What Can a Whistleblower Report? 5 Protected Disclosures

You’ve spent three nights replaying it. The spreadsheet, the safety report, the contract, the call. You know what you saw, and you’re not crazy. But it’s one thing to know something’s wrong, and it’s a whole other thing to say it out loud at work, where your paycheck and your reputation live.

The short version: yes. The rules differ sharply between federal employees and private-sector workers, the complaint process has strict deadlines, and several gaps can leave you unprotected.

Two Different Races: Federal Versus Private Sector

Think of whistleblower protection in the U.S. as split into two lanes.

Federal civil servants have one big umbrella. The Whistleblower Protection Act covers a broad swath of executive branch employees and gives them a clear set of rules. Private-sector workers don’t get that single umbrella. Instead, they get a tray of smaller umbrellas, each run by a different agency under the Department of Labor, protecting specific things like workplace safety, wages, and certain types of fraud.

Your path to legal protection depends entirely on which lane you’re in: federal employee, private-sector worker, contractor, or gig worker.

The Whistleblower Protection Act: The Big Umbrella for Federal Employees

The Civil Service Reform Act of 1978 established the Office of Special Counsel and the Merit Systems Protection Board to handle federal employment issues. Then, in 1989, the Whistleblower Protection Act came along as a major upgrade.

The important part is you need three things to be protected: a position that’s covered, a personnel action taken, and the action has to happen because you made a protected disclosure. It’s that link between your whisper and your penalty that the law cares about. The statutory definition of what counts as an “agency” for coverage is found in 5 U.S.C. § 2302(a)(2)(C), and positions above GS-15 are subject to special classification rules under 5 U.S.C. § 5108.

The 2012 Fix That Changed Everything

The Whistleblower Protection Enhancement Act of 2012 was the law’s modern tune-up. Before that, courts had been chipping away at protections. For example, one court said if you reported the wrongdoing to the wrongdoer themselves, that didn’t itself a “disclosure.” Another court said if other people knew about it already, you weren’t protected. The 2012 fix set aside both of those rulings.

Now, it doesn’t matter if your report was oral, if it was old news, if it happened while you were off the clock, or even before you were hired. You’re still covered. The 2012 law also forced agencies’ nondisclosure agreements to include a statement telling you about your rights.

Who’s Covered, and Who’s Not

If you’re a current federal employee, a former one, or even an applicant for an executive branch job, you’re likely covered. That includes most civil-service positions in the competitive service, the career Senior Executive Service, and excepted service roles. So, the standard federal employee in a cabinet department or smaller agency is highly likely covered.

But there are notable exceptions. The WPA explicitly excludes individuals employed by the FBI, CIA, DIA, NGA, NSA, ODNI, and NRO, as defined in 5 U.S.C. § 2302(a)(2)(C). The intelligence agencies have separate rules. It also doesn’t generally cover judicial or legislative branch staff, except for people at the Government Publishing Office, and the definition of “agency” in that same statute also limits coverage for certain other entities, such as government corporations as defined in 31 U.S.C. § 9101. And if you’re a government contractor, this umbrella doesn’t shelter you either.

What Can You Actually Report?

You’re protected in your “reasonable belief” that what you’re reporting shows one of these five things:

1. A violation of any law, rule, or regulation.
2. Gross mismanagement, meaning management action or inaction that causes a substantial risk of significantly messing up the agency’s mission.
3. A gross waste of funds. That means an expenditure clearly out of proportion to anything the government gets back.
4. Abuse of authority. That’s someone arbitrarily and capriciously using their power to hurt a person’s rights or for personal gain.
5. A specific and substantial danger to public health or safety.

Here’s where it gets relatable. You don’t need to be a hero with a folder of hard evidence. The standard is objectively. It’s not about what you personally think it is.

A reasonable person who knew what you know must see a real problem. You can report a potential violation if the wrongdoing is real and likely to happen soon. A policy disagreement is not protected.

