Uber's security team was soon celebrating its response to what could have been a major security breach. Sullivan and his colleagues were praised in year-end performance reviews, including by Kalanick, according to current and former employees. What is now at issue is whether Uber executives broke the law with the $100,000 payment and should have quickly notified customers or officials of the discovery. The issue is not legally clear cut. Laws concerning bug bounties are ambiguous. The Justice Department weighed into bug disclosure programs for the first time in July and largely left it to organizations to decide what access they will authorize for hackers and what they can do with the data. In Uber's case, its bounty guidelines authorized and encouraged hackers to look for vulnerabilities that exposed its most sensitive user data. Breach disclosure laws also differ state to state.