notably different language than section 1505.
In Aguilar, the defendant was convicted of endeavoring to obstruct the due administration of justice in violation of 18 U.S.C. § 1503, which, in relevant part, makes it unlawful for a person to “corruptly or by threats or force . . . endeavor[] to influence, intimidate, or impede” jurors or court officers in the discharge of their duties or to influence, obstruct, or impede (or endeavor to do the same) “the due administration of justice.” See 515 U.S. at 595; 18 U.S.C. § 1503(a). Specifically, the defendant was convicted for making false statements to an FBI agent during an investigation; the government argued that the defendant knew his statements would be provided to a grand jury and “made the statements with the intent to thwart” the grand jury investigation, not just the FBI investigation. Aguilar, 515 U.S. at 600-01.
After considering the “very broad language” of section 1503's catchall provision, which outlaws “endeavors to influence, obstruct, or impede, the due administration of justice,” the Court imposed a nexus requirement. See id. at 598-600; see also 18 U.S.C. § 1503(a). The Court determined that “[t]he action taken by the accused must be with an intent to influence judicial or grand jury proceedings; it is not enough that there be an intent to influence some ancillary proceeding, such as an investigation independent of the court's or grand jury's authority.” Aguilar, 515 U.S. at 599. “In other words,” the Court wrote, “the endeavor must have the natural and probable effect of interfering with the due administration of justice.” Id. (citations and quotation marks omitted). The Court then rejected the government's argument that the defendant's statements were “analogous to those made directly to the grand jury itself,” finding instead that “uttering false statements to an investigating agent . . . who might or might not testify before a grand jury” was not “sufficient to make out a violation of the catchall provision of § 1503.” Id. at 600-01.
Bhagat expressly considered Aguilar and distinguished it-not, as Sullivan contends, because of whether the defendant was accused of directly or indirectly obstructing the proceeding at issue, but because of the nature of the proceeding itself. See Mot. at 11:18-12:3; see also Bhagat, 436 F.3d at 1147-48. This is evident from the opinion:
Aguilar did not involve obstruction of agency proceedings under 18 U.S.C. § 1505. Rather, the court in Aguilar addressed false statements made during the course of an agency's investigative proceeding that obstructed a judicial proceeding pursuant to 18 U.S.C. § 1503's “catchall” provision. The Supreme Court noted that judicial proceedings are distinct from government investigations, and that the intent to obstruct an agency proceeding did not automatically demonstrate intent to obstruct the related judicial one. To transpose the intent to obstruct an agency proceeding into the judicial context, the Court held that there had to be a “nexus” between the two proceedings....Because Bhagat was charged under section 1505 with obstructing an agency proceeding and not a judicial one, there was no need to create a causal nexus and, consequently, no need to supplement the Price instructions with additional elements.Bhagat, 436 F.3d at 1147-48 (citations omitted).
Marinello does not change my view of Bhagat. It too considered a statute-this time, from the Internal Revenue Code-with a catchall phrase making it unlawful for a person to “corruptly or by force or threats of force . . . obstruct[] or impede[], or endeavor[] to obstruct or impede, the due administration of this title.” See Marinello, 138 S.Ct. 1104-05 (citing 26 § U.S.C. 7212(a)). Relying in part on Aguilar, the Supreme Court held that to convict a defendant under section 7212(a), the government “must show (among other things) that there is a ‘nexus' between the defendant's conduct and a particular administrative proceeding.” Id. at 1109-10. The Marinello decision hinged upon the phrase “the due administration of this title” in section 7212(a), just as the Aguilar decision did on “the due administration of justice” in section 1503. See id. at 1009.
Neither Aguilar nor Marinello is sufficiently on point to overturn the Ninth Circuit's express holding regarding section 1505 in Bhagat. Those cases contemplate different statutes with broad catchall phrases that are absent from section 1505. Section 1505 forbids, in part, “endeavors to influence, obstruct, or impede the due and proper administration of the law under which any pending proceeding is being had before any department or agency of the United States.” See 18 U.S.C. § 1505. In identifying a particular proceeding as the object of any obstruction, section 1505 provides a level of specificity that the catchall provisions of sections 1503 and 7212(a) lack.
Sullivan's remaining arguments regarding statutory construction do not compel a finding contrary to Bhagat. See Mot. at 6:22-10:8. Although he points to a recent Ninth Circuit case where the court, in a footnote, listed section 1505 as one of several statutes “requir[ing] a nexus to an ongoing or pending proceeding or investigation,” that footnote does not mention Bhagat, does not cite to any authority specific to section 1505, and offers no further analysis. See id. at 15:1215; see also Valenzuela Gallardo v. Barr, 968 F.3d 1053, 1064 n.9 (9th Cir. 2020).