The categories often overlap: a waste of money could also be an abuse of authority, and a safety hazard might stem from a rule violation.

Who Can You Tell?

You have broad latitude. You can file to your supervisor, another federal official, the inspector general, Members of Congress, and even the news media. The WPA is broad about who you can tell, unless the information is specifically forbidden by law or required by an executive order to be kept secret to protect national defense or foreign affairs.

First, those exceptions are interpreted narrowly. In a major Supreme Court case involving a TSA agent, the Court said “prohibited by law” doesn’t mean an agency rule or regulation. The actual law itself has to forbid the disclosure. So an agency can’t slap a rule on you and then punish you for breaking it to report a problem.

Second, reporting to the Office of Special Counsel or an Inspector General always protects you, even if the information is classified. And you can talk to Congress about non-classified information. If the info is classified, you can still bring it to Congress if it was classified by a non-intelligence agency head.

The law also guarantees your right to talk to Congress. The Lloyd-La Follette Act of 1912 had you. But there’s a tension between operational control and congressional oversight, and courts haven’t always settled it.

Your First Amendment speech rights can be limited when you’re speaking as part of your official duties.

How the System Works: OSC, MSPB, and the Path Forward

For federal employees, the path has two main stages: the Office of Special Counsel (OSC) investigates, and the Merit Systems Protection Board (MSPB) adjudicates if things don’t get resolved.

The OSC Route

You file your complaint with OSC. They must send you written acknowledgment within 15 days. Then they have 240 days, about 8 months, to make a determination. If they find a prohibited personnel practice, they refer the case forward to the MSPB and the agency involved. If they don’t find a violation or close your case, they must provide you a written status report explaining their findings.

The Individual Right of Action (IRA)

If OSC does not act within 120 days, you may bring your case to the MSPB on your own. This is your escape hatch. The filing deadline is 65 days from the day you receive the OSC’s notice that they won’t touch it.

The Direct Appeal

If you’re going to be removed, suspended for more than 14 days, reduced in grade or pay, or furloughed for more than 30 days, you have a third option. You can appeal that action directly to the MSPB and raise whistleblowing as your defense. For that option, you usually have to file within 30 calendar days of the action.

What Counts as Retaliation?

Retaliation is broader than just getting fired. It includes stripping you of a promotion, cutting your hours, denying you overtime, or any other significant change in your duties, responsibilities, or working conditions. They can’t do any of it because of your disclosure.

You don’t have to prove your report was the main reason they came after you. You have to show it was a “contributing factor,” and that’s a low bar. It means your disclosure played any role in the decision, even a small one.

The knowledge/timing test is key: if the retaliation happened right after you spoke up, and you can show they knew about your report, you’ve done the heavy lifting. You’ve shown enough for the agency’s plate to be clear.

Then the burden shifts to your employer. They have to prove by clear and convincing evidence that they would have taken the same action anyway, regardless of your report.

If they can’t, the board orders corrective action. The Federal Circuit has refined this standard in cases like Booker v. Merit Sys. Prot.

Bd. (1992), Singleton v. Merit Sys. Prot.

Bd. (2001), Ruggieri v. Merit Sys. Prot.

Bd. (2006), and King v. Dep’t of the Army (11th Cir. 2014), emphasizing that the agency’s burden is stiff but not impossible to meet.

If You Win: What Does “Made Whole” Look Like?

If you win, remedies are designed to put you back where you would have been: reinstatement, back pay, benefits, medical costs, travel expenses, and attorney’s fees.

The 2012 law also gave the MSPB power to order compensatory damages for emotional distress and similar harm. And the people in management who did the retaliating can be removed, reduced in grade, suspended, given a written reprimand, or banned from federal employment for up to 5 years.

There’s also a critical safety net called a “stay”: while your case unfolds, the Office of Special Counsel can ask the MSPB to put the retaliation action on hold for up to 45 days.

Getting DOL: What About Everyone Not Federal?

