Guide to Protecting Whistleblowers

When businesses, governmental agencies, and specific individuals engage in ethical and legal wrongdoing, it’s the responsibility of those with this information to come forward. Unfortunately, blowing the whistle on such behavior can come with retaliation — from losing your job to being harassed or even threatened. If you have information that might reveal troubling or illegal behavior, this guide is for you.

What Is Whistleblowing?

Whistleblowing is defined as disclosing information that the person believes evidences:

• A violation of a law, rule or regulation
• Mismanagement or any action that has an adverse effect on an organization
• Waste of funds
• Any substantial danger to public safety or health¹.

Types of Whistleblowing

There are several types of whistleblowing, including:

Informal

Informal whistleblowing is not conducted through official channels. It can be anonymous or identified. Here are examples of both:

• Anonymous
  • Internal: This could be an unsigned note to a manager or an anonymous call to Human Resources within the whistleblower’s organization.
  • External: External informal whistleblowing could entail a tip-off to a journalist or anonymous postings online.
• Identified
  • Internal: This could mean simply discussing your concerns with a coworker.
  • External: External, identified whistleblowing could be something like posting about your employer on social media.

Formal:

Formal whistleblowing occurs through official channels like a company’s HR department or the state Attorney General’s office. It can also be anonymous or identified. Here’s what both look like:

• Anonymous
  • Internal: This could mean leaving an anonymous message on an official whistleblower hotline.
  • External: External, formal and anonymous whistleblowing could be something like reporting a medication error to an official program.
• Identified
  • Internal: Internal, identified and formal whistleblowing might mean raising concerns with your company’s HR department directly.
  • External: If internal whistleblowing doesn’t work, people may have to report concerns with a government agency or journalist².

Whistleblowing Examples

Whistleblowing is something that often graces our television screens and newspapers. Here are some recent examples:

• Edward Snowden: Working for a defense contractor, Edward Snowden gave reporters at the Washington Post and the Guardian access to over 1.7 million classified documents revealing the National Security Agency’s surveillance of everybody in the U.S. Called both a hero and a traitor by the public, Snowden now lives in exile in Russia³. His whistleblowing can be classified as informal, external and identified.
• Me Too movement: Recently, there’s been a ton of whistleblowing from the Me Too movement, which calls out sexual assault and discrimination against women. For example, Dr. Larry Nassar, formerly a physician for the U.S women’s gymnastics team, has been accused of molesting and sexually assaulting women since 1998, when a student-athlete at his then-employer Michigan State University first reported him; the university didn’t take any action. After several accusations, a federal, class action lawsuit, and the coming forward of three Olympic athletes, McKayla Maroney, Aly Raisman and Gabby Douglas, Nassar was finally sentenced to 40 to 125 years in prison in 2018, 20 years after the first accusation. In this case, the whistleblowing was at times both anonymous and identified, formal and informal, and internal and external, given the amount of times Nassar was accused of sexual misconduct⁴.
• Black Lives Matter movement: Finally, the Black Lives Matter (BLM) movement against police brutality has done a fair amount of whistleblowing regarding the murders of Tamir Rice, George Floyd and other unarmed black people. BLM has also called out racism in institutions like the Los Angeles Times. Angel Jennings, the newspaper’s only black reporter in local news plus six other journalists, sued the LA Times and its publisher, Tribune Publishing, for their pay gaps compared to their white colleagues, saying it violated California’s Equal Pay Act; they later reached a settlement⁵. This is an example of formal, identified and external whistleblowing.

Consequences of Whistleblowing

Although there are measures in place to prevent retaliation, whistleblowers often face consequences for coming forward with sensitive information. According to the U.S Department of Labor⁶, here are some possible challenges that whistleblowers could face after the fact:

• Retaliation
  • Being fired, laid off or demoted
  • Denied overtime or a promotion
  • Disciplined
  • Denied benefits
  • Reducing pay or hours
  • Failing to rehire or hire
• Intimidation, harassment or threats
• Social isolation or ostracization
• Blacklisting

Resources on Whistleblowing and Protecting Whistleblowers

While federal and most state laws prohibit retaliation against whistleblowers, it’s still best to take steps to protect yourselves, a colleague or even a journalistic source.

