Skip Navigation
Fact Sheet

National Security Whistleblowing: A Gap in the Law

Contrary to popular belief, existing legal protections for whistleblowers are limited and generally do not extend to leaks of classified information. This fact sheet summarizes key laws affecting whistleblowers and their prosecution.

Published: August 21, 2013

Many people presume that “whis­tleblow­ing” is a legal defense for govern­ment employ­ees or contract­ors facing crim­inal charges for disclos­ing clas­si­fied inform­a­tion. In fact, exist­ing legal protec­tions for whis­tleblowers are limited and gener­ally do not extend to leaks of clas­si­fied inform­a­tion. Below is a brief summary of some key laws affect­ing whis­tleblowers.

[Down­load the PDF]


Q:  What is the Whis­tleblower Protec­tion Act?

A:  The Whis­tleblower Protec­tion Act (WPA) provides that the govern­ment may not take adverse person­nel actions against agency employ­ees who engage in protec­ted disclos­ures to specified persons or entit­ies. The defin­i­tions of these terms follow:

  • Person­nel actions include meas­ures like firing, demot­ing, cutting pay, etc. They do not include crim­inal prosec­u­tions.
  • Protec­ted disclos­ures include the release of inform­a­tion that the employee reas­on­ably believes demon­strates illeg­al­ity, gross misman­age­ment, gross waste, abuse of author­ity, or a substan­tial and specific danger to public health or safety.
  • Specified persons or entit­ies differ depend­ing on the clas­si­fic­a­tion status of the inform­a­tion.
    • If the inform­a­tion is not clas­si­fied, the employee may disclose it to anyone.
    • If the inform­a­tion is clas­si­fied or its disclos­ure is other­wise prohib­ited by law, the employee may disclose it to certain offi­cials – includ­ing the Special Coun­sel (a govern­ment office estab­lished to protec­ted federal employ­ees from prohib­ited person­nel prac­tices) and the agency’s Inspector General.

The WPA does not apply to persons in posi­tions of a “confid­en­tial, policy-determ­in­ing, poli­cy­mak­ing, or policy-advoc­at­ing char­ac­ter.” Nor does it apply to anyone in the Federal Bureau of Invest­ig­a­tions, the Cent­ral Intel­li­gence Agency, the National Secur­ity Agency, or any other exec­ut­ive body that conducts primar­ily foreign intel­li­gence or counter-intel­li­gence activ­it­ies.


Q: What is the Intel­li­gence Community Whis­tleblower Protec­tion Act (ICWPA)?

A: Intel­li­gence Community (IC) employ­ees are not covered by the WPA. Instead, the Intel­li­gence Community Whis­tleblower Protec­tion Act (ICWPA) permits IC employ­ees to report an “urgent concern” (even if it involves clas­si­fied inform­a­tion) to the agency’s Inspector General and, ulti­mately, to the congres­sional intel­li­gence commit­tees. Remark­ably, though, the ICWPA does not provide employ­ees protec­tion against retali­ation if they make such disclos­ures.


Q: What is Pres­id­en­tial Policy Direct­ive 19?

A: Pres­id­ent Obama issued a direct­ive in 2012 (Pres­id­en­tial Policy Direct­ive 19, or PPD-19) requir­ing IC agen­cies* to provide employ­ees with protec­tion from retali­ation if they disclose clas­si­fied inform­a­tion that would meet the criteria for a “protec­ted disclos­ure” under the WPA to a super­visor, their agency head, the relev­ant Inspector General, or the Director of National Intel­li­gence. But the direct­ive leaves several gaps:

  • It does not apply in cases where the head of an agency determ­ines that an employee should be fired for national secur­ity reas­ons.
  • It does not apply to persons in posi­tions of a “confid­en­tial, policy-determ­in­ing, poli­cy­mak­ing, or policy-advoc­at­ing char­ac­ter,” or to members of the Armed Forces.
  • If disclos­ures through approved govern­ment chan­nels prove unsuc­cess­ful, there is no provi­sion for disclos­ure outside the agency or intel­li­gence commit­tees.

This last point is partic­u­larly import­ant. The direct­ive could facil­it­ate trans­par­ency in instances where one employee is aware of another employ­ee’s rogue miscon­duct, but is unlikely to have much effect in cases where the agency itself is compli­cit in the wrong­do­ing and the intel­li­gence commit­tees are not will­ing to inter­fere.


Q: When Can a Whis­tleblower Be Prosec­uted?

A: Contrary to popu­lar belief, the fact that a person’s disclos­ures might be protec­ted under the WPA, ICWPA, or PPD-19 does not consti­tute a defense against crim­inal prosec­u­tion. It merely shields the employee from being fired or other forms of adverse person­nel action.

Many of the more severe crim­inal penal­ties for disclos­ing national secur­ity inform­a­tion have histor­ic­ally required some level of intent to harm the United States, which is unlikely to be present in cases of whis­tleblow­ing. Unfor­tu­nately, recent judi­cial opin­ions have gener­ated consid­er­able uncer­tainty about this require­ment.

Most notably, the Espi­on­age Act, which was enacted to punish spies and trait­ors during World War I, prohib­its disclos­ures of national defense inform­a­tion in cases where the person making the disclos­ure has “reason to believe” it could injure the national defense or give advant­age to a foreign coun­try. As recently as 2006, a federal judge inter­preted this language to require the govern­ment to prove “bad faith” on the part of the defend­ant. The judges in the cases of John Kiriakou and Brad­ley Manning, however, disagreed, declar­ing that the defend­ant’s subject­ive intent is irrel­ev­ant. Another judge recently threw the case law into even deeper confu­sion: She held that the govern­ment does not even need to demon­strate that the disclos­ure would be “poten­tially damaging to the United States or useful to an enemy of the United States.”  These rulings further open the door to crim­inal prosec­u­tions against indi­vidu­als who meet the stat­utory defin­i­tion of whis­tleblowers.


* The FBI has its own regu­lat­ory whis­tleblower system and thus is excluded from PPD-19’s cover­age. The FBI’s system suffers from a number of flaws, as discussed here: http://www.whis­tleblowers.org/stor­age/whis­tleblowers/docs/Blog­Docs/2013–02–04-memo-changesto­part27.pdf.