If you don’t work for the federal government, the Department of Labor runs your lane. The practical way to think about this is through the agency that handles your issue:

• Safety concerns at work? File with OSHA(Occupational Safety and Health Administration). They take these complaints, not just safety inspections.
• Pay problems? The Wage and Hour Division (WHD) handles minimum wage, overtime, family and medical leave, and things like lie detector test violations.
• Military-related issues? The Veterans’ Employment and Training Service (VETS) manages whistleblower complaints under USERRA.

For example, the Migrant and Seasonal Agricultural Worker Protection Act protects farmworkers who report violations. The False Claims Act is giant whistleblower law for fraud against the government, and it’s how whistleblowers can collect a reward: between 15% and 30% of what the government recovers. Dodd-Frank does the same for securities and commodities fraud, paying 10% to 30% of monetary sanctions. Since 2011, these programs collected a total of $43.4 billion and paid out approximately $6.7 billion to whistleblowers. That’s real money.

Contractors and the Federal Family Without a Big Umbrella

Federal contractors and grantees have their own form of shelter. Under 41 U.S.C. § 4712, you’re protected from reprisal for exposing wrongdoing related to the government’s work. If you’re a DoD or NASA contractor, 10 U.S.C. § 4701 gives you similar cover.

The intelligence community has its own whistleblower law, and the military has the Military Whistleblower Protection Act. A few congressional staffers have limited protection under the Congressional Accountability Act.

The Rough Edges and The Real World

The MSPB went five frustrating years without a quorum, from January 2017 to March 2022. That meant they couldn’t issue final decisions needed on appeals. The result: a backlog of over 2,500 cases waiting to be heard.

One federal court called the WPA a “procedural obstacle course.” It’s hard to win. If you look at historical data, more than 95% of MSPB cases involving whistleblower claims were decided against the person who came forward years ago, though the standards have changed since then. And not everything is covered.

For instance, revoking a security clearance isn’t considered a retributive action, and neither are internal investigations, unless things get extreme. Courts have also carved out specific limits on what counts as a covered disclosure, as seen in cases like Pessa v. Smithsonian Inst. (M.S.P.B. 1994) and Czarkowski v. Merit Sys.

Prot. Bd. (Fed. Cir. 2004).

But the U.S. framework is actually the model for the world: the OECD praised U.S. laws for making a real dent in corruption. Since 2011, the whistleblower programs here have collected more than $43 billion and paid out about $6.7 billion in rewards.

First Steps, In Case Any of This Is You

If you’re thinking about speaking up, here’s a starting point:

1. Document everything. Notes, emails, spreadsheets, safety reports, the date you told someone. Get it all in a safe place.
2. Figure out your agency.
3. Federal employee? Start with OSC.
4. Private sector, workplace safety? OSHA.
5. Wage and hour issue? WHD.
6. Fraud against the government? False Claims Act / qui tam.
7. Know the deadlines. OSC has 15 days to acknowledge your complaint and 240 days to decide. If they don’t act within 120 days, you can bring your case to the MSPB, but you only have 65 days to file.
8. Be realistic about anonymity. OSC keeps your identity confidential in most cases, but it’s not absolute. An accuser can sometimes guess based on context. Don’t promise yourself a secret identity.
9. Talk to a lawyer. If you’re thinking about a qui tam case or dealing with something complicated, spend the consultation fee. It’s worth it.

The Bottom Line

You’ve been replaying a moment you know was wrong.

Is it worth risking your career to speak up? Take a deep breath.

The law is not perfect. The system is slow, uneven, and has more holes than a screen door. But your right to be honest without wrecking your career is real. You need a reasonable belief, not a smoking gun.

The system exists, you have a path through it, and even when the path gets steep, the full weight of the government is behind you.

Take the first step. Document what you saw. Then, when you’re ready, speak up. You might be the reason the next person doesn’t have to replay it for nights.

Frequently Asked Questions