The protection of sources

and whistleblowers
Submission to the United Nations Special Rapporteur on
the Right to Freedom of Opinion and Expression by
Association for Progressive Communications (APC)
29th June 2015
Table of Contents
1. Introduction...........................................................................................................................3
2. Protection of Sources and Whistleblowers and Law...........................................................4
2.1 Protection of Sources and Whistleblowers in International Law.....................................4
2.2 Protection of Sources and Whistleblowers in National Laws and Jurisprudence...........4
3. Technical Considerations and Limitations to Whistleblowing and Protection of Sources7
3.1 Electronic Surveillance and Protection of Sources............................................................7
3.2 Protection of Sources Beyond Traditional Journalism......................................................7
3.3 Leak Platforms.....................................................................................................................8
3.4 Issues Raised at APC Member in Bulgaria, Bluelink, Meeting on Protection of Sources 9
4. Recommendations..............................................................................................................10

2
1. Introduction
APC welcomes the opportunity to comment on the protection of sources and
whistleblowers for the October 2015 report of the Special Rapporteur on the Protection
of the Right to Freedom of Opinion and Expression to the UN General Assembly.
Whistleblowers1 reveal misconduct at great personal and professional risk. They are
routinely subject to harassment, job termination, arrest, and even physical attacks for
exposing wrongdoing. Whistleblowers need strong legal protections to protect them
from retaliation and enable them to report offences safely and freely.
But even in contexts where laws in place to protect whistleblowers are lacking, they are
rarely enforced or are completely ignored. The courageous actions of whistleblowers
defend human rights, save lives and billions of dollars in public funds, contribute to
making governments more transparent and companies more accountable. ICTs have
played a pivotal role in aiding whistleblowers and sources as well as in generally enabling
more transparency. They also pose challenges to the protection of whistleblowers and
sources.
APC is an international network and non-profit organisation that has endeavoured to use
information technology for justice for the last 25 years. We advocate for everyone to
have affordable access to a free and open internet to improve our lives and create a
more just world. APC believes that the ability to use the internet to make governments
more accountable and transparent at global and national levels should be promoted and
protected.
Our submission focuses on the global and national contexts for the protection of sources
and whistleblowers, with highlights on the technical considerations and limitations on
the practice of these rights. While presenting cases on violations by states on the practice
of whistleblowing, especially those within the context of national security, we also expose
how unsecure online communications can impact the protection of sources, and share
local perspectives from practicing jounalists and human rights defenders. We end with
providing specific recommendations.

1 For the purpose of this submission we use the definition of the term 'whistleblower' used by the
Special Rapporteur in his call for comments: “...any person who reports or discloses information of
a threat or harm to the public interest in the context of their work-based relationship.”

3
2. Protection of Sources and Whistleblowers and Law
2.1 Protection of Sources and Whistleblowers in International Law
A growing number of international instruments recognise the importance of
whistleblowers and require or encourage states to adopt measures to protect disclosure.
Whistleblowing is an integral part of freedom of expression, protected under Article 19 of
the ICCPR as well as other standards such as UN Convention against Corruption. 2
The UN Human Rights Committee noted in its General Comment no. 34 that:
“States parties should recognize and respect that element of the right of
freedom of expression that embraces the limited journalistic privilege not to
disclose information sources.”

Furthermore, the Joint Declaration on Defamation of Religions, and Anti-Terrorism and

Anti-Extremism Legislation (2008) of the four special mandates stated that:
“Normal rules on the protection of confidentiality of journalists’ sources of
information –including that this should be overridden only by court order on
the basis that access to the source is necessary to protect an overriding public
interest or private right that cannot be protected by other means -should
apply in the context of anti-terrorist actions as at other times.”

The UN Convention against Corruption binds all of its signatory countries to consider
legal provisions to protect people who report corruption-related offences from
retaliation. In Article 33 (Protection of reporting persons), it provides for whistleblower
protection:
“Each State Party shall consider incorporating into its domestic legal system
appropriate measures to provide protection against any unjustified treatment
for any person who reports in good faith and on reasonable grounds to the
competent authorities any facts concerning offences established in
accordance with this Convention.”

The implementation of Article 33 in domestic legal systems is crucial for the protection of
whistleblowers and for their contributions to be taken seriously.