Sullivan asks me to go where the Ninth Circuit has explicitly not, namely, to inject a nexus element into section 1505. Any decision to revisit Bhagat or reconcile it with Marinello or the footnote in Valenzuela Gallardo is for the appellate court, not me. The Ninth Circuit's decision in Bhagat is clear and controlling: section 1505 does not require a causal nexus. See 436 F.3d at 1148.
2. Duty to Disclose
A conviction under section 1505 may also be based on a defendant's omission, as opposed to his affirmative conduct. Sullivan again argues that for the government to convict him of section 1505 under an omission-based theory, it must show that he had a specific legal duty to disclose the data breach. Mot. at 20:14-24:11. For this argument, Sullivan points to the ordinary meaning of the word “withholding” in section 1505 and the doctrine of constitutional avoidance in support. See id. He does not cite any case law that imposes a duty to disclose requirement on section 1505. See id. Instead, he compares section 1505 with two cases interpreting 18 U.S.C. § 1001 in arguing that the void for vagueness doctrine “requires the construction of § 1505” to include a specific legal duty to disclose. See id. at 22:9-23:9.
Neither of these arguments is compelling. First, Congress expressly considered the term “corruptly” as used in section 1505 and did not include any duty to disclose. It did this when it enacted 18 U.S.C. § 1515(b), which defines “corruptly” as used in section 1505 as “acting with an improper purpose, personally or by influencing another, including making a false or misleading statement, or withholding, concealing, altering, or destroying a document or other information.” As the government notes, Congress has decided “what it means to corruptly influence an investigation” and determined that withholding and concealing information is sufficient, without any reference to a duty to disclose. See Oppo. [Dkt. No. 245] 16:27-17:1. This indicates that no such duty is necessary to convict a defendant under section 1505, which uses the definition set forth in section 1515(b).
Second, a more relevant Ninth Circuit case makes clear that a duty to disclose is not required when the government proceeds under 18 U.S.C. § 2(b) in conjunction with an obstruction charge, as occurred here. Under section 2(b), “[w]hoever willfully causes an act to be done which if directly performed by him or another would be an offense against the United States, is punishable as a principal.” 18 U.S.C. § 2(b). In other words, “[a] person who causes the commission of an offense is punishable as a principal even though the person who completes the wrongful act violates no criminal statute because of lack of criminal intent or capacity.” United States v. Causey, 835 F.2d 1289, 1292 (9th Cir. 1987). “Section 2(b) punishes the individual who causes a criminal act, because no crime would take place without his or her participation.” Id. (emphasis in original). In this case, the government proceeded under section 2(b) as an alternative theory of liability under which the jury could convict Sullivan of either section 1505 or section 4, if it found that Sullivan caused another person to obstruct the FTC investigation or commit misprision of felony. See, e.g., 2640:19-2641:15 (describing section 2(b) as an alternative theory of liability); see also Final Jury Instrs. at 25 (same).
When Sullivan argued for the inclusion of a duty to disclose in the jury instruction on “corruptly” as used in section 1505, the parties homed in on United States v. Singh, 979 F.3d 697 (9th Cir. 2020). See Proposed Jury Instrs. at 50-60; Dkt. Nos. 194, 195 (supplemental briefing); Tr. at 2129:8-2137:21 (oral argument). Relevant to this case, Singh was convicted of conspiracy to falsify campaign records in violation of 18 U.S.C. § 1519. See Singh, 979 F.3d at 708. Like Sullivan, Singh argued that “a mere omission, without an affirmative duty” could not satisfy the statute's actus reus element and that even if he had omitted information that caused a campaign to file false entries on its disclosure reports, he had no duty to disclose that information and played no role in preparing those forms. See id. at 715-17. The Ninth Circuit wrote that the argument “has merit,” noting that in other cases where courts affirmed omission-based section 1519 convictions, “the defendants either prepared the record or document, or were responsible for doing so” and that the relevant local and state laws “imposed the reporting requirements on campaigns and candidates, not on individuals ‘volunteering' or providing services to the campaign” as Singh had done. See id. at 717.
Under section 1519, “[w]hoever knowingly alters, destroys, mutilates, conceals, covers up, falsifies, or makes a false entry in any record, document, or tangible object with the intent to impede, obstruct, or influence the investigation or proper administration of any matter within the jurisdiction of any department or agency of the United States or any case filed under title 11, or in relation to or contemplation of any such matter or case, shall be fined under this title, imprisoned not more than 20 years, or both.” 18 U.S.C. § 1519.
