Guide to Protecting Whistleblowers Resources, Laws and Best Practices
Table of Contents
Whistleblowers are an important part of today’s society, revealing legal and ethical wrongdoings of businesses, organizations, specific people and even the government. But unfortunately, whistleblowing can come with retaliation, from losing a job to getting harassed or threatened. If you’re thinking about whistleblowing or want to protect someone who is, this guide is for you.
What Is Whistleblowing?
Whistleblowing is defined as disclosing information that the person believes evidences:
- A violation of a law, rule or regulation
- Mismanagement or any action that has an adverse effect on an organization
- Waste of funds
- Any substantial danger to public safety or health1.
Types of Whistleblowing
There are several types of whistleblowing, including:
Informal whistleblowing means that it’s not done through official hotlines or organizations designated to handle whistleblowing calls. Informal whistleblowing could be anonymous, meaning the whistleblower’s identity isn’t disclosed, or identified, when it has been. Here are some examples of each:
- Internal: This could be an unsigned note to a manager or an anonymous call to Human Resources within the whistleblower’s organization.
- External: External informal whistleblowing could entail a tip-off to a journalist or anonymous postings online.
- Internal: This could mean simply discussing your concerns with a coworker.
- External: External, identified whistleblowing could be something like posting about your employer on social media.
Formal whistleblowing means that it’s done through the proper channels, be it a company’s HR department or the state Attorney General.
- Internal: This could mean leaving an anonymous message on an official whistleblower hotline.
- External: External, formal and anonymous whistleblowing could be something like reporting a medication error to an official program.
- Internal: Internal, identified and formal whistleblowing might mean raising concerns with your company’s HR department directly.
- External: If internal whistleblowing doesn’t work, people may have to report concerns with a government agency or journalist2.
Whistleblowing is something that often graces our television screens and newspapers. Here are some recent examples:
Edward Snowden: Working for a defense contractor, Edward Snowden gave reporters at the Washington Post and the Guardian access to over 1.7 million classified documents revealing the National Security Agency’s surveillance of everybody in the U.S. Called both a hero and a traitor by the public, Snowden now lives in exile in Russia3. His whistleblowing can be classified as informal, external and identified.
Me Too movement: Recently, there’s been a ton of whistleblowing from the Me Too movement, which calls out sexual assault and discrimination against women. For example, Dr. Larry Nassar, formerly a physician for the U.S women’s gymnastics team, has been accused of molesting and sexually assaulting women since 1998, when a student-athlete at his then-employer Michigan State University first reported him; the university didn’t take any action. After several accusations, a federal, class action lawsuit, and the coming forward of three Olympic athletes, McKayla Maroney, Aly Raisman and Gabby Douglas, Nassar was finally sentenced to 40 to 125 years in prison in 2018, 20 years after the first accusation. In this case, the whistleblowing was at times both anonymous and identified, formal and informal, and internal and external, given the amount of times Nassar was accused of sexual misconduct4.
Black Lives Matter movement: Finally, the Black Lives Matter (BLM) movement against police brutality has done a fair amount of whistleblowing regarding the murders of Tamir Rice, George Floyd and other unarmed black people. BLM has also called out racism in institutions like the Los Angeles Times. Angel Jennings, the newspaper’s only black reporter in local news plus six other journalists, sued the LA Times and its publisher, Tribune Publishing, for their pay gaps compared to their white colleagues, saying it violated California’s Equal Pay Act; they later reached a settlement5. This is an example of formal, identified and external whistleblowing.
Consequences of Whistleblowing
Unfortunately, whistleblowing can have its consequences for the whistleblower, most commonly retaliation. According to the U.S Department of Labor6, here are some possible challenges that whistleblowers could face after the fact:
- Being fired, laid off or demoted
- Denied overtime or a promotion
- Denied benefits
- Reducing pay or hours
- Failing to rehire or hire
- Intimidation, harassment or threats
- Social isolation or ostracization
Resources on Whistleblowing and Protecting Whistleblowers
While federal and most state laws prohibit retaliation against whistleblowers, it’s still best to take steps to protect yourselves, a colleague or even a journalistic source.
How To Protect Yourself as a Whistleblower
Before you whistleblow, make sure you have a plan to protect yourself. Our tips:
Read the law: First find out if you have engaged in “protected activity” according to your state laws, detailed below. “Protected activity” means that the whistleblower reports or refuses to engage in violations of regulations, laws or rules. Not all whistleblowing is protected equally; rather, the laws vary based on the industry, agency, city, state and more.
