Blowing the whistle without blowing your career

Technology professionals are among today's most infamous whistleblowers. The list of those who have made headlines for exposing corporate or government skulduggery includes Shawn Carpenter, a network security analyst who blew the lid off a Chinese cyberespionage ring; Bradley (now Chelsea) Manning, who shared more than 250,000 classified State Department cables with WikiLeaks; and Edward Snowden, who leaked top-secret information about NSA surveillance activities.

But for every high-profile case, there are plenty of tales of IT professionals who have accused their employers of wrongdoing without making national headlines or feeling the need to seek asylum in foreign countries.

Take Nell Walton, for example. A former database administrator at Nova Information Systems (now Elavon), Walton filed a whistleblower complaint with the Occupational Safety and Health Administration in 2005 against the credit card processor for security violations on databases that contained billions of transaction records.

According to Walton, she repeatedly asked the company to bolster its database security -- a request that she claims prompted retaliation from Nova's "chain of command." Walton's complaint was dismissed by OSHA. She appealed the decision with the U.S. Department of Labor but eventually lost her case against Nova in a federal court. (Elavon didn't respond to an interview request.)

The case, which lasted nearly three years, cost Walton her job, physical health and nearly $50,000 in legal fees. "It totally pretty much wrecked my life for three years," she says. "Even after the case was over and we lost, it was just awful."

Such is the difficult and often stressful path for IT professionals who dare to expose what they perceive to be misconduct or negligence on the part of their employers. "It's like that saying from my childhood: Nobody likes a squealer," says James Lewis, director and senior fellow of the Strategic Technologies Program at the Center for Strategic and International Studies, a Washington-based think tank. "You can be noble and a whistleblower, but don't expect it to be an easy life."

Yet the potential for techies to become high-profile whistleblowers is growing, whether they like it or not. For starters, today's data deluge -- bits and bytes of information being generated by everything from assembly-line sensors to point-of-sale devices -- is fueling a demand for unprecedented data transparency. Suddenly, the public is requesting greater openness from IT departments regarding what data is being collected, how it's being used, how it's being secured and who's accessing it.

At the same time, the stakes have never been higher for organizations to keep their systems secure. According to Ponemon Institute's "2014 Cost of Data Breach Study: Global Analysis," a report sponsored by IBM, the average cost of a data breach to a company was $3.5 million, up 15% from the average reported by companies participating in last year's study. The 314 companies from 10 countries that took part in this year's study estimate they will be dealing with an average of 17 malicious codes and 12 sustained probes each month. IT teams must keep confidential data safe from these mounting threats or face the wrath of angry shareholders, fine-wielding regulatory bodies and disgruntled customers.

All of that puts technology professionals between a rock and a hard place. On one hand, they're saddled with the awesome responsibility of ensuring data openness and seeing to it that data management practices meet the highest ethical standards. On the other hand, IT professionals who detect -- and then report -- shoddy security measures or misuse of data are sitting on "a potential powder keg," warns Larry Ponemon, founder of Ponemon Institute, a privacy and data protection think tank in Traverse City, Mich. It's no surprise that many IT leaders "take the attitude that [reporting malfeasance is] someone else's problem," he says, "or convince themselves that even though it's a data breach, it won't really be harmful to people."

Fortunately, a number of new developments are helping IT leaders more readily embrace their emerging role as corporate watchdogs. Greater legal protections, innovative whistleblowing platforms, new reporting processes, cultural shifts -- they all promise to help technology professionals prepare for a new era of high-tech whistleblowing, even under the threat of employer retaliation, lengthy legal battles and foreign exile.

Legal matters

For four years now, the Dodd-Frank Wall Street Reform and Consumer Protection Act has received mixed reviews on its ability to fulfill its mandate to reward and protect people who report governmental or corporate misconduct. The legislation works by granting whistleblowers monetary awards ranging from 10% to 30% of the money collected in an enforcement action. In fact, in the first seven weeks after the Dodd-Frank Act took effect in August 2011, the Securities and Exchange Commission received 334 tips from informers seeking rewards. Since then, the SEC has fielded more than 6,000 whistleblower reports.

