Whistleblower Protections
Oversight & Investigations

Whistleblower Protections

Skip to main content
Table of Contents
< All Topics
Print

Whistleblower Protections

Instructions

You help Citizen Analyst navigate whistleblower law: which statute may cover a person, which channel that statute protects, what the deadline and remedy are, and which risks sit outside every statute. You replicate the navigation work of whistleblower counsel such as the Government Accountability Project and Empower Oversight, not their representation. We never tell a source that a disclosure is protected; only their lawyer can.

Use this skill to:

  • explain the protection landscape in a story about a whistleblower or a retaliation case;
  • screen an inbound tip from someone who says they are a whistleblower, and route them to counsel;
  • check whether a reported disclosure went through a protected channel before we characterise it.

Do not use it for:

  • secure channels, SecureDrop, Signal or metadata hygiene: use secure-source-communication;
  • verifying a leaked document: use media-verification-specialist and source-credibility-scoring;
  • tracking an official’s corruption pattern: use public-corruption-ombudsman (it cites this skill for retaliation);
  • FOIA requests and appeals: use public-records-research-specialist;
  • First Amendment doctrine beyond the public-employee note in §2: use first-amendment-legal-expert.

What a citizen journalist can do without compulsion. We cannot subpoena, grant immunity or promise confidentiality enforceable against a court. We can receive information through a secure channel, verify it from independent records, publish what is in the public interest, and point the source to people who can protect them. Every method below stays inside that line.

1. Who this is for, and the journalist/advocate line

Role Does Never does
Reporter / editor (us) Receives, verifies, decides what to publish, protects the source’s identity as far as we lawfully can Advises on legal strategy; tells a source a disclosure is “safe” or “protected”; files a complaint on the source’s behalf
Referral desk (us, separately logged) Gives the source the neutral referral list in §5 and the official channel names in §2–§3 Picks one organisation for them; trades coverage for a referral
Counsel (outside) Advises on protection, deadlines, channel and NDA exposure; files —

Disclosure rule. If we referred a source who later appears in our reporting, the story says so in a disclosure line (study §11 guardrail 6). Referral is never conditioned on the source talking to us.

2. Federal statutes: coverage, channel, deadline, remedy

How to read this table. Each row names the statute and the subsection that holds the deadline or remedy. Deadlines are short and some run from the date of the retaliation, not the disclosure. Every deadline here must be checked against the current statute and with counsel before anyone relies on it. Confirmed cites link the statute text; a cite still marked Verify has not been checked against it (§Sources).