Remain anonymous: The best way to avoid retaliation is to remain anonymous throughout the whistleblowing process. You can do this by reporting to the Securities and Exchange Commission, Commodity Futures Trading Commission and the Internal Revenue Service, all government agencies that will conceal your identity.
Know the statute of limitations: Different states have different statutes of limitations on the amount of time you have after employee retaliation to create a civil suit. Know that time frame beforehand in case you’re retaliated against. For example, in Florida, whistleblowers have 180 days after receiving a notice from the Florida Commission on Human Relations that they received their complaint to file a civil suit actionst their employer for retaliation. However, Rode Islands have three years after the retaliation to bring civil action against their employer, so the range varies pretty greatly. To learn more, read about your state’s whistleblowing laws below.
Keep the receipts: Gather as much hard evidence of the violations as possible. Audio recordings are the most useful; however, not all states allow recording of people without their consent, so make sure to look that up beforehand in a guide of state recording laws7. If audio recording isn’t allowed, keep detailed notes of both the wrongdoings and any relations you might face. Store them privately, and especially not at your workplace8.
Get help: There are a number of whistleblowing organizations that offer free legal assistance to whistleblowers. Our favorites include:
- Government Accountability Project: This non-profit organization has helped over 8,000 whistleblowers since 1977, taking on wrongdoings by corporations, government agencies, financial institutions and more9.
- Whistleblower Aid: Finally, Whistleblower Aid is another non-profit providing whistleblowers with free legal aid, although they may take a portion of any monetary award from a retaliation civil suit11.
- National Whistleblower Center: The National Whistleblowing Center provides information, legal assistance and advocacy for whistleblowers10.
Best Digital Practices for Whistleblowing
Aside from protecting yourself from employers and the law, there are a few ways you can make sure that your information and identity stay safe, as well. After all, anonymity is the best way to protect yourself as a whistleblower. Here’s what we recommend to retain your digital security:
Don’t use your work phone: To protect your anonymity, use your home phone as opposed to the phone in your office or organization. Kathleen McClellan, National Security and Human Rights Deputy Director for the Whistleblower and Source Protection Program at ExposeFacts12, says that it’s unlikely that corporations or government agencies will monitor home devices, unless you work for the NSA, CIA or FBI, in which case avoiding home surveillance may be next to impossible.
Don’t work on your home or work Internet: If you’re using your home device on a public Wi-Fi network like at a coffee shop, use a VPN, or Virtual Private Network. VPNs hide your web traffic and IP address, encrypting your activity.
Create accounts with fake names: For any email, social media or messaging apps you may be using to communicate about your whistleblowing, create new accounts with fake information.
Stay on task: When you’re working on your whistleblowing by using the Internet at all, make sure you don’t do other online activities simultaneously, like checking your email or shopping online.
Use a secure browser: We recommend using Tor13 instead of your regular web browser, as it lets users remain anonymous.
Use encrypted messaging apps: Instead of using your phone’s default messaging app like iMessage, use an encrypted app like TextSecure14.
Check phone settings: You may not know this, but your phone is most likely tracking you at all times. Here’s how to change your settings:
- iOS: Under Settings, click on Bluetooth and toggle the switch off. Next under Settings, go to Privacy then Location Services and toggle the switch to off.
- Android: In Settings, click Connected Devices, Connection Preferences, then Bluetooth and turn it off. Also in Settings click on Google, Manage Your Google Account, Data and Personalization then Activity Controls and turn it off.
Hide your screen: Hacking isn’t the only way that people can get your credentials; they can also do it the old-fashioned way by peaking over your screen15. To hide your web activity in a flash, you’ll need to know the device’s keyboard shortcut you can press to hide your web windows or tabs. Here are the shortcuts for the most popular computer brands:
Close accounts on public computers: If you’re using a public computer, make sure to completely log out of your accounts and remove any devices or software that you used on it.
How Journalists Can Protect Whistleblowers
Oftentimes, whistleblowers will turn to journalists as a last resort after being ignored by their employer or a government agency. But in going public with an accusation of wrongdoing, whistleblowers put themselves even more at risk. Here’s how to make sure your source stays safe:
Use anonymous sources: The easiest way to protect the whistleblower’s identity is to not reveal their identity both in your reporting and even to government requests. Of course, journalists should only use anonymous sources in the event that the whistleblower faces real danger or retaliation and if they can’t get this information elsewhere. We recommend consulting a lawyer before going public with a story.
Use best digital security practices: Just as whistleblowers protect themselves digitally, journalists should use the same digital security tactics22; see above for more information.
