The case of former senior National Security Agency (NSA) official Thomas Drake requires an examination of current whistleblower laws in the context of changes to information sharing, such as Wikileaks and other online outlets. Drake became concerned with the agency's decision to choose a data collection program costing billions of dollars over a less costly and less intrusive alternative. He believed that the program flouted privacy protections afforded to US citizens by the Fourth Amendment. Drake reportedly raised these concerns with his superiors before contacting the NSA Inspector General. When he did not receive a satisfactory response there, he contacted the Department of Defense Inspector General. Still dissatisfied, he escalated the matter to both the House and Senate Committees on Intelligence. When Drake still believed he had not received a satisfactory response, he contacted a reporter at the Baltimore Sun. The newspaper later published a series of articles detailing waste and mismanagement in the NSA.

Drake was indicted with the offence of "willful retention of classified information" under the Espionage Act of 1917. Drake maintained in his defence that despite discussing the situation with the reporter, he had been careful not to breach national security. In a spectacular back down, federal prosecutors withdrew the charges as part of a deal which resulted in Drake pleading guilty to the misdemeanour offence of "exceeding authorized use of a computer." The episode is particularly significant. Drake did not initially choose to leak swathes of unredacted documents to an outlet on the Internet. Instead, he followed the Intelligence Community Whistleblower Protection Act of 1998 by exhausting the official mechanisms available to him.

In 2004, the 9/11 Commission Panel Report stated that "(d)emocracy's best oversight mechanism is public interest disclosure." In 2008, then presidential candidate Barack Obama proclaimed, "(g)overnment whistleblowers are part of a healthy democracy and must be protected from reprisal." The Drake prosecution, along with four other prosecutions for unauthorized disclosures, may present a significant departure from this ethos and may be part of what some consider as a "backlash" occurring against whistleblowers. For example, in December 2010, the Whistleblower Protection Enhancement Act, which contained measures to strengthen protection afforded to national security employees, failed to pass following a senator's anonymous hold. Following the leaking of thousands of documents to Wikileaks, the US Army introduced a new regulation entitled the "Threat Awareness and Reporting Program," which requires service personnel to report possible indications of subversion or leaks to the media. Lastly, the Intelligence Authorization Act for Fiscal Year 2011 would have allowed the head of the respective intelligence agency to determine that a present or former employee had failed to obtain authorization for making a disclosure and should therefore lose their current or future pension benefits. The provision was blocked following a public hold by Senator Ron Wyden.

The recent developments, together with the Drake episode, are likely to have three possible outcomes for the would-be whistleblower considering whether and how to raise their concerns. First, they may decide that following Drake's experience, they should use the official channels available and be deterred from making an unauthorized disclosure. Second, conversely, the employee may decide that they do not trust the official mechanisms and that they cannot risk making direct contact with a journalist, and so anonymous disclosure to an online outlet such as Wikileaks is the best option. Such a course of action could be detrimental to the organization concerned and harmful to national security. Third, they may decide not to raise their concerns at all. Such an option would be detrimental to the organization, to congressional oversight, and to the wider public interest.

The Council of Europe has determined that authorized concern reporting "fuels less mistrust" within an organization than anonymous disclosures and makes it easier for the whistleblower to be protected against possible retaliation or victimization. However, when whistleblowing through official channels has failed or necessity demands it, one must consider whether it would be more appropriate to introduce a form of "safety valve" to allow for wider disclosures to the public or media. In a report outlining the best practice for intelligence services, the UN Special Rapporteur on the promotion and protection of human rights and fundamental freedoms while countering terrorism identified whistleblower protections that should extend to disclosures to the media or the public if they are made "as a last resort" and "pertain to matters of significant public concern." These guidelines have been followed in Canada, where the Security of Information Act of 2001 aims to balance the public interest in disclosure against the public interest of non-disclosure, creating a positive obligation to utilize the official channels whilst allowing for external disclosure when the employee has not received a response in a reasonable time. However, these conditions do not apply if the disclosure was necessary to avoid grievous bodily harm or death.

The circumstances surrounding the Drake case offer a timely opportunity for US officials to carefully review how the situation was handled and assess the effectiveness of the response. The pace of technological advancements has made it easier and faster to publish unauthorized material. When leaks do occur, emphasis is often placed on punishment of the leaker and future prevention without a clear focus on why the leak occurred in the first place. Reliance upon outdated legislation such as the Espionage Act or the UK's Official Secrets Act of 1989 can only go so far to deter future unauthorized disclosures. Public servants will continue to be the ultimate arbiters of whether to use an authorized mechanism or to leak material. The provision of robust official mechanisms and a culture whereby raising concerns is actively encouraged through those channels may go part of the way in securing the objective of preventing future leaks, and do so by markedly less draconian means.

Ashley Savage is a Lecturer in Law at Northumbria University Law School in Newcastle, UK. Prior to that, he was employed at Public Concern at Work, the UK's leading independent authority on whistleblowing. His research interests include the protection of journalistic sources, the mechanisms used to hold executive departments accountable and UK parliamentary oversight of the Security and Intelligence Services.

Suggested citation: Ashley Savage, Wikileaks and Whistleblowers: The Need for a New Legal Focus, JURIST—Forum, June 28, 2011, http://jurist.org/forum/2011/06/ashley-savage-whistleblowing.php.