2.2 Protection of Sources and Whistleblowers in National Laws and

Jurisprudence
Nearly a third of UN member states already have some laws covering whistleblower
activity3. Most European countries expressly protect the confidentiality of journalistic
sources.
Nonetheless, some frameworks, such as those in the United States and United Kingdom,
have proved seriously inadequate when the information disclosed concerns the activities
of the state itself, especially when national security is invoked. There has been an
increasing trend in the United States of America to file charges of espionage against
government employees or contractors that have uncovered misconduct or any conduct
2 https://www.unodc.org/documents/treaties/UNCAC/Publications/Convention/08-50026_E.pdf
3 https://wikileaks.org/w/images/c/c0/Silencingsources.pdf

4
that violates human rights, with the Obama administration charging eight whistleblowers
under the Espionage Act.
In an Inter-American Convention for Human Rights (IACHR) hearing on Freedom of
Expression and Communications Surveillance by the United States 4, held on October 28,
2013, participating organizations indicated that regulations that would protect
informants from retaliation for the disclosure of information of public interest are not
truly available to personnel from the national security sector. The current regulations
take the form of a Presidential Policy Directive issued in October 2012 and do not apply
to contractors or members of the armed forces, do not have legal mechanisms to redress
retaliations, and create a discretionary administrative review mechanism whose
decisions would not be binding on the intelligence agencies.
They further stated that the laws of the United States for the criminal prosecution of
public servants who disclose or leak national security information and the protection of
whistleblowers do not meet international standards on freedom of expression and
information. They asserted that the offenses defined in the laws are vague and overly
broad, and do not require intent or harm. The offenses and the penalties also fail to take
proper account of the public interest of the information disclosed, and they fail to
provide protections to security sector whistleblowers. Finally, the penalties established
for the disclosure of classified information, particularly pursuant to the Espionage Act of
1917, were said to be disproportionately severe.
Middle East
Most Middle Eastern countries lack laws protecting whistleblowers. In the Gulf
Cooperation Council countries, the lack of whistleblower protection laws in general has
led some progressive thinking governmental departments to implement their own
programmes. The Omani State General Reserve Fund, a sovereign wealth fund, adopted
its own wide-ranging whistleblowing programme aimed at encouraging the reporting of
illegal practices.
Furthermore, the private sector in the Middle East, mostly multi-nationals with their
headquarters in Europe, have led their own initiatives to protect whistleblowers that
expose corruption and illegal activities in their own organisations. Very few local
corporations and companies implement such programs. 5
On the 24th of June, 2010, the National Network for the Right of Access to Information in
Lebanon submitted a draft law on whistleblower protection to the Lebanese parliament.
The draft law was approved by the Administration and Justice parliamentary committee
in March 2015. It is now waiting to be submitted to the general assembly to be voted on. 6
Jordan also has no laws to guarantee the protection of whistleblowers. Additionally, the
Anti-Corruption Commission Law of 2006, stipulates that claims of corruption, which are
proved false, may result in the punishment of the complainant. 7 On the 13th of April,
2014, Bahrain arrested a person who leaked papers proving that Jordan has sent
gendarme forces to Bahrain, a claim which both countries have repeatedly denied. 8
In 2010, 21 members of the Arab League signed an Arab Anti-Corruption Convention (all
4 http://www.oas.org/es/cidh/audiencias/hearings.aspx?lang=es&session=132
5 http://omanlawblog.curtis.com/2014/04/whistleblowing-policy-in-oman.html
6 http://transparency-lebanon.org/Ar/whatwedodetails/1/26/0
7 https://www.globalintegrity.org/global_year/2011
8 http://en.gerasanews.com/bahrain-arrests-responsible-of-leaked-information/

5
except Somalia). While the treaty contains some protections for sources and
whistleblowers, they are inadequate and limited to the scope of reprisals by non-state
actors. Furthermore, 15 of 22 Arab States have so far ratified or acceded to the United
Nations Convention against Corruption (UNCAC). Yet, none of these countries have
modified their national laws to be in line with the convention, except for Algeria, which
passed a new whistleblower protection act in 2014.9
The Americas
In the Americas, the constitutions of Brazil, Paraguay, Argentina, and Ecuador provide for
explicit source protection; protection is granted in legislation in El Salvador, Peru, Chile,
Brazil, Uruguay, Venezuela, and Panama. Within the Organization of American States
(OAS) the Inter-american Convention Against Corruption (1996) 10 states in its article 3
that States Parties should consider the implementation of:
“ 8. Systems for protecting public servants and private citizens who, in good
faith, report acts of corruption, including protection of their identities, in
accordance with their Constitutions and the basic principles of their domestic
legal systems.”

The OAS has developed a draft model law to facilitate the protection of whistleblowers
when reporting of acts of corruption11.
Differently from many parts of the world, the OAS approach represents an effort to
consider the protection of whistleblowers under the same agenda as human rights.
Through the mechanisms offered by the Inter-American System of Human Rights (ISHR),
for example, it can promote changes at the public policy level and build institutional
frameworks for protection of whistleblowers. It is also allows for more visibility for this
issue, encouraging its incorporation in national and international forums. This
demonstrates how the Inter-American Convention on Human Rights (IACHR) can be
complementary to national regulations on whistleblowers protection 12.

