|
||
|
4 August 2012. "Responsible disclosure" is corrupt. 3 August 2012 Whistleblowing in a Wikileaks World
Date: Fri, 3 Aug 2012 14:05:12 +0200
Gregory M Bernard Full text thru: http://calhoun.nps.edu/public/handle/10945/6769 EXECUTIVE SUMMARY Introduction A dramatic change in the information-sharing environment has occurred over the last decade. New technologies, the rapid evolution of the Internet, and innovations in social media have provided the ability to gather and share information at an unprecedented level. The Executive Branch of the U.S. Government touts the virtues of transparency, while Congress defines whistleblowing and the disclosure of government fraud/waste/abuse as a “civic duty”, and yet the Freedom of Information Act (FOIA) process is broken, the Whistleblower Protection Act (WPA) is woefully inadequate, and secrecy continues to run rampant. The disclosure of hundreds of thousands of potentially classified documents to the organization Wikileaks may be an example of what this contradiction has caused. The existence of Wikileaks as an organization is irrelevant now, and their most significant contribution is not the release of 1.2 million documents. Rather, the most significant impact of Wikileaks is their successful demonstration and validation of the ‘Wikileaks model.’ Wikileaks has demonstrated the power of the Internet using web technologies to provide protections through anonymity, while giving individuals access to a worldwide audience. The current troubles faced by the organization may or may not portend the end of Wikileaks; however, it does provide a glimpse into the future of whistleblowing. Building upon the apparent success of the Wikileaks model, the Wall Street Journal and Al-Jazeera have both implemented “anonymous” whistleblower submission sites. This new paradigm for communications, as enabled by the innovative uses of the Internet and social media, provides both opportunities and areas for concern regarding government transparency. Problem Statement Whistleblowing serves as a critical check and balance system to government bureaucracy, helping to circumvent administrative roadblocks and to provide a mechanism through which homeland security can monitor and increase efficiency in its operations. Homeland security also deals with information that can be of a sensitive or secret nature, the unauthorized disclosure of which can cause damage to both homeland security efforts and national security. Maintaining the balance between secrecy and transparency is a difficult proposition; however, current government efforts, particularly its handling of whistleblowers, places that balance in jeopardy. The government has taken some steps to address some of these problems; however, the government has also taken extreme measures to prosecute any whistleblowers who stray outside the appropriate submission process (i.e., deemed an unauthorized leak of sensitive/classified information) or are not protected by the WPA. Instead of acknowledging that current policy on whistleblowers is broken, the government’s current course of action decreases the likelihood important fraud/waste/abuse information will be received from whistleblowers, while possibly influencing their decision and encouraging them to bypass authorized channels and instead utilize the Internet to protect themselves from identification and retaliation. The current lack of public trust in government, and the existence of alternative avenues for disclosure that provide greater protections than those currently offered by the U.S. Government, serve to exacerbate the problem. Research Question What policy model and associated technological process could the U.S. DHS implement that will encourage whistleblowers to submit information through authorized channels as opposed to leaking information to unauthorized parties? Analysis To answer the research question, this thesis explores three primary areas. The first is the whistleblowing environment, to include definitions, applicable policies, laws (both domestic and international), authorized and unauthorized processes, motivations, public trust, requirements, and intentions of all parties involved. The second area of focus is technology, specifically, the available options, best practices, and vulnerabilities of potential technological solutions (e.g., phone, email, web). The final portion of thesis serves to develop and evaluate policy options based on the findings and conclusions identified in the first two areas of analysis. Those findings are as follows: • Overclassification is a problem Current legitimate/authorized processes, such as submission through standard government channels, present significant risks to the whistleblower. Clandestine/unauthorized processes, such as the Internet (Wikileaks) and mainstream media, represent a clear breach of the law, which is in conflict with the “do the right thing” mindset of many whistleblowers. If whistleblowers had a way to communicate identified issues through an authorized third party that would serve as a proxy on their behalf, it would undermine the current processes (both legitimate and clandestine), potentially making them obsolete. It would reduce the personal risk faced by whistleblowers by providing the anonymity that makes the clandestine approach attractive, without clearly breaking the law. The Department of Homeland Security has an opportunity to build upon and improve the “Wikileaks Model,” to harness its use of technology and process to create a solution that would meet the needs of both whistleblowers and the government. If implemented correctly, the number of legitimate whistleblower complaints would increase (overall submissions would increase), and the number of whistleblowers who choose unauthorized avenues would be expected to decrease. Recommendation For any solution to be considered successful, it is critical to establish a clear definition of success. This thesis proposes the following definition of success for any whistleblowing solution. To promote the voluntary disclosure of information by any man or woman who reasonably believes that organizational wrongdoing has occurred, the facilitation of corrective action to address the wrongdoing, and providing for the protection of the submitter while maintaining information security, all within the bounds of U.S. law. Four key pillars create the foundation for success. • Whistleblowers must have the support of leadership The conclusions drawn in this thesis, including the policy model ultimately recommended, is based on the research and the findings identified above. Combined with a current understanding of the problem, the evaluation criteria, and the potential solutions available, it is recommended that the government establish a partnership with a non-government organization (NGO) within U.S. legal jurisdiction, and subsidize the establishment of a government sponsored whistleblower submission website and virtual private network. This solution would allow whistleblowers to submit information to the government with the protection of anonymity, through the third party NGO. Establishing this policy provides whistleblowers who truly believe in improving government operations through the submission of information on fraud/waste/abuse or other types of concerns, a legitimate way to achieve their goal without risking their career and future on the weak whistleblower protections currently in place. While it may not completely eliminate leaks to the media or organizations, such as Wikileaks, the researcher believes those leaks will decrease as more whistleblowers give the government an opportunity to act on their submission.
|