On Oct. 5, 2022, former Uber Chief Security Officer Joseph Sullivan was found guilty of misprision of a felony and obstruction of justice in the U.S. District Court for the Northern District of California for his role in covering up a 2016 data breach involving the records of approximately 57 million users and 600,000 drivers. Sullivan's conviction provides a rare look at the use of the federal misprision statute against an officer of a major U.S. concern and the first known instance of its application in connection with concealing a cybersecurity incident. The conviction has rightly become a topic of conversation in the C-suites of many companies in recent weeks—raising the question of what obligations management has to report a crime once it has identified wrongdoing. In this article we examine the misprision of a felony statute and offer insight into what it means for those who become aware of a crime during the course of business moving forward.

Misprision of a Felony

Misprision of a felony (18 U.S.C. §4) makes it a crime for anyone having knowledge of the commission of a felony to conceal and to "not as soon as possible make known the same to some judge or other person in civil or military authority under the United States …" The impetus for the law, which dates back to English common law, was to prohibit those who witness the commission of a felony—but are neither principals or accessories thereto—from concealing evidence of that felony and failing to report it to the proper authorities. In recent years the law "has become a little used and much maligned criminal charge" (United States v. Olson, 856 F.3d 1216, 1222 (9th Cir. 2017)), as prosecutors prefer to pursue bad actors as accessories after-the-fact rather than through a misprision count, which carries a maximum sentence of only three years. The law's opponents have argued that it has outlived its usefulness in light of modern law enforcement tactics and that it runs afoul of a citizen's right against self-incrimination (United States v. King, 402 F.2d 694, 697 (9th Cir. 1968)).

To successfully bring a charge of misprision of a felony, the government must prove beyond a reasonable doubt each of four elements: (1) the principal committed and completed the alleged felony; (2) the defendant had full knowledge of that fact; (3) the defendant failed to notify the authorities of the underlying felony; and (4) the defendant "took affirmative steps to conceal the crime of the principal." Olson, 856 F.3d at 1220. Importantly for the scienter requirement of the second element, the government must prove not only that the defendant knew the principal engaged in the underlying conduct, but also that the defendant knew that the conduct constituted a felony. Id. at 1222. To establish that the defendant knew the conduct was a felony, the government need not prove that the defendant knew the "precise term of imprisonment authorized by law," but that they knew the punishment could exceed a year in prison. Id. at 1224. Misprision applies only to knowledge of another's felony; individuals cannot be guilty of misprision of their own felonies. See Jones v. State, 14 Ind. 120 (1860).