9 http://www.ad.gov.eg/Admin/EditorDocs/Int_Cooperation/
%D9%82%D8%B1%D8%A7%D8%B1%20%D8%A7%D9%84%D8%AA%D9%88%D9%82%D9%8A
%D8%B9%20%D8%B9%D9%84%D9%89%20%D8%A7%D8%AA%D9%81%D8%A7%D9%82%D9%8A
%D8%A9%20%D9%85%D9%83%D8%A7%D9%81%D8%AD
%D8%A9%20%D8%A7%D9%84%D9%81%D8%B3%D8%A7%D8%AF.pdf
10 https://www.oas.org/juridico/english/treaties/b-58.html
11 http://www.oas.org/juridico/english/draft_model_reporting.pdf
12 http://www.cdh.uchile.cl/media/publicaciones/pdf/99.pdf

6
3. Technical Considerations and Limitations to
Whistleblowing and Protection of Sources
3.1 Electronic Surveillance and Protection of Sources
With the proliferation of electronic surveillance over the previous decade, the safety of
anonymous sources and whistleblowers no longer depends only on ethical and legal
protections, but also on information security. Even if ethical and legal protections are in
place, mass surveillance risks rendering them meaningless. The Snowden revelations in
2013, themselves a proof of the importance of whistleblowing, have revealed the extent
of electronic surveillance and the prevalence of such practices across all electronic
communications platforms.
However, the majority of journalists and civil society organisations still exchange
confidential information over regular phone lines, text messages and unencrypted email.
This is a significant challenge especially within the context of state or corporate
surveillance, as the relevant actors can sidestep the legal protection of sources and
whistleblowers, and identify their identities by other means.
The UNESCO global study on freedom of expression, access, privacy and ethics online13
posed this challenge, asking:
“…whether the protection of the confidentiality of journalistic sources should
be similar to, or dramatically different, in the online digital media
environment, where it is possible to technically track networks of
communication. In this light, should there be greater or different kinds of
protections for journalists in protecting the confidentiality of their sources?”

3.2 Protection of Sources Beyond Traditional Journalism

Civil society and human rights defenders, like journalists, often depend on sources for
their work. However, the right to preserve the confidentiality of sources is usually
referred to, both in international and domestic law, as a right of journalists. NGO activists
and academic commentators, and other professions that rely on being middlemen to
carry information of public interest to the public deserve the same protections, to ensure
that sources are not deterred from conveying important information to them.
This is why some international bodies have opted to entirely avoid use of the term
‘journalist’. The Declaration of Principles on Freedom of Expression adopted by the Inter-
American Commission for Human Rights states:
“Every social communicator has the right to keep his/her source of
information, notes, personal and professional archives confidential.”

Other bodies have formulated wider definitions of the word journalist, such as the
Recommendation adopted by the Council of Europe’s Committee of Ministers, which
states:
“The term ‘journalist’ means any natural or legal person who is regularly or
professionally engaged in the collection and dissemination of information to
the public via any means of mass communication.”
13 http://www.unesco.org/new/en/internetstudy

7
The UNESCO internet study14 included proposals to expand the definition of 'journalist' to
include social media producers and human rights advocates in the context of source
protection coverage.
It also notes that:
“Updating regulation that protects the confidentiality of journalists’ sources to
include digital aspects, was underlined as being central to press freedom in
research specially commissioned from the World Association of Newspapers
and New Publishers (WAN-IFRA) as a contribution towards this study.”