How To Protect Yourself as a Whistleblower

Before you whistleblow, make sure you have a plan to protect yourself. Our tips:

• Read the law: First find out if you have engaged in “protected activity” according to your state laws, detailed below. “Protected activity” means that the whistleblower reports or refuses to engage in violations of regulations, laws or rules. Not all whistleblowing is protected equally; rather, the laws vary based on the industry, agency, city, state and more.
• Remain anonymous: The best way to avoid retaliation is to remain anonymous throughout the whistleblowing process. You can do this by reporting to the Securities and Exchange Commission, Commodity Futures Trading Commission and the Internal Revenue Service, all government agencies that will conceal your identity.
• Know the statute of limitations: Different states have different statutes of limitations on the amount of time you have after employee retaliation to create a civil suit. Know that time frame beforehand in case you’re retaliated against. For example, in Florida, whistleblowers have 180 days after receiving a notice from the Florida Commission on Human Relations that they received their complaint to file a civil suit actionst their employer for retaliation. However, Rode Islands have three years after the retaliation to bring civil action against their employer, so the range varies pretty greatly. To learn more, read about your state’s whistleblowing laws below.
• Keep the receipts: Gather as much hard evidence of the violations as possible. Audio recordings are the most useful; however, not all states allow recording of people without their consent, so make sure to look that up beforehand in a guide of state recording laws⁷. If audio recording isn’t allowed, keep detailed notes of both the wrongdoings and any relations you might face. Store them privately, and especially not at your workplace⁸.
• Get help: There are a number of whistleblowing organizations that offer free legal assistance to whistleblowers. Our favorites include:
  • Government Accountability Project: This non-profit organization has helped over 8,000 whistleblowers since 1977, taking on wrongdoings by corporations, government agencies, financial institutions and more⁹.
  • Whistleblower Aid: Finally, Whistleblower Aid is another non-profit providing whistleblowers with free legal aid, although they may take a portion of any monetary award from a retaliation civil suit¹¹.
  • National Whistleblower Center: The National Whistleblowing Center provides information, legal assistance and advocacy for whistleblowers¹⁰.

Best Digital Practices for Whistleblowing

Aside from protecting yourself from employers and the law, there are a few ways you can make sure that your information and identity stay safe, as well. After all, anonymity is the best way to protect yourself as a whistleblower. Here’s what we recommend to retain your digital security:

• Don’t use your work phone: To protect your anonymity, use your home phone as opposed to the phone in your office or organization. Kathleen McClellan, National Security and Human Rights Deputy Director for the Whistleblower and Source Protection Program at ExposeFacts¹², says that it’s unlikely that corporations or government agencies will monitor home devices, unless you work for the NSA, CIA or FBI, in which case avoiding home surveillance may be next to impossible.
• Don’t work on your home or work Internet: If you’re using your home device on a public Wi-Fi network like at a coffee shop, use a VPN, or Virtual Private Network. VPNs hide your web traffic and IP address, encrypting your activity.
• Create accounts with fake names: For any email, social media or messaging apps you may be using to communicate about your whistleblowing, create new accounts with fake information.
• Stay on task: When you’re working on your whistleblowing by using the Internet at all, make sure you don’t do other online activities simultaneously, like checking your email or shopping online.
• Use a secure browser: We recommend using Tor¹³ instead of your regular web browser, as it lets users remain anonymous.
• Use encrypted messaging apps: Instead of using your phone’s default messaging app like iMessage, use an encrypted app like TextSecure¹⁴.
• Check phone settings: You may not know this, but your phone is most likely tracking you at all times. Here’s how to change your settings:
  • iOS: Under Settings, click on Bluetooth and toggle the switch off. Next under Settings, go to Privacy then Location Services and toggle the switch to off.
  • Android: In Settings, click Connected Devices, Connection Preferences, then Bluetooth and turn it off. Also in Settings click on Google, Manage Your Google Account, Data and Personalization then Activity Controls and turn it off.
• Hide your screen: Hacking isn’t the only way that people can get your credentials; they can also do it the old-fashioned way by peaking over your screen¹⁵. To hide your web activity in a flash, you’ll need to know the device’s keyboard shortcut you can press to hide your web windows or tabs. Here are the shortcuts for the most popular computer brands:
  • Mac: Command-H¹⁶
  • Windows: Windows + D¹⁷
  • Chromebook: Shift + Ctrl + w¹⁸
  • Dell: Alt + Q¹⁹
  • HP: Alt + F4²⁰
  • Lenovo: Ctrl-W²¹
• Close accounts on public computers: If you’re using a public computer, make sure to completely log out of your accounts and remove any devices or software that you used on it.