The court went on: “However, Singh was not simply convicted under § 1519.” Id. “Instead,” it wrote, “the jury instructions and the indictment disclosed that the government proceeded under 18 U.S.C. § 2(b) in conjunction with § 1519.” Id. Under such a theory of liability, it held, “the actus reus element merges with the mens rea element to focus liability on the person harboring the criminal intent” and thus, the government “did not need to prove that Singh prepared the reports or had a duty to report . . . rather, that the campaign had a duty to report the information is enough.” Id. at 717-18.
Sullivan revisits Singh in his Rule 29 motion, arguing that it “does not save the government's case.” Mot. at 28:1-29:10. He contends that Singh “made affirmative false statements” to those responsible for preparing the campaign reports, and that the evidence presented here “established merely that [Sullivan] remained silent regarding the 2016 Incident.” See id. at 28:8-18. Setting aside the sufficiency of the evidence for now, Singh stands for the proposition that a duty to disclose is not required when the government proceeds under a theory of liability under section 2(b) along with the relevant obstruction statute. That is what happened here. See Final Jury Instrs. at 25 (section 2(b) instruction).
Sullivan argued in reply that the Ninth Circuit “recently signaled” that courts should read section 1505 in conjunction with section 1001 “in which context the duty-to-disclose requirement is well established.” See Reply [Dkt. No. 247] 7:13-8:2. According to Sullivan, the court's favorable citations to a model jury instruction applicable to section 1001 cases and to a section 1001 case shows that “the Ninth Circuit interpreted § 1505 in accordance with § 1001.” Id. But the case he relies upon, United States v. Kirst, 54 F.4th 610 (9th Cir. 2022), considered whether a National Transportation Safety Board investigation was a “proceeding” within the meaning of section 1505, whether the government presented sufficient evidence to prove corrupt intent, and whether the court erred in instructing the jury on materiality. It made no mention of any duty to disclose. See generally Kirst, 54 F.4th at 610. And a “signal,” via two citations, is not enough to overcome the analysis in Singh.
Sullivan does not point to any case law where the Ninth Circuit (or Supreme Court) expressly requires a duty to disclose as an element of section 1505. See Mot. at 20:14-24:11. As I explained in settling the jury instructions, and again in this Order, Singh answers the question: When the government proceeds under section 2(b) along with the relevant obstruction statute, no such duty is required. See 979 F.3d at 717-18.
3. Section 4
Under 18 U.S.C. § 4,
[w]hoever, having knowledge of the actual commission of a felony cognizable by a court of the United States, conceals and does not as soon as possible make known the same to some judge or other person in civil or military authority under the United States, shall be fined under this title or imprisoned not more than three years, or both.
“To establish misprision of felony, the government must prove beyond a reasonable doubt: ‘(1) that the principal . . . committed and completed the felony alleged; (2) that the defendant had full knowledge of that fact; (3) that he failed to notify the authorities; and (4) that he took affirmative steps to conceal the crime of the principal.'” United States v. Olson, 856 F.3d 1216, 1220 (9th Cir. 2017) (quoting Lancey v. United States, 356 F.2d 407, 409 (9th Cir. 1966)).
Sullivan makes a parallel argument with respect to section 4, asserting that it too requires a “relationship in time, causation, or logic”-in other words, a nexus-between the verb used in the statute (“conceal”) and its indirect object (“some judge or other person in civil or military authority under the United States”). See Mot. at 29:16-31:2. So, he argues, “[c]onduct that does not have the ‘natural and probable effect' of shielding information from federal law enforcement cannot reasonably be said to amount to ‘concealment' [of] that information from federal law enforcement.” Id. at 30:27-31:2 (citing Aguilar, 515 U.S. at 601).
To the extent that Sullivan argues for the express, separate inclusion of a nexus requirement in section 4, he has not pointed to any case law or other authority imposing one. See id. at 29:16-31:2. In addition, I instructed the jury that in order to convict Sullivan under section 4, the government must prove, in relevant part, that “the defendant did an affirmative act to conceal the crime.” See Final Jury Instrs. at 19 (emphasis added). The government argues that this effectively serves as a nexus requirement and that there is “no basis to apply any further restriction or duplicative instruction.” Oppo. at 19:13-18. I agree.