How Businesses Can Protect Whistleblowers
Businesses and whistleblower employees don’t have to be at odds with each other. Rather, businesses should create environments where whistleblowing is encouraged and where whistleblowers are protected. Senior leadership must be dedicated to transparency, accountability and an anti-retaliation approach, which may include:
Create a “speak up” culture: Aimed at preventing wrongdoings before they occur, a true “speak up” culture encourages employees to raise issues, knowing that they’ll be resolved fairly.
Make a resolution system: You should create a system for resolving reported violations that protects the whistleblower.
Train workers on their rights: Tell your employees their rights when it comes to whistleblowing, including information on internal and external protection programs. Make sure managers are trained as well.
Use an independent auditor: To determine if your protection program is effective, we recommend hiring an independent auditor23.
Laws About Whistleblowing
The good news is that whistleblowing is legal in the United States and is protected by dozens of federal, state and even local laws. However, every law has its own respondents, meaning who it covers, as well as stipulations, so again, it’s important to research the legalities before you whistleblow. Your best bet is to contact a lawyer directly, but we outlined the main laws below.
Federal Whistleblowing Laws
The federal government has several regulations that protect employees from retaliation for whistleblowing; however, not every law protects every employee in the U.S. Let’s take a closer look.
- Whistleblower Protection Act: This act applies to federal employees and applicants only, protecting them from employer retaliation.
- Whistleblower Protection Enhancement Act: This act strengthens protections for whistleblower federal employees24.
- False Claims Act: Covering private citizens, the False Claims Act says that anyone can file suit on behalf of the government if someone has filed false claims. If there’s a recovery of funds, the private citizen could receive a portion25.
- Dodd-Frank Act: Among other things, the Dodd-Frank Act establishes a whistleblower program that requires the Commodity Futures Trading Commission to pay eligible whistleblowers who provided information about violations of the Council of Economic Advisers which resulted in the successful enforcement of a covered administrative or judicial action. This act also protects the whistleblowers from retaliation26.
- IRS’ Whistleblower Law: This law says that whistleblowers that report people who don’t pay their owed taxes should be rewarded for up to 30 percent of the remaining tax, penalties and other collected amounts27.
- Taxpayer First Act: This act creates reforms for whistleblowers who report to the Internal Revenue Service specifically. Within 60 days of their referral, they’ll get a response back, plus protection against retaliation28.
- OSHA’s Whistleblower Protection Program29: The Occupational Safety and Health Administration (OSHA) has a program that enforces over 20 federal laws protecting employees against retaliation for whistleblowing or reporting workplace health and safety concerns. These laws span many industries, from food safety to the environment. Here’s what laws OSHA’s Whistleblower Protection Program enforces and the employee respondents covered.
- Asbestos Hazard Emergency Response Act: Private sector, state/ local government, certain Department of Defense (DoD) schools, certain tribal schools
- Clean Air Act: Private sector, federal, state and municipal
- Comprehensive Environmental Response, Compensation and Liability Act: Private sector, federal state and municipal
- Consumer Financial Protection Act: Anyone engaging with offering or providing a consumer financial product or service, the service provider to such a person, or that person’s affiliate acting as a service provider
- Consumer Product Safety Improvement Act: Manufacturing, private labeling, distribution, and retailer employers in the U.S
Energy Reorganization Act: Nuclear Regulatory Commission contractors or subcontractors, licensees or applications for licenses, Department of Energy contractors or subcontractors, and the Tennessee Valley Authority
- Federal Railroad Safety Act: Railroad carriers and their contractors, subcontractors and officers
- Federal Water Pollution Control Act: Private sector, state and municipal employees, Indian tribes, federal employees who file complaints under the Federal Water Pollution Control Act
- International Safe Container Act: Private sector, local government, certain state government and interstate compact agencies
- Moving Ahead for Progress in the 21st Century Act: Motor vehicle manufacturers, part suppliers or dealerships
- National Transit Systems Security Act: Public transportation agencies and their contractors, subcontractors and officers
- Occupational Safety and Health Act: Private sector, USPS, certain tribal employers
- Pipeline Safety Improvement Act: Private sector, states, municipalities, individuals owning or operating pipeline facilities and their contractors or subcontractors
- Safe Drinking Water Act: Private sector, federal, state and municipal governments, Indian tribes
- Sarbanes-Oxley Act: Companies registered under section 12 or required to report under section 15(d) of the Senior Executive Accountability Act (SEA) and their consolidated subsidiaries, affiliates, contractors, subcontractors, officers, agencies, and nationally-recognized statistical rating organizations
- Seaman’s Protection Act: Private sector, state and local government employees of American-owned or U.S flagged vessels.