How Journalists Can Protect Whistleblowers

Oftentimes, whistleblowers will turn to journalists as a last resort after being ignored by their employer or a government agency. But in going public with an accusation of wrongdoing, whistleblowers put themselves even more at risk. Here’s how to make sure your source stays safe:

• Use anonymous sources: The easiest way to protect the whistleblower’s identity is to not reveal their identity both in your reporting and even to government requests. Of course, journalists should only use anonymous sources in the event that the whistleblower faces real danger or retaliation and if they can’t get this information elsewhere. We recommend consulting a lawyer before going public with a story.
• Use best digital security practices: Just as whistleblowers protect themselves digitally, journalists should use the same digital security tactics²²; see above for more information.

How Businesses Can Protect Whistleblowers

Businesses and whistleblower employees don’t have to be at odds with each other. Rather, businesses should create environments where whistleblowing is encouraged and where whistleblowers are protected. Senior leadership must be dedicated to transparency, accountability and an anti-retaliation approach, which may include:

• Create a “speak up” culture: Aimed at preventing wrongdoings before they occur, a true “speak up” culture encourages employees to raise issues, knowing that they’ll be resolved fairly.
• Make a resolution system: You should create a system for resolving reported violations that protects the whistleblower.
• Train workers on their rights: Tell your employees their rights when it comes to whistleblowing, including information on internal and external protection programs. Make sure managers are trained as well.
• Use an independent auditor: To determine if your protection program is effective, we recommend hiring an independent auditor²³.

Laws About Whistleblowing

The good news is that whistleblowing is legal in the United States and is protected by dozens of federal, state and even local laws. However, every law has its own respondents, meaning who it covers, as well as stipulations, so again, it’s important to research the legalities before you whistleblow. Your best bet is to contact a lawyer directly, but we outlined the main laws below.

Federal Whistleblowing Laws

The federal government has several regulations that protect employees from retaliation for whistleblowing; however, not every law protects every employee in the U.S. Let’s take a closer look.

