Twitter Whistleblower Claim Is Cautionary Tale for Employers

The widely reported recent whistleblower complaint by Twitter Inc.'s former chief of security Peiter Zatko highlights the importance of employers having policies and procedures in place to effectively address concerns repeatedly raised by cybersecurity professionals.

The whistleblower complaint and its continuing fallout, including Zatko's testimony before Congress, reveal how the triad of cybersecurity obligations to safeguard data, cyber incident reporting rules and whistleblower protections can result in litigation, regulatory activity and reputational harm when cyber professionals' repeated concerns are not addressed to their satisfaction.

The dueling press statements on behalf of Zatko and his employer offering up competing accounts should serve as the proverbial wake-up call for organizations employing cybersecurity professionals to quickly and effectively respond when repeated internal concerns over security practices are raised.

To avoid whistleblower litigation and regulatory scrutiny, while complying with their cybersecurity obligations, employers should develop written protocols that anticipate the inevitable raising of cybersecurity concerns by cyber professionals, including a process to escalate concerns to legal counsel or independent cyber professionals when necessary to mediate competing views.

Employers should clarify whether the employee is raising a whistleblower complaint alleging legal violations, or, rather, is acting within the scope of addressing normal concerns. Employers should also convey that concerns may be raised without the fear of retaliation.