Cybersecurity Vulnerabilities Whistleblower Attorney

Learn What You Need to Know About Reporting Cyber Threats to the Federal Government

Cybersecurity vulnerabilities can present substantial risks to consumers, employees, investors, taxpayers, and the public at large. They can also present risks to sensitive government and consumer data maintained by various federal agencies. Despite the numerous federal cybersecurity laws that establish stringent requirements for federal contractors, grantees, and program participants, cybersecurity failures remain a constant and pervasive risk.

Are you eligible to serve as a cybersecurity vulnerabilities whistleblower?

Given the multitude of risks that cyber incidents can present, uncovering these risks is a top priority for the federal government. But, the federal government necessarily relies on whistleblowers to come forward. From employees of defense contractors and publicly traded companies to employees of the federal government, various individuals can come forward as whistleblowers. All cybersecurity whistleblowers are entitled to legal protections, and those in the private sector may also be eligible for monetary awards.

Examples of Reportable Cybersecurity Vulnerabilities

Whistleblowers can report all types of cybersecurity vulnerabilities to the federal government. They can also report cybersecurity incidents of which the government is not yet aware. Some of the most common grounds for cyber whistleblowing include:

Data Breaches

If your employer or another company has experienced a data security breach, you may be eligible to serve as a federal whistleblower. Whistleblowers can report data breach response failures as well. Along with data breaches, other cybersecurity incidents such as theft, extortion, and other means of cyber fraud can warrant federal whistleblower complaints in many cases.

Cybersecurity Flaws

Federal contractors and various other entities are subject to strict cybersecurity obligations under federal law. For these entities, following federal laws that impose obligations designed to mitigate cybersecurity risks is essential. As a result, whistleblowers can report flaws in these companies’ cybersecurity programs in many cases as well. Even if a flaw has not yet resulted in a breach, if the flaw presents a substantial and specific danger, a whistleblower complaint may be warranted.

Cybersecurity Fraud

Federal government contractors are required to comply with the government’s cybersecurity risk management standards as a condition of doing business with the government. When government contractors fail to meet these standards and still bill the government, they can—and should—be held liable for cybersecurity fraud. Typically, reporting contractors for violating the terms of their government contracts involves filing a whistleblower complaint under the False Claims Act.

Reporting Violations

Government contractors and various other companies are required to report cybersecurity incidents to the federal government. When companies fail to report cyber incidents, this can also provide clear grounds for whistleblowers to come forward. Whether coming forward involves filing a whistleblower complaint in federal court or contacting one of the government agencies listed below will depend on the specific circumstances involved.

Reporting Options for Employees of Federal Contractors and Other Companies

For employees (and former employees and other individuals) in the private sector, reporting material cybersecurity incidents and other cybersecurity-related violations may involve coming forward through various means. While there are several possibilities, the most common means of serving as a cybersecurity whistleblower for the federal government include:

False Claims Act Whistleblower Complaint

The False Claims Act allows whistleblowers to file complaints in cases involving federal contractors, grantees, and program participants. Companies and institutions violate the False Claims Act when they bill the government in violation of the terms of their contracts, awards, or participation. This includes billing the government despite failing to comply with the government’s cybersecurity standards and cybersecurity breach response protocols.

CFTC Whistleblower Program

The U.S. Commodity Futures Trading Commission (CFTC) accepts whistleblower complaints involving violations of the Dodd-Frank Act (among other federal statutes). The Dodd-Frank Act is one of several federal statutes that establish stringent cybersecurity standards for public companies. These include, but are by no means limited to, standards that require these companies to adopt written policies designed to effectively manage cyber risk and ensure appropriate incident response.  

DOJ Whistleblower Program

The U.S. Department of Justice (DOJ) accepts whistleblower complaints involving all forms of corporate misconduct and fraud. This includes failure to adequately protect sensitive government information, failure to adequately protect customer information, and failure to adequately restrict access to critical i, among many other legal violations. While federal prosecutors at the DOJ handle whistleblower cases under the False Claims Act, cybersecurity whistleblowers can file complaints directly with the DOJ in some cases as well.

SEC Whistleblower Program

The U.S. Securities and Exchange Commission (SEC) accepts whistleblower complaints involving violations of the Sarbanes-Oxley Act (SOX) and various other federal securities laws. Similar to the Dodd-Frank Act, these laws also impose stringent cybersecurity requirements (either directly or indirectly), and the SEC works with whistleblowers to pursue enforcement actions as warranted.

Reporting Options for Federal Government Employees

Federal government employees can also serve as cybersecurity whistleblowers in many cases. Federal employees are protected under the Whistleblower Protection Act (WPA), and they can report violations involving fraud, waste, abuse, and threats to national security—among other concerns. For example federal employees can report fraud under defense contracts and other federal contracts, and they can also report bribery and other offenses related to contractors’, grantees’, and program participants’ cybersecurity compliance obligations.

Protections and Financial Incentives for Cybersecurity Whistleblowers

Recognizing the critical role that cybersecurity whistleblowers play in protecting critical infrastructure and helping the government resolve allegations through civil and criminal enforcement proceedings when warranted, Congress has enacted multiple laws that are designed specifically to protect those who come forward. The rights afforded to qualifying cybersecurity whistleblowers under federal law include:

• Strict Confidentiality – All cybersecurity whistleblowers are entitled to strict confidentiality under federal law. If you come forward through the appropriate channels, the federal government will have an obligation to protect your identity consistent with all applicable statutory requirements.
• Protection Against Whistleblower Retaliation – Federal law prohibits private-sector employers and federal agencies from retaliating against whistleblowers. If an employer violates this prohibition against whistleblower retaliation, it can be held liable for damages and other remedies.
• Whistleblower Compensation (Private Sector Only) – Whistleblowers in the private sector who come forward under the False Claims Act or by contacting certain federal agencies can receive monetary rewards if their complaints lead to successful enforcement actions. While specific reward terms vary, eligible whistleblowers are generally entitled to between 10% and 30% of the amount the government recovers.

If you would like more information about your rights as a cybersecurity whistleblower should you decide to come forward, we invite you to get in touch. An experienced federal whistleblower attorney at our firm will be more than happy to explain everything you need to know.

FAQs: Cybersecurity Whistleblowing in the Public and Private Sectors

Speak with an Experienced Federal Cybersecurity Whistleblower Attorney in Strict Confidence

If you would like more information about serving as a federal cybersecurity whistleblower, we strongly encourage you to contact us today. To schedule a confidential consultation with an experienced federal cybersecurity whistleblower attorney, Call 888-680-1745 or contact us confidentially online now.