- Section 402 of the FDA Food Safety Modernization Act: Any entity engaged in the manufacturing, processing, packing, transporting, distribution, reception, holding or importation of food
- Section 1558 of the Affordable Care Act: Private and public sector employees
- Solid Waste Disposal Act: Private sector, federal, state, municipal, Indian tribes
- Surface Transportation Assistance Act: Private sector
- Toxic Substances Control Act: Private sector
- Wendell H. Ford Aviation Investment and Reform Act for the 21st Century: Air carriers and their contractors or subcontractors.
That’s it for the federal whistleblowing laws; now, let’s see how the individual states protect whistleblowers.
State Whistleblowing Laws
In the United States, every state has their own laws and regulations. Here, we provide a general overview of each state’s whistleblowing laws and who they protect. Note that this list isn’t completely comprehensive, but instead a basic summary of state laws.
|State||State’s Whistleblower Protection Laws||Employees Protected from Retaliation|
|Alabama||Alabama Ethics Act30||Public|
|Alaska||State of Alaska Whistleblower Act31, Alaska Whistleblower Protection Act32||State|
|Arizona||Arizona Revised Statutes33||All|
|Arkansas||Fraud Detection and
Whistle-Blower Protection Act34
|California||California Whistleblower Protection Act35, California Labor Code36||All|
|Colorado||Labor Government Employee Whistleblower Protection37, State Employee Protection Act38, Medicaid False Claims Act39||All|
|Connecticut||Connecticuit General Statutes40||All|
|Delaware||Delaware Whistleblowers' Protection Act41||All|
|Hawaii||Hawaii Whistleblowers’ Protection Act44||All|
|Illinois||Whistleblower Act46, Illinois False Claims Act, State Officials and Employees Ethics Act47||All|
|Indiana||Indiana Occupational Safety & Health Act48||All|
|Iowa||Iowa Occupational Safety & Health Act49||All|
|Kansas||Kansas Whistleblower Act50||State|
|Louisiana||Freedom From Reprisal For Disclosure of Improper Acts52||Public|
|Maine||Whistleblower’s Protection Act53||All|
|Maryland||Maryland Whistleblower Law54||All|
|Massachusetts||Massachusetts General Laws55||All|
|Michigan||Whistleblowers’ Protection Act58||All|
|Missouri||Whistleblower’s Protection Act58, St. Louis City Whistleblower Law59||All|
|Nebraska||State Government Effectiveness Act61||State|
|Nevada||Whistleblower Law62, Nevada OSHA Protection Program63||All|
|New Hampshire||Whistleblowers’ Protection Act64||All|
|New Jersey||Conscientious Employee Protection Act65, Anti-Corruption Whistleblower Program66||All|
|New Mexico||Whistleblower Protection Act67||Public|
|New York||Whistleblower Policy and Procedure68, Senate Bill S8397A69, NYC Whistleblower Law70, New York State Labor Law71||All|
|North Carolina||North Carolina General Statute72||State|
|North Dakota||Public Employee Relations Act73, North Dakota Century Code74||All|
|Ohio||Ohio Revised Code75||All|
|Oklahoma||Oklahoma Whistleblower Act76||State|
|Oregon||Oregon Revised Statutes77||All|
State, local government, publicly funded groups
|Rhode Island||Rhode Island Whistleblower Act78||All|
|South Carolina||South Carolina Code of Laws79||Public|
|South Dakota||South Dakota Code of Laws80||Civil service|
|Tennessee||Tennessee Code81, Tennessee Medicaid False Claims Act82||
State and local government, all for Medicaid fraud reports
|Texas||Texas Whistleblower Act83||Public|
|Utah||Utah Protection of Public Employees Act84, Utah OSHA State Plan85||
Public, most private sector employees
|Vermont||Vermont Statutes86, VOSHA’S Whistleblower Protection Program87||
State, private sector employees engaged in a business affecting interstate commerce
|Virginia||Code of Virginia88||All|
|Washington||State Employee Whistleblower Protection89, Local Government||State, local|
|West Virginia||Whistle-blower Law91||Public|
|Wisconsin||Whistleblower Law92, Fair Employment Law93||All|
|Wyoming||Wyoming State OSHA Plan94||
Most private sector employees
So just how common is whistleblowing, anyway, and what are people reporting the most? To find out, we looked at the hard numbers.
If you genuinely believe that a company, government agency or person is violating local, state or federal laws, whistleblowing may be the only path to judgment. Of course, there’s always the possibility of retaliation, which is why we recommend brushing up on state and federal laws surrounding whistleblowing, hiring a lawyer or getting free legal assistance, and using best practices for digital security. With these tools in hand, you can stay protected as a whistleblower or protect a whistleblower from retaliation.
References and Footnotes