• Whistleblower Protection Act: This act applies to federal employees and applicants only, protecting them from employer retaliation.
• Whistleblower Protection Enhancement Act: This act strengthens protections for whistleblower federal employees²⁴.
• False Claims Act: Covering private citizens, the False Claims Act says that anyone can file suit on behalf of the government if someone has filed false claims. If there’s a recovery of funds, the private citizen could receive a portion²⁵.
• Dodd-Frank Act: Among other things, the Dodd-Frank Act establishes a whistleblower program that requires the Commodity Futures Trading Commission to pay eligible whistleblowers who provided information about violations of the Council of Economic Advisers which resulted in the successful enforcement of a covered administrative or judicial action. This act also protects the whistleblowers from retaliation²⁶.
• IRS’ Whistleblower Law: This law says that whistleblowers that report people who don’t pay their owed taxes should be rewarded for up to 30 percent of the remaining tax, penalties and other collected amounts²⁷.
• Taxpayer First Act: This act creates reforms for whistleblowers who report to the Internal Revenue Service specifically. Within 60 days of their referral, they’ll get a response back, plus protection against retaliation²⁸.
• OSHA’s Whistleblower Protection Program²⁹: The Occupational Safety and Health Administration (OSHA) has a program that enforces over 20 federal laws protecting employees against retaliation for whistleblowing or reporting workplace health and safety concerns. These laws span many industries, from food safety to the environment. Here’s what laws OSHA’s Whistleblower Protection Program enforces and the employee respondents covered.
  • Asbestos Hazard Emergency Response Act: Private sector, state/ local government, certain Department of Defense (DoD) schools, certain tribal schools
  • Clean Air Act: Private sector, federal, state and municipal
  • Comprehensive Environmental Response, Compensation and Liability Act: Private sector, federal state and municipal
  • Consumer Financial Protection Act: Anyone engaging with offering or providing a consumer financial product or service, the service provider to such a person, or that person’s affiliate acting as a service provider
  • Consumer Product Safety Improvement Act: Manufacturing, private labeling, distribution, and retailer employers in the U.S
  • Energy Reorganization Act: Nuclear Regulatory Commission contractors or subcontractors, licensees or applications for licenses, Department of Energy contractors or subcontractors, and the Tennessee Valley Authority
  • Federal Railroad Safety Act: Railroad carriers and their contractors, subcontractors and officers
  • Federal Water Pollution Control Act: Private sector, state and municipal employees, Indian tribes, federal employees who file complaints under the Federal Water Pollution Control Act
  • International Safe Container Act: Private sector, local government, certain state government and interstate compact agencies
  • Moving Ahead for Progress in the 21st Century Act: Motor vehicle manufacturers, part suppliers or dealerships
  • National Transit Systems Security Act: Public transportation agencies and their contractors, subcontractors and officers
  • Occupational Safety and Health Act: Private sector, USPS, certain tribal employers
  • Pipeline Safety Improvement Act: Private sector, states, municipalities, individuals owning or operating pipeline facilities and their contractors or subcontractors
  • Safe Drinking Water Act: Private sector, federal, state and municipal governments, Indian tribes
  • Sarbanes-Oxley Act: Companies registered under section 12 or required to report under section 15(d) of the Senior Executive Accountability Act (SEA) and their consolidated subsidiaries, affiliates, contractors, subcontractors, officers, agencies, and nationally-recognized statistical rating organizations
  • Seaman’s Protection Act: Private sector, state and local government employees of American-owned or U.S flagged vessels.
  • Section 402 of the FDA Food Safety Modernization Act: Any entity engaged in the manufacturing, processing, packing, transporting, distribution, reception, holding or importation of food
  • Section 1558 of the Affordable Care Act: Private and public sector employees
  • Solid Waste Disposal Act: Private sector, federal, state, municipal, Indian tribes
  • Surface Transportation Assistance Act: Private sector
  • Toxic Substances Control Act: Private sector
  • Wendell H. Ford Aviation Investment and Reform Act for the 21st Century: Air carriers and their contractors or subcontractors.

That’s it for the federal whistleblowing laws; now, let’s see how the individual states protect whistleblowers.

State Whistleblowing Laws

In the United States, every state has their own laws and regulations. Here, we provide a general overview of each state’s whistleblowing laws and who they protect. Note that this list isn’t completely comprehensive, but instead a basic summary of state laws.

Whistleblowing Statistics

So just how common is whistleblowing, anyway, and what are people reporting the most? To find out, we looked at the hard numbers.

Recap

If you genuinely believe that a company, government agency or person is violating local, state or federal laws, whistleblowing may be the only path to judgment. Of course, there’s always the possibility of retaliation, which is why we recommend brushing up on state and federal laws surrounding whistleblowing, hiring a lawyer or getting free legal assistance, and using best practices for digital security. With these tools in hand, you can stay protected as a whistleblower or protect a whistleblower from retaliation.

