Whistleblower protection

Why does wrongdoing stay hidden until the law shields the person who reports it?

Read almost any inquiry into a long-running fraud or a fatal safety failure and the same sentence appears: a great many people knew. Not one or two — departments, auditors, supervisors, sometimes hundreds. The wrongdoing was not a secret in the ordinary sense. It was simply unsaid.

That should be puzzling. If dozens know, the chance that nobody speaks ought to be small, since it takes only one. So the question is not why some particular person kept quiet, but why silence survives being widely shared — and why a law that changes no one's knowledge changes what gets said.

Put the sums on one person. Suppose a disclosure would prevent harm worth 100, spread across a thousand people who each get 0.1 — illustrative figures, chosen to expose the structure rather than describe any case. The reporter is one of that thousand, so his share of the benefit is 0.1. Against it set his private cost: dismissal, an unusable reference, legal fees, a specialism he can no longer work in. Call it 10, which is conservative for someone twenty years into a trade. His share of the good he does is a hundredth of what it costs him.

Notice what that arithmetic will and will not respond to. Raising the public benefit from 100 to 1,000 raises his share to 1 — still an order of magnitude short. No size of harm makes speaking privately worthwhile, which is why the strength of the moral case is not the operative variable. Only two things move the sum: lowering the private cost, or transferring some of the benefit to the reporter. Every serious legal regime does one or the other.

So what stands between him and a report? Not knowledge, and mostly not courage. Retaliation — and specifically that retaliation is cheap and nearly unprovable. The employer controls the assignment, the appraisal, the restructuring and the reference, each exercisable through channels that look entirely legitimate. A rule saying "thou shalt not retaliate" is therefore close to unenforceable on its own terms: the act is real and the evidence sits with the person who did it.

Which is why the working part of a protection statute is not the prohibition but the evidence rule. Under the American federal scheme, and the model Sarbanes-Oxley carried into corporate law, the employee need show only that the protected disclosure was a contributing factor in the adverse action; the burden then shifts, and the employer must show by clear and convincing evidence it would have acted the same way regardless. The 2019 European directive makes the same reversal. The law does not make retaliation impossible. It makes the ambiguity around it cost the employer instead of the employee.

Let me name a figure in order to set it aside. It is often repeated that tips are the largest single source by which occupational fraud is discovered — I recall the claim from fraud-examiner survey work, but I am recalling it, not verifying it, and it cannot bear the weight usually put on it. That statistic is drawn from frauds that were detected, which is precisely the population speaking created. It says nothing about how much stays hidden, so it cannot measure whether protection works. The argument does not need it.

What would refute the load-bearing claim — that disclosure is governed by the reporter's private cost rather than his disposition? The account predicts reporting volume moves with the regime and not with exhortation: more under anonymous channels than named ones, more where part of the recovery is transferred to the reporter, and mostly internal first, with external reporting following retaliation rather than preceding it. If disclosure rates were flat across regimes differing sharply in anonymity and remedy, the cost mechanism would be wrong and something about character would have to take its place.

Two other folk accounts fail for their own reasons. People are loyal, or cowardly fails on that same evidence: the same people report readily when the channel is anonymous, so the trait cannot be what varies. Protection works by punishing retaliators fails because the sanction is rarely reached — most cases settle or fail on proof — while the evidentiary shift bites from the first day.

Two mechanisms are easy to merge and worth keeping apart. The first is a cost problem: one person pays, everybody gains. The second is a coordination problem on top of it: a lone reporter is discreditable in a way two are not, so each insider's willingness depends on his belief about the others, and a group can hold a stable silence not one member endorses. Protection helps with both — it lowers the private cost, and by making the first report survivable it lowers the number who must move together.

Be honest about the evidence. Whether these statutes actually increase disclosure is not settled; retaliation persists under every regime that has one, and many protected whistleblowers still lose their careers. What is clearer is that regimes transferring money to the reporter — a statutory share of what is recovered — produce a visible rise in tips, which the arithmetic predicts and a pure anti-retaliation rule does not obviously deliver.

A neighbouring piece makes an almost opposite case, and the pairing is clarifying. Anonymous giving argues for removing the audience so the giver loses the reputational reward and learns what was really motivating him. Whistleblower anonymity removes the audience so the reporter escapes a punishment. The fixed point of difference is which way identifiability cuts: in giving, being seen is the payoff, so hiding purifies the act; in reporting, being seen is the cost, so hiding makes the act possible at all. Both land on the same point from opposite sides — what governs behaviour is not the motive but whether the actor can be identified. A second neighbour, Bystander effect, explains inaction through ambiguity and audience; here the facts are usually unambiguous and there is often no audience at all, and what remains is livelihood, which is why adding observers does not help.