Uber Says Whistleblower Was Extorting the Company

Photo: Getty

The drama surrounding an explosive letter written by former Uber employee Richard Jacobs keeps heating up, with Uber executives testifying in court today to try to undermine it.

The letter claimed Uber’s Marketplace Analytics team used the encrypted, ephemeral chat app Wickr and worked on secret servers and devices that couldn’t be traced back to Uber in order to steal confidential information and trade secrets from competitors. It emerged this week in connection with the lawsuit in which Waymo alleges that Uber stole its trade secrets. The trial was scheduled to start next week, but based on the letter, US District Judge William Alsup delayed the trial until he could determine whether Uber had withheld evidence.

Today, Uber’s deputy general counsel Angela Padilla claimed the former employee made the claims in the letter in an effort to extort Uber. At the time the Jacobs, a former member of Uber’s security team, had threatened to sue the company—but Uber ultimately settled with him for millions of dollars. During his testimony yesterday, Jacobs said some of the claims made in the letter were not accurate and that he hadn’t had much time to review it before his lawyers sent it to Uber.

Padilla said Uber voluntarily disclosed the existence of the letter to the US Attorney’s Office in June and to courts in New York and California in September. The company decided to disclose the letter to the government to preempt Jacobs, who had threatened to go to the government himself, Padilla said.

The letter also made its way to several members of Uber’s board, she testified, including Benchmark general partner Bill Gurley, Uber co-founder Garrett Camp, Uber’s SVP Ryan Graves, TPG founding partner David Bonderman, Nestle executive Wan Ling Martello, Arianna Huffington, and Travis Kalanick. Salle Yoo, Uber’s former chief legal officer, also saw the letter, although she did not sit on the board.

Padilla described Jacobs as an extortionist who made explosive claims about what Uber was up to in order to score a payout. Uber ultimately reached a $4.5 million dollar settlement with Jacobs, and paid an additional $3 million to his lawyers. As part of the settlement, Jacobs is working as a consultant on Uber’s internal investigation into his claims. It’s unclear what Jacobs’ lawsuit was over

Judge Alsup argued that Uber would not have made such a massive payment to Jacobs if there was no merit to his claims. “You said it was a fantastic BS letter, nothing to it. And yet you paid $4.5 million dollars,” he said. “That is a lot of money and people don’t pay that kind of money for BS. You certainly don’t hire them as consultants if you think everything they have to offer is BS.”

Jacobs was caught moving confidential documents from Uber to his personal email account, Padilla explained. “He was stealing those documents in order to be a whistleblower,” she said. When he was confronted, he sent an email to Kalanick and other senior Uber executives with the subject line “criminal and unethical activities in security” and resigned shortly after.

The email mentioned Waymo and ATG (Uber’s Advanced Technologies Group, which leads its autonomous vehicle development). However, his email was not turned over to Waymo’s lawyers during discovery because the term “waymo” was not included in the list that Waymo asked Uber to search for.

During the hearing, Uber CEO Dara Khosrowshahi announced on Twitter that Uber employees were no longer allowed to use Wickr for workplace communications. “True that Wickr, Telegram were used often at Uber when I came in,” he wrote. “As of Sept 27th I directed my teams NOT to use such Apps when discussing Uber-related business.”

Two executives from Uber’s security team, Mat Henley and Nick Gicinto, testified that Wickr was not used to communicate about trade secret theft. However, Henley and Gicinto revealed that Uber did conduct surveillance on its competitors. Henley said he tasked staffers with surveilling the routes used by a competing autonomous vehicle developer, and Gicinto said that he had received an audio recording of staffers from the overseas ride-hailing companies Didi Chuxing and Grab.

The trial, which was scheduled to begin next week, has been delayed until February. Waymo will use the extra time to dig into the claims made in the Jacobs letter and try to determine whether it was ever a target of Uber’s surveillance.

This story was updated at 3:30 p.m.

Correction: This post originally misidentified one of the ride-hailing companies former Uber security team member Nick Gicinto received audio recordings of as Gett instead of Grab.  We regret the error.

Uber Admits 2.7 Million UK Users Affected by Data Breach

Photo: Getty

Uber has confirmed that data for about 2.7 million customers in the United Kingdom was stolen in the 2016 breach that affected at least 57 million people worldwide. Reports revealed last week that Uber tried to keep the hack secret for more than a year, and even paid the hackers $100,000 to delete the information and stay mum about the whole mess.

The new revelation about UK victims of the breach comes via the nation’s Information Commissioner’s Office, a data protection agency. In a report released today, ICO deputy commissioner James Dipple-Johnstone wrote that,“Uber has said the breach involved names, mobile phone numbers and email addresses.”

But the agency is still trying to confirm the scope of the breach. “As part of our investigation we are still waiting for technical reports which should give full confirmation of the figures and the type of personal data that has been compromised,” Johnstone wrote.

Uber did not respond to a Gizmodo request for comment. A section about the 2016 breach on Uber’s help page states that the company’s “outside forensics experts have not seen any indication that trip location history, credit card numbers, bank account numbers, Social Security numbers or dates of birth were downloaded.”

Responding to the report, London mayor Sadiq Khan told The Telegraph “Uber needs to urgently confirm which of their customers are affected, what is being done to ensure these customers don’t suffer adversely, and what action is being taken to prevent this happening again in the future.”

Stateside, Uber is also just beginning to face government scrutiny over the hack. On Monday, Republicans and Democrats in Congress began pressuringUber to disclose more information about its handling the breach. And the company is already facing about a dozen federal lawsuits related to the incident.