References and Footnotes

1. https://www.archives.gov/oig/wpo.html
2. https://www.ncbi.nlm.nih.gov/books/NBK519615/
3. https://www.newyorker.com/magazine/2019/09/23/edward-snowden-and-the-rise-of-whistle-blower-culture
4. https://www.usatoday.com/pages/interactives/larry-nassar-timeline/
5. https://www.latimes.com/entertainment-arts/business/story/2020-06-24/los-angeles-times-black-lives-matter-diversity
6. https://www.whistleblowers.gov/sites/default/files/2016-11/WPAC_BPR_42115.pdf
7. https://www.mwl-law.com/wp-content/uploads/2018/02/RECORDING-CONVERSATIONS-CHART.pdf
8. https://www.lexology.com/library/detail.aspx?g=aaf61211-a4b8-45dd-81a4-cad023f71cb8
9. https://whistleblower.org/
10. https://www.whistleblowers.org/know-your-rights/
11. https://whistlebloweraid.org/
12. https://whisper.exposefacts.org/
13. https://www.torproject.org/download/
14. https://textsecure-private-messenger.en.softonic.com/android
15. https://www.whistleblowers.org/wp-content/uploads/2019/07/Cybersecurity-Best-Practices.pdf
16. https://support.apple.com/en-us/HT201236
17. https://support.microsoft.com/en-us/help/12445/windows-keyboard-shortcuts
18. https://support.google.com/chromebook/answer/183101?hl=en
19. https://www.dell.com/support/article/en-us/sln284208/list-of-windows-8-keyboard-shortcuts?lang=en
20. https://support.lenovo.com/us/en/solutions/ht102949
21. https://www.spj.org/whistleblower/
22. https://www.whistleblowers.gov/sites/default/files/2016-11/WPAC_BPR_42115.pdf
23. https://www.cpsc.gov/About-CPSC/Inspector-General/Whistleblower-Protection-Act-WPA
24. https://www.justice.gov/civil/false-claims-act
25. https://www.cftc.gov/sites/default/files/idc/groups/public/@lrfederalregister/documents/file/2011-20423a.pdf
26. https://www.irs.gov/compliance/whistleblower-informant-award
27. https://www.congress.gov/bill/116th-congress/house-bill/3151/text
28. https://www.whistleblowers.gov/sites/wb/files/2019-12/WB-Statute-Summary-Chart-10.8-Final.pdf
29. http://ethics.alabama.gov/docs/2016_DRAFT_CODFICATION_Restated_AL_Ethics_Act_2016_Revisions(8-1-2016).pdf
30. http://doa.alaska.gov/dop/fileadmin/StatewidePlanning/pdf/WhistleblowerActPoster.pdf
31. http://www.akleg.gov/basis/get_documents.asp?session=29&docid=65327
32. https://www.azleg.gov/ars/23/01501.htm
33. https://www.dfa.arkansas.gov/images/uploads/personalManagementOffice/70_07WhistleBlowerProtectionAct.pdf
34. https://www.auditor.ca.gov/hotline/protections
35. https://www.dir.ca.gov/dlse/WhistleblowersNotice.pdf
36. https://leg.colorado.gov/bills/hb16-1078
37. https://www.stopfraudcolorado.gov/whistleblower-protection.html
38. https://www.ct.gov/chro/cwp/view.asp?a=2528&Q=316236
39. https://delcode.delaware.gov/title19/c017/index.shtml
40. https://www.flsenate.gov/Laws/Statutes/2018/112.3187
41. https://dol.georgia.gov/employment-laws-and-rules
42. https://www.capitol.hawaii.gov/hrscurrent/Vol07_Ch0346-0398/HRS0378/HRS_0378-0062.htm
43. https://legislature.idaho.gov/statutesrules/idstat/title6/t6ch21/sect6-2104/
44. https://www.ilga.gov/legislation/ILCS/ilcs3.asp?ActID=2495&ChapterID=57
45. https://www2.illinois.gov/oeig/complaints/pages/whistleblower.aspx
46. https://www.in.gov/dol/2594.htm
47. https://www.iowaosha.gov/whistleblower-protection-program
48. http://kslegislature.org/li_2018/b2017_18/statute/075_000_0000_chapter/075_029_0000_article/075_029_0073_section/075_029_0073_k/
49. https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=40158
50. http://ethics.la.gov/pub/laws/1169.pdf
