Whistleblower

An employee who reports illegal, unethical, or unsafe conduct by their employer to a government agency, law enforcement, or the public.

A whistleblower is someone who exposes wrongdoing within an organization — reporting illegal conduct, fraud, safety violations, or ethical breaches to authorities, regulators, or the public. Federal and state laws protect whistleblowers from retaliation in a wide range of contexts: financial fraud (Sarbanes-Oxley, Dodd-Frank), securities violations (SEC whistleblower program), environmental violations (EPA), workplace safety (OSHA), and government contractor fraud (False Claims Act), among others.

The SEC whistleblower program, established by Dodd-Frank in 2010, is one of the most financially significant whistleblower protections in U.S. law. Individuals who provide original information about securities law violations that leads to a successful enforcement action with sanctions over $1 million are entitled to 10–30% of the collected sanctions. This has resulted in substantial awards — some whistleblowers have received tens of millions of dollars. The program also prohibits retaliation against individuals who report to the SEC, and provides private right of action for retaliated-against employees.

Internal reporting — through an employer's ethics hotline, compliance department, or management chain — is also protected in most whistleblower frameworks, even though internal reporting does not trigger financial rewards under programs like the SEC's. However, internal reporting before going external may actually weaken some protections: under Dodd-Frank, the Supreme Court held in Digital Realty Trust v. Somers (2018) that only employees who report directly to the SEC are protected against retaliation under Dodd-Frank's strongest protections. Employees who report internally first and are then retaliated against may need to rely on Sarbanes-Oxley protections, which have shorter deadlines and different procedural requirements.

Before blowing the whistle, consulting an attorney who specializes in whistleblower law is strongly advisable. The specific statute you report under, the sequence of internal versus external reporting, documentation practices, and timing relative to any adverse employment actions all significantly affect the strength of both the underlying whistleblower report and any retaliation claim. The financial rewards available under some programs (SEC, IRS, False Claims Act) can be substantial, but only for original information submitted in compliance with each program's specific requirements — guidance that an attorney can provide before the report is made.

Key Whistleblower Protections by Law

  • Sarbanes-Oxley (SOX): protects employees of public companies and their contractors who report securities fraud, mail fraud, wire fraud, or violations of SEC rules.
  • Dodd-Frank: protects individuals who report securities violations directly to the SEC — stronger anti-retaliation protections and no administrative exhaustion requirement.
  • False Claims Act: protects employees who report fraud on the federal government and allows them to file qui tam lawsuits and collect 15–30% of government recoveries.
  • OSHA whistleblower statutes: OSHA administers over 20 federal whistleblower protection programs covering environmental, transportation, financial, consumer product safety, and other reporting.
  • False Claims Act state analogs: many states have their own False Claims Acts covering fraud against state governments — with similar qui tam rights.
  • IRS whistleblower program: reports of tax fraud over $2 million can result in 15–30% of collected proceeds for the informant.

Before You Report: Practical Considerations

  • Consult a whistleblower attorney first — the specific statute, submission requirements, and sequence of reporting all affect your protections and potential awards.
  • Document the misconduct carefully before reporting: contemporaneous records, preserved communications, and specific instances with dates and dollar amounts.
  • Understand whether internal reporting is required or voluntary — some programs reward original information reported directly to regulators, not recycled internal complaints.
  • Know the deadlines: SOX complaints must be filed with OSHA within 180 days of the retaliatory action; Dodd-Frank claims have a 3-year statute of limitations.
  • Protect yourself: do not take proprietary documents outside the company — most whistleblower statutes protect what you observe or learn in the ordinary course of work.
  • Expect retaliation: document your employment status and performance before reporting so any post-report adverse action is measurable against a baseline.

Example

A compliance officer at a financial firm discovers evidence that the company is systematically overcharging clients in violation of SEC rules. He consults a whistleblower attorney, organizes his documentation, and submits a tip to the SEC through their online portal. After an 18-month investigation, the SEC fines the company $25 million. He receives a $3.2 million whistleblower award — 13% of the collected sanctions.