In addition to offering financial rewards, the Dodd-Frank Act aims to protect whistleblowers from employer retaliation by allowing them to maintain anonymity.

However, as financial experts continue to debate the impact of Dodd-Frank, many organizations are taking matters into their own hands. "The Dodd-Frank rules around whistleblowing were a good wake-up call, but I'm seeing a lot of organizations stepping back and asking, 'How can we take this to the next level? What's the Version 2.0?'" says Mohammed Ahmed, a senior manager at Deloitte Financial Advisory Services and co-author of the Deloitte report "Whistleblowing and the New Race to Report."

How not to air dirty laundry

For many organizations, the answer is to establish an internal whistleblowing program, complete with a 24/7 hotline and financial rewards for employees who expose bad behavior and faulty systems. Whistleblower hotlines, for example, allow IT workers to anonymously report any misconduct they witness within their organization either by phone or via a Web portal. Although IT professionals are most likely to notice something like the mishandling of data, other causes for concern include fraud, corruption and illegal activity of any kind, of course, as well as safety violations and health hazards.

Walton says she wishes whistleblower hotlines were available back in 2005 when she decided to tell her employer about her concerns about data security. "I honestly think that a [whistleblowing] channel would have opened [the case] up to people that were more interested in protecting the data rather than protecting their own jobs," she says.

Even so, while more and more organizations are providing internal communication platforms and incentives for whistleblowing, the real motive behind many of these initiatives is to ensure corporate missteps are handled in-house and not brought to the attention of authorities.

The rationale behind many of these internal programs "is to motivate whistleblowers to report internally first before going to the SEC," says Ahmed. "Companies are grappling with the fact that reports can be made directly to the SEC. Most are uncomfortable with the notion that they don't know what's being reported about them and that the first time they find out is from a regulator."

Solutions hidden in plain sight

If today's internal whistleblowing tools fail to instill confidence in IT leaders, there's a growing crop of third-party sites and submission systems to choose from.

Tor (previously known as The Onion Router), for example, is an anonymizing program that routes traffic through a network of multiple nodes -- or virtual tunnels -- to anonymize the identities of its users.

According to the Tor website, the technology bounces communications around a distributed network of relays operated by volunteers around the world. Tor prevents websites from tracking users, be they CIOs or political dissidents, so those individuals can remain undetected if they want to, say, communicate sensitive information to journalists, connect with authorities or browse whistleblowing sites.

Another option is GlobaLeaks, an open-source whistleblowing framework that's designed to help IT professionals report wrongdoing without having to rely on in-house tools or technologies. "Whistleblowing is risky," says Marco Calamari, a member of the Hermes Center for Transparency and Digital Human Rights in Milan, Italy, which developed the innovative technology. "GlobaLeaks is a highly configurable software built on the foundation of Tor, which allows for anonymous browsing of the Internet." The upside of GlobaLeaks, which boasts 5,000 voluntary servers and 1 million users, is its ease of use, which allows even nontechnical people to set up their own anonymous whistleblowing sites.

One of today's more innovative submission systems is an online advertising network called AdLeaks. Unlike tools such as Tor, which rely on SSL connections over an anonymizing network to mask a user's identity, AdLeaks works by embedding AdLeaks ads onto a website.

These ads contain code that encrypts a whistleblower's messages, which are then delivered back to AdLeaks as small packets of encrypted information. By letting a whistleblower's browser substitute messages with encrypted parts of a disclosure, AdLeaks ensures the sender is completely unobservable and that eavesdroppers can't distinguish between a regular browser's transmissions and those of a whistleblower's browser.

But even AdLeaks isn't a foolproof solution. For one thing, because it leaks only a small piece of information each time, the process may take weeks to complete. And because AdLeaks is a research project, the system is still considered part of an experimental research product line. Professor Volker Roth of Freie Universitat (Free University) in Berlin, who is spearheading the project, says, "We cannot guarantee the security of any submissions, and we do not have the organization to handle whatever would be submitted to us."