Statute Who is covered Protected disclosure (summary) Channel Deadline Remedy Source
Whistleblower Protection Act (1989) / WPEA (2012) Most federal civil-service employees, former employees and applicants; FBI, IC elements and GAO excluded Reasonable belief of a violation of law, rule or regulation; gross mismanagement; gross waste of funds; abuse of authority; substantial and specific danger to public health or safety Office of Special Counsel (OSC), then Merit Systems Protection Board (MSPB) individual right of action; IG; Congress IRA appeal to MSPB within 65 days of OSC’s close-out letter (60 days from receipt if it arrives more than 5 days late), or after 120 days without OSC action (5 C.F.R. §1209.5) Corrective action incl. back pay, attorney fees, compensatory damages 5 U.S.C. §2302(b)(8)–(9); §1214(a)(3); §1221(g); 5 C.F.R. §1209.5
Anti-gag (WPEA) Federal employees An agency may not enforce a nondisclosure policy or agreement lacking the statutory statement preserving whistleblower rights OSC Same as WPA Same as WPA 5 U.S.C. §2302(b)(13)
Right to petition Congress Federal employees Petitioning Congress or furnishing information to either House, a committee or a Member “may not be interfered with or denied” Any Member or committee None stated None in the section itself; retaliation is pursued under WPA 5 U.S.C. §7211
Inspector General Act Employees of the IG’s agency Complaints of violations of law, mismanagement, waste, abuse of authority, danger to health or safety The agency’s IG None stated IG may not disclose the employee’s identity without consent, unless unavoidable; reprisal is a prohibited act 5 U.S.C. §407 (recodified 2022 from IG Act §7)
IC Whistleblower Protection Act / PPD-19 Employees and contractors of intelligence-community elements An “urgent concern” (serious abuse, violation of law, false statement to Congress, reprisal) IC element IG or IC IG → DNI → intelligence committees; never the press IG credibility finding within 14 days, counted from when the employee confirms intent to report to Congress; DNI forwards to the committees within 7 days IC internal review and external review panel; clearance-retaliation review 50 U.S.C. §3033(k)(5); §3234, §3341(j) and PPD-19 (2012): Verify
Military Whistleblower Protection Act Members of the armed forces Communication with a Member of Congress or IG; disclosures of violations, mismanagement, waste, abuse, danger DoD or service IG; Congress IG need not investigate a reprisal complaint made more than one year after the member became aware Correction of military records through the board for correction 10 U.S.C. §1034(c)(5), (g)
Federal contractor and grantee employees Employees of federal contractors, subcontractors, grantees Gross mismanagement of a federal contract or grant, gross waste, abuse of authority, danger to health or safety, violation of law related to the contract Agency IG, Congress, GAO, agency officials, DOJ, a court or grand jury, a supervisor Complaint to the IG within 3 years of the reprisal; district-court action if the agency has not acted within 210 days Reinstatement, back pay, compensatory damages, fees 41 U.S.C. §4712(b)(4), (c)(2)
Sarbanes-Oxley §806 Employees of public companies and their contractors Securities fraud, mail/wire/bank fraud, SEC rule violations OSHA (Department of Labor); SEC; Congress; supervisor 180 days after the violation or after the employee learns of it Reinstatement, back pay with interest, special damages incl. fees 18 U.S.C. §1514A(b)(2)(D), (c)
Dodd-Frank: SEC program Anyone reporting securities violations to the SEC Original information leading to a sanction over $1 million SEC Office of the Whistleblower (report to the SEC is required for the anti-retaliation claim, Digital Realty v. Somers, 2018) Retaliation suit: 6 years after the violation or 3 years after the facts became known, never more than 10 Award of 10–30% of sanctions collected; retaliation: reinstatement, 2× back pay, fees 15 U.S.C. §78u-6(b), (h); 17 C.F.R. §240.21F-17: Verify
Dodd-Frank: CFTC program Anyone reporting commodities violations to the CFTC Original information leading to a sanction over $1 million CFTC Whistleblower Office Retaliation suit: 2 years after the violation Award of 10–30% of sanctions collected; retaliation: reinstatement, back pay 1× with interest, fees 7 U.S.C. §26(b), (h)
False Claims Act (qui tam) Anyone with knowledge of fraud on federal funds; retaliation protection for employees, contractors, agents False claims for federal money Sealed complaint in federal court served on DOJ, through counsel Retaliation: 3 years after the retaliation Relator share 15–25% if DOJ intervenes, 25–30% if not; retaliation: reinstatement, 2× back pay, special damages 31 U.S.C. §3730(b), (d), (h)(3)
IRS whistleblower program Anyone reporting tax underpayment Information on underpayment where the amount in dispute exceeds $2 million IRS Whistleblower Office (Form 211) Retaliation complaint: 180 days, §7623(d) Award of 15–30% of collected proceeds; retaliation remedy under §7623(d) 26 U.S.C. §7623(b), (d)
OSHA-administered statutes Workers in sectors covered by more than 20 statutes (workplace safety, transport, environment, consumer and financial protection) Varies by statute OSHA, whistleblowers.gov Varies by statute; OSH Act §11(c) is 30 days. Check the statute-specific deadline with counsel Varies by statute 29 U.S.C. §660(c)(2); whistleblowers.gov

Public employees and the First Amendment. Speech made pursuant to an employee’s official duties is not protected by the First Amendment (Garcetti v. Ceballos, 547 U.S. 410 (2006)); sworn testimony outside ordinary job duties can be (Lane v. Franks, 573 U.S. 228 (2014)). State and local employees depend on state law and this doctrine, not on the WPA.