51. https://www.maine.gov/audit/fraud/wpa.html
52. https://dbm.maryland.gov/eeo/Documents/Title5.pdf
53. https://malegislature.gov/Laws/GeneralLaws/PartI/TitleXXI/Chapter149/Section185
54. https://www.revisor.mn.gov/statutes/cite/181.932
55. http://www.dmh.ms.gov/wp-content/uploads/2020/01/Mississippi-State-Employee-Handbook-Effective-01.01.2020.pdf
56. https://revisor.mo.gov/main/OneSection.aspx?section=285.575
57. https://www.stlouis-mo.gov/internal-apps/legislative/upload/Ordinances/BOAPdf/70847.pdf
58. https://leg.mt.gov/lad/fraud-hotline/
59. https://nebraskalegislature.gov/divisions/ombud-whistle.php
60. https://www.leg.state.nv.us/nrs/NRS-281.html#NRS281Sec611
61. https://www.leg.state.nv.us/NRS/NRS-618.html#NRS618Sec085
62. http://www.gencourt.state.nh.us/rsa/html/XXIII/275-E/275-E-mrg.htm
63. https://nj.gov/labor/forms_pdfs/lwdhome/CEPA270.1.pdf
64. https://www.nj.gov/oag/corruption/whistleblower-info.html
65. https://www.nmlegis.gov/sessions/10%20Regular/final/HB0165.pdf
66. https://hcr.ny.gov/system/files/documents/2019/04/whistleblowerprocedure.pdf
67. https://legislation.nysenate.gov/pdf/bills/2019/S8397A
68. https://www1.nyc.gov/assets/doi/downloads/pdf/Report/Local%20Law%2033.pdf
69. https://nyassembly.gov/leg/?default_fld=&bn=A5696&term=2013&Memo=Y
70. https://www.ncleg.net/EnactedLegislation/Statutes/HTML/BySection/Chapter_126/GS_126-84.html
71. https://www.legis.nd.gov/cencode/t34c11-1.pdf
72. https://www.legis.nd.gov/cencode/t34c01.pdf?20150821135139
73. http://codes.ohio.gov/orc/4113.52
74. https://omes.ok.gov/sites/g/files/gmc316/f/OWA.pdf
75. https://www.oregon.gov/boli/civil-rights/Pages/whistleblowing-protections.aspx
76. https://ethics.ri.gov/complaints/
77. https://www.scstatehouse.gov/code/t08c027.php
78. https://sdlegislature.gov/Statutes/Codified_Laws/DisplayStatute.aspx?Type=Statute&Statute=3-6D-22
79. https://advance.lexis.com/documentpage/?pdmfid=1000516&crid=c1485d82-5f08-49bd-bb23-7d04fa1b4261&config=025054JABlOTJjNmIyNi0wYjI0LTRjZGEtYWE5ZC0zNGFhOWNhMjFlNDgKAFBvZENhdGFsb2cDFQ14bX2GfyBTaI9WcPX5&pddocfullpath=%2Fshared%2Fdocument%2Fstatutes-legislation%2Furn%3AcontentItem%3A4X8K-SGD0-R03M-Y0T9-00008-00&pdcontentcomponentid=234179&pdteaserkey=sr0&pditab=allpods&ecomp=d5w_kkk&earg=sr0&prid=82a51526-6cab-4794-8da3-a40826652bb6
80. https://www.tn.gov/content/dam/tn/tenncare/documents2/pi08001.pdf
81. https://statutes.capitol.texas.gov/Docs/GV/htm/GV.554.htm
82. https://le.utah.gov/xcode/Title67/Chapter21/C67-21_1800010118000101.pdf
83. https://www.osha.gov/stateplans/ut
84. https://humanresources.vermont.gov/sites/humanresources/files/documents/Vermont%20Whistleblower%20Statute%202014.pdf
85. https://labor.vermont.gov/vermont-occupational-safety-and-health-administration-vosha/whistleblower-protection-program
86. https://law.lis.virginia.gov/vacode/title2.2/chapter30.1/section2.2-3011/
87. https://apps.leg.wa.gov/RCW/default.aspx?cite=42.40
88. https://app.leg.wa.gov/RCW/default.aspx?cite=42.41&full=true#42.41.030
89. http://www.wvlegislature.gov/WVCODE/Code.cfm?chap=06c&amp%3Bamp%3Bart=2
90. https://dwd.wisconsin.gov/er/civilrights/retaliation/whistleblower.htm
91. https://dwd.wisconsin.gov/er/civilrights/retaliation/
92. https://www.osha.gov/stateplans/wy
93. https://www.sec.gov/fast-answers/answersinternethtm.html
94. https://www.sec.gov/files/sec-2018-annual-report-whistleblower-program.pdf
95. https://s3-us-west-2.amazonaws.com/acfepublic/2018-report-to-the-nations.pdf