B. Sufficiency of the Evidence
Having disposed of those issues, construing the evidence in the light most favorable to the prosecution and considering whether any rational juror could have found the essential elements of the crimes beyond a reasonable doubt, there was sufficient evidence supporting Sullivan's conviction of both counts. See Nevils, 598 F.3d at 1161.
To convict Sullivan under section 1505, the government had to prove beyond a reasonable doubt that: (1) there was proceeding pending before a department or agency of the United States; (2) Sullivan was aware of that proceeding; and (3) Sullivan “intentionally endeavored corruptly to influence, obstruct, or impede the pending proceeding.” See Price, 951 F.2d at 1031. The jury was instructed on these elements, as well as the definition of “corruptly” and 18 U.S.C. §§ 2(a) and (b). See Final Jury Instrs. at 17-18, 23-25.
As the government notes, there was ample evidence that Sullivan was “aware of the nature, history, and scope of the FTC's investigation as of November 2016.” See Oppo. at 10:21-23. That includes a transcript of and testimony regarding Sullivan's deposition with the FTC, which occurred 10 days before the 2016 breach was discovered and covered Uber's data security practices, including the storage of access keys, use of Amazon Web Services, and vulnerabilities. See, e.g., Tr. at 357:4-359:3 (describing Exhibit 340 as Sullivan's FTC testimony); 369:17-21 (establishing Sullivan's personal knowledge of Uber security practices); 374:23-375:12 (discussing Sullivan's testimony regarding the 2014 data breach); 380:1-381:11 (discussing Sullivan's testimony regarding access keys); 383:1-387:7 (discussing Sullivan's testimony regarding the use of Amazon Web Services and vulnerabilities).
The jury was also presented with evidence, including the Preacher Central Tracker, that Sullivan and others at Uber believed that the circumstances of the 2016 data breach belied what he had previously told the FTC. See, e.g., Ex. 29 at 11 (“This may also play very badly based on previous assertions.”); Tr. at 796:22-798:3 (testifying that this referenced “the FTC assertions” regarding data access and encryption); Ex. 29 at 18 (“Joe was just deposed on this specific topic and what the best or minimum practices that any company should follow in this area.”); Tr. at 629:1-630:6 (describing the statement). And it heard evidence about Sullivan's efforts to keep the data breach a secret, including testimony from Sullivan's direct report, John Flynn, who said that Sullivan told him “This can't get out” when discussing the incident. See Tr. at 603:7-605:10; see also id. at 635:17-636:15 (discussing Preacher Central Tracker comments from Sullivan that “we need to keep this tightly controlled” and that Sullivan was “communicating directly to the A Team”). Flynn further testified that Sullivan mentioned to him, “I was just recently deposed by the FTC” and that he said “[s]omething about the two issues”-involving the 2014 and 2016 data breaches-“were similar.” See id. at 604:17-605:4.
The jury also heard evidence about steps that Sullivan took following the breach, which speak to the third and final element of the obstruction charge. Three pieces of evidence are key. First, the jury heard from Clark, who testified that after the response team learned that driver's license numbers had been accessed, Sullivan asked him, “How can we fit this into bug bounty?”, which Clark understood to be a directive to find a way to fit the breach within Uber's bug bounty program. Id. at 1319:18-1320:24. Clark then testified that he developed a “theory” to avoid triggering disclosure requirements, wherein the hackers would be treated as Uber employees or agents. See id. at 1322:1-24. Clark testified that after he presented this theory to Sullivan, Sullivan told him that “we're going to treat it as a bug bounty.” Id. at 1324:10-25.
The second key piece of evidence is the NDA. The jury saw exhibits showing various edits made to the NDA that were attributed to Sullivan. See, e.g., Exs. 100-115. It also heard testimony from Clark about the nature of those edits, including that specific language was “Joe's idea,” and that when Clark noted the language was inaccurate, Sullivan told him “[t]hat it would stay.” See Tr. at 1344:16-1345:15.
Finally, the jury heard evidence regarding the $100,000 payment made to the hackers, including testimony that at the time, Uber's maximum bounty was $10,000. See id. at 965:13-19. Later, one of Uber's then-attorneys testified that Sullivan had said that the $100,000 payment was “essentially to avoid the potential embarrassment to the company if it were to become disclosed.” Id. at 2176:5-14.