What the table does not decide. Whether a particular disclosure qualifies, whether a channel was used correctly and whether a deadline is still open are questions for the source’s lawyer. In copy we write “may be covered by” and name the statute; we never write “is protected”.

3. Congressional channels

Channel What it is How we use it Source
Committee of jurisdiction (majority and minority staff) Where a disclosure to Congress lands in practice; 5 U.S.C. §7211 and §2302(b)(8) cover the federal employee Name both the majority and minority offices; never steer to one party 5 U.S.C. §7211
House Office of the Whistleblower Ombuds House office established in the 116th Congress; it cannot accept disclosures Background on how House offices should handle intake; never send a source there to disclose whistleblower.house.gov/about
Senate Whistleblower Protection Caucus Bipartisan Senate caucus launched in 2015 A point of contact for the members who track whistleblower issues; not a legal channel Wyden press release
Intelligence committees The only lawful congressional route for classified IC disclosures, and only through the ICWPA process Never suggest a source carry classified material to any office directly 50 U.S.C. §3033(k)(5)

Partisan symmetry. A congressional referral lists both parties’ offices on the committee. A story about a whistleblower’s congressional disclosure states which offices received it, if known, and does not imply that one party’s office is the safe one.

4. Risks outside the statutes

Risk What can go wrong What we do
Classified information Disclosure outside the ICWPA or IG channel is not protected and can be prosecuted (e.g. 18 U.S.C. §793). Public disclosure of information that law or executive order requires to be kept secret falls outside 5 U.S.C. §2302(b)(8)(A) Do not solicit classified material. If a source offers it, stop the intake and route to counsel; editor decides any publication question with legal review
Nondisclosure agreements Private NDAs may be enforced in contract; federal NDAs must carry the anti-gag statement; the SEC bars agreements that impede reporting to it Ask whether the source signed one; do not read it for them; counsel decides. Sources: 5 U.S.C. §2302(b)(13); 17 C.F.R. §240.21F-17 (Verify)
Trade secrets Taking documents can create civil or criminal exposure Immunity exists for disclosure in confidence to a government official or attorney, solely to report a suspected violation, or in a sealed filing. It does not cover giving documents to a reporter. 18 U.S.C. §1833(b)
State law State and local employees and private workers outside the sectors above depend on state statutes that vary widely Name the state; tell the source state law applies and counsel must check it. We do not summarise a state’s law without a cited source
Copying, timing, identity Removing originals, using work devices, or a unique document watermark can expose the source Hand off to secure-source-communication before any material is sent

5. Newsroom intake workflow

Step Action Output Gate
1. Channel Move the conversation to a channel chosen with secure-source-communication; stop collecting on work email or work devices Channel noted in the intake record (no identifying data) No material accepted before this step
2. Role statement Read the source the role statement (Appendix A): we are journalists, not lawyers; we cannot promise legal protection Statement given, date Required
3. Screen Sector, employer type, whether classified material, an NDA or trade secrets are involved; whether a deadline may be running Risk screen (Appendix B) Classified → stop and refer
4. Referral Give the neutral referral list below and the official channels from §2–§3 Referral logged Never conditioned on cooperation
5. Verify Corroborate claims from records we can obtain without compulsion: public filings, court dockets, IG reports, FOIA Verification notes with sources osint-orchestrator source tiers
6. Minimise harm Decide what identifying detail to omit; weigh privacy of third parties named in documents Harm note Editor sign-off
7. Publish or hold Publish under the allegation / finding / charge rule (Safety); disclose any referral Story + disclosure line claims-integrity-audit, malice-evaluator

Referral list (options, not endorsements; listed alphabetically). Empower Oversight; Government Accountability Project; Project On Government Oversight (POGO, resources and Hill contacts rather than representation); Whistleblower Aid (Verify: not confirmed in this build) [B]. Study §6.4 records GAP and Empower as providing pro bono whistleblower representation and POGO as a whistleblower-sourcing organisation. A state bar referral service is the default for state-law matters. We list them; the source chooses.

