Former Uber Security Chief Charged with Concealing Hack

That predates him joining Cloudflare, as far as I can tell.

As much as cloudflare downplayed the vulnerability, it's nothing in comparison to how much researchers overplayed it.

If people really gave a shit about the impact on the poor affected innocents, the best thing to do was to fix it silently and wait 30 days for internet caches to clear before disclosing. Also raise an immediate deletion request to google on the 100 or so affected pages it stored in cache, that's ridiculously little compared to the alleged impact.

There’s a famous YouTube video of a law professor encouraging people to never talk to the police.

Civics classes regularly tell students they have an absolute right to stay silent.

The idea that US citizens have an obligation to report crimes is not obvious, and sounds like “compelled speech.“

If this is true, I find it shocking. I thought I had an almost infinite right to keep my mouth shut, and the exceptions involved a judge telling me “you must answer the question” - or at least signing a warrant.

You’re missing an element of the crime. Here are the elements according to the Ninth Circuit, which is the jurisdiction in which Sullivan is being charged.

Under 18 U.S.C. § 4, “the government must prove beyond a reasonable doubt: ‘(1) that the principal . . . committed and completed the felony alleged; (2) that the defendant had full knowledge of that fact; (3) that he failed to notify the authorities; and (4) that he took affirmative steps to conceal the crime of the principal.”

So merely failing to report a felony, even one you directly witnessed, does not give rise to a criminal act under the law. Otherwise every witness to a a crime could be considered a criminal if they didn’t report it. You have to engage in some act of concealment as well.

If someone is attacked and they accept money not to press charges, isn’t that concealing a crime to authorities?