Sullivan makes much of the payment, arguing that there was insufficient evidence that he was responsible for it or that it was meant to impede the FTC investigation. See Mot. at 15:256:15. But, considered in the light most favorable to the prosecution and alongside the other evidence presented-namely, Sullivan's awareness of the FTC proceeding, the accuracy of his testimony in light of the 2016 breach, his comments about the need for secrecy, his desire to fit the breach into Uber's bug bounty program, and his involvement in the creation of the NDA-a rational juror could reasonably infer that the payment was designed to ensure that information about the breach did not become public and therefore draw further attention from the FTC. The same is true of the NDA itself. See id. at 16:16-26 (arguing that the government “failed to establish that the NDA had anything to do with the FTC's investigation”).
Taken together, and construed in the light most favorable to the prosecution, the evidence presented was such that any rational juror could have found beyond a reasonable doubt that: (1) there was a proceeding pending before the FTC, an agency of the United States; (2) Sullivan was aware of that proceeding; and (3) he intentionally endeavored corruptly to influence, obstruct, or impede it. The evidence was therefore sufficient to support Sullivan's obstruction conviction.
The evidence was also sufficient to support his misprision conviction. To convict Sullivan under section 4, the government had to prove that: (1) a federal felony was committed (in this case, “intentionally accessing a computer without authorization and thereby obtaining information from a protected computer, or conspiracy to extort money through a threat to impair the confidentiality of information obtained from a protected computer without authorization”); (2) Sullivan had knowledge of the commission of that felony; (3) Sullivan had knowledge that the conduct was a federal felony; (4) Sullivan failed to notify federal authorities; and (5) that he did an affirmative act to conceal the crime. See Olson, 856 F.3d at 1220; Final Jury Instrs. at 19.
According to Sullivan, the government did not prove beyond a reasonable doubt that he took affirmative steps to conceal the hackers' crime. Mot. at 29:27-31:19. I disagree. The $100,000 payment to the hackers and NDA support this, specifically the provision where the hackers promised that they “have not and will not disclose anything about the vulnerabilities” or their conversations with Uber without written permission. See Tr. at 899:7-12.
Finally, Sullivan contends that there was insufficient evidence showing that he knew the hackers' conduct was unauthorized and thus constituted a data breach requiring disclosure to the FTC or a federal felony as required under section 4. Mot. at 31:20-33:23. In support, he points to additional testimony from Clark, who told the jury that he advised the Uber team that it could properly treat the incident as an authorized bug bounty and not an unauthorized data breach if they could secure the data, ensure that it had not been further disseminated, and obtain an NDA. See id. at 32:12-25 (citing in part Tr. at 1320:14-18, 1423:18-1424:13). Clark believed that these conditions were satisfied. Tr. at 1530:7-1531:25.
Construing the evidence in the light most favorable to the prosecution, any rational juror could have found beyond a reasonable doubt that Sullivan knew that the hackers' conduct was not authorized. First, the jury heard testimony of Sullivan's prior career as an attorney, specifically as a federal prosecutor who received special training on computer and telecommunication crime and was a founding member of the Northern District of California's “Computer Hacking and IP Unit.” See id. 359:22-361:13. Next, the jury saw evidence of and heard testimony regarding an email Sullivan sent to Uber's new CEO, Dara Khosrowshahi, in which Sullivan wrote that during the incident an “unauthorized party gained access” to Uber's rider and driver data. Id. at 1773:41775:6. The jury was also presented with the evidence of Sullivan's efforts to ensure that news of the breach did not become public and that it fit within Uber's bug bounty program. Any rational juror could find, based on this evidence, that Sullivan knew the breach was not authorized- otherwise, he would not need to bring it within the bug bounty program or ensure that it was not publicized. And, given Sullivan's prior career experience with computer hacking and other crimes, any rational juror could have determined that he knew the breach was unauthorized, despite any statements from Clark that it could be retroactively designated as such.
In sum, after construing the evidence in the light most favorable to the government, any rational juror could have found the essential elements of the two crimes beyond a reasonable doubt. See Nevils, 598 F.3d at 1161. The evidence is sufficient to support Sullivan's convictions of both counts. His motion for a judgment of acquittal is DENIED.
II. MOTION FOR A NEW TRIAL
Sullivan's request for a new trial under Rule 33 is also DENIED, for largely the same reasons as above. The evidence referenced above, along with other evidence presented at trial, supports the jury's verdict. It does not “preponderate[] sufficiently heavily against the verdict that a serious miscarriage of justice may have occurred” and therefore does not present an exceptional circumstance that warrants setting aside the verdict and granting a new trial. See Kellington, 217 F.3d at 1097; Del Toro-Barboza, 673 F.3d at 1153.
CONCLUSION
Sullivan's motion for judgment of acquittal or, alternatively, for a new trial, is DENIED.
IT IS SO ORDERED.