Sources

Primary (statute and regulation; each to be read in its current text at uscode.house.gov or ecfr.gov):

Agency and congressional:

  • Office of Special Counsel, osc.gov; MSPB, mspb.gov; OSHA, whistleblowers.gov; SEC Office of the Whistleblower, sec.gov/whistleblower; CFTC, whistleblower.gov; IRS Form 211. Verify each URL.
  • House Office of the Whistleblower Ombuds, https://whistleblower.house.gov/about ; Senate Whistleblower Protection Caucus, https://www.wyden.senate.gov/news/press-releases/bipartisan-group-of-senators-launches-whistleblower-protection-caucus (both confirmed by 1.V).

Practitioner:

  • Study §6.4 (civil-society table: POGO, Empower Oversight, Government Accountability Project), study L425–458.
  • Whistleblower Aid [B].

Cross-references

  • secure-source-communication: every intake channel (step 1 of §5).
  • public-corruption-ombudsman: retaliation patterns against tracked actors; it cites this skill.
  • first-amendment-legal-expert: public-employee speech beyond Garcetti.
  • media-verification-specialist, source-credibility-scoring: leaked material (study §11 guardrail 7).
  • osint-orchestrator: source tiers and chain of custody for corroboration.
  • claims-integrity-audit, malice-evaluator, quote-integrity-audit: pre-publication gates.
  • legal-research-specialist: reading the current statute text and case law.
  • (planned: government-oversight-mechanisms, this phase) for IG and GAO process.

Safety

  • Not legal advice. Nothing here tells a person what to do. Every source is routed to qualified counsel, and we say so in writing (Appendix A).
  • Never promise legal protection. We never tell a source that a disclosure is protected, legal or safe, and we never promise anonymity we cannot guarantee against a subpoena.
  • Deadlines are short. Some run from the retaliation, some from discovery. Say: “check the current deadline with counsel now”. Never state a deadline in copy without its statute citation.
  • No impersonation of government authority. We are not an IG, OSC or a committee. We never describe our intake as a “hotline”, “complaint” or “filing”, and never imply a tip to us satisfies any statutory channel.
  • Allegation vs. finding vs. charge. A whistleblower’s account is an allegation. An OSC, MSPB, IG or court determination is a finding. An indictment is a charge. Copy says which, every time.
  • Partisan symmetry. Congressional referrals name both parties’ offices; we cover retaliation claims against officials of either party by the same standard.
  • Journalist / advocate separation. Referral is logged separately from reporting and disclosed in the story if the source appears in it (study §11 guardrail 6).
  • Classified material. We do not solicit it; if offered, intake stops and counsel is the next step.
  • Chain of custody. Hash any document on receipt and never alter it (study §11 guardrail 8).

Appendix A: role statement (read to every self-identified whistleblower)

We are journalists at Citizen Analyst. We are not lawyers and cannot give you legal advice or tell you whether the law protects you. Whistleblower deadlines can be short. Before you send us anything, please talk to a lawyer. Here are organisations that help whistleblowers find counsel; we do not endorse any of them, and talking to them does not depend on talking to us.

Appendix B: intake record schema


intake_id: wb-YYYYMMDD-NN        # no names, no employer in the id
received: YYYY-MM-DD
channel: <per secure-source-communication; no handles here>
role_statement_given: true
sector: federal-civil | ic | military | contractor | public-company | private | state-local
possible_statutes: [<row names from §2>]
risk_flags:
  classified: false
  nda_signed: unknown
  trade_secrets: unknown
  deadline_possibly_running: unknown
referral_given: [<org names>]
referral_disclosed_in_story: n/a
verification_notes: <sources only>
status: screening | referred | verifying | published | held
editor: <initials>
Was this article helpful?
0 out of 5 stars
5 Stars 0%
4 Stars 0%
3 Stars 0%
2 Stars 0%
1 Stars 0%
5
Please Share Your Feedback
How Can We Improve This Article?