3.3 Leak Platforms

The gaps in protection to whistleblowers, as well as the rise of ICTs and the ease of
electronic transmission has given rise to new online platforms that enable
whistleblowers to publish information anonymously. The global nature of the internet
has enabled this information to stay available online. One such platform is Wikileaks,
which is a journalistic organisation that provides a secure online “dropbox”, enabling
anonymous whistleblowers to deliver information without placing themselves at great
risk.
This has inspired internet activists to create similar platforms, such as Globaleaks and
Associated Whistleblowing Press. Whilst not journalistic institution themselves , and not
involved in publishing information, these platforms enable and support whistleblowing
and investigative journalism. Globaleaks, for example, is an open source platform that
enables institutions to install anonymous, and secure whistleblowing platforms. The
platform has been implemented by over 24 institutions at the time of the writing of this
report.15 One notable implementation is AfriLeaks16 designed specifically to support
investigative journalism in Africa.
These types of secure platforms have failed however, to prevent significant reprisals
against people who have leaked documents to them. Chelsea Manning, the 27-year-old
US Army private who provided WikiLeaks with classified military documents in 2009 and
2010, is currently serving a 35-year prison sentence. American hacktivist Jeremy
Hammond, 30 is serving a decade for his part in stealing private data from an intelligence
firm that was later published by WikiLeaks. And in January 2015, writer Barrett Brown, 33,
was dealt a 5.5 year sentence, in part for aiding Hammond after the hack occurred.
The platform itself and other related internet platforms was also subject to attacks. The
US government has succeeded in pressuring several online platforms, such as Google, to
surrender private data of people associated with Wikileaks. US companies have also
come under intense political pressure to remove any connection to, or support for,
WikiLeaks. After the 2010 US diplomatic cable leak, Amazon stopped hosting the website
on its servers, and a distributed denial of service attack forced a domain name service to
drop the Wikileaks domain, essentially removing a well known address for the website
from the internet’s address book.
In a more recent case of reprisals, email service provider Lavabit was forced to close
down in 2013 after it was asked by the US government to compromise its entire privacy
system for the sake of eavesdropping on a single customer, largely presumed to be

14 http://www.unesco.org/new/en/internetstudy
15 https://en.wikipedia.org/wiki/GlobaLeaks#Implementations
16 https://www.afrileaks.org/

8
Edward Snowden, a whistleblower that revealed mass surveillance and misconduct by
the US National Security Agency.

3.4 Issues Raised at APC Member in Bulgaria, Bluelink,

Meeting on Protection of Sources
APC Member Bluelink held a public meeting for journalists and civil society in Sofia,
Bulgaria on June 6th, 2015, to discuss whistleblowing and protection of sources. The
upcoming study by the Special Rapporteur on protection of sources was discussed, and
participants called for a expanded definition of whistleblowers and sources, as well as an
expanded definition of who is entitled to the right of protection of sources.
Furthermore, participants discussed the differences between disclosing information to
media through a mediator, such as a journalistic or civil society institution, and platforms
that disclose all information without mediation such as Wikileaks. Some noted that
unmediated platforms are sometimes, even if unintentionally, less invested in protecting
their sources, due to a lack of understanding of the risks the whistleblowers are facing.
Unmediated whistleblowing can also have privacy implications and release information
that might put certain people at risk. Another risk of unmediated whistleblowing is that
these platforms can be vulnerable to delibrate efforts to spread misinformation.
Verification of information can also be particularly challenging for these platforms.
Another issue that was discussed was the advantages the internet has to offer to
potential whistleblowers, as they have the power to decide where and when to disclose
information. Whistleblowers can choose to disclose information in countries other than
their own to take advantage of a stronger protection of sources. Participants also noted
that whistleblowing doesn't work in countries where there is no rule of law, citing
Bulgaria as an example – despite being a member of EU, it has been placed under
supervision because of that.

9
4. Recommendations
The APC Internet Rights Charter17 clearly states that:
• The internet must be protected from all attempts to silence critical voices and to
censor social and political content or debate.
• Organisations, communities and individuals should be free to use the internet to
organise and engage in protest.
• All information, including scientific and social research, that is produced with the
support of public funds should be freely available to all.
As the world’s longest-running online progressive network founded in 1990, APC has
been troubled by trends over the last decade that show that such rights are increasingly
violated and believes that the attempts to censor leak platforms provide additional
reasons for concern.
The vulnerability of whistleblowers is a serious protection gap in the implementation of
the right seek or impart information. APC supports the recommendations made by Frank
La Rue, the former UN Special Rapporteur on Freedom of Opinion and Expression and
Catalina Botero Marino, the Inter-American Commission on Human Rights (IACHR)
Special Rapporteur for Freedom of Expression, namely; "Any attempt to impose
subsequent liability on [Government “Whistleblowers”] who disseminate classified
information should be grounded in previously established laws enforced by impartial
and independent legal systems with full respect for due process guarantees, including
the right to appeal." 18
Furthermore, we make the following recommendations:
• Given the recent examples of serious retaliation against whistleblowers, we
believe that their international protection must be strengthened and that it is time
for the international community to consider concrete steps to bridge this
protection gap.
• States and international bodies regulating the protection of sources should allow
the practice of that right to be applied to a wider definition than traditional
journalists. Furthermore, they should ensure that protection of sources and
whistleblowers goes beyond corruption and extends to those who reveal human
rights violations.
• States should not attempt to silence critical voices and information pertaining to
the public interest particularly those hosted in jurisdictions outside its own.
• ٍStates and the internet community should explicitly reject any form of online
content control that limits freedom of expression and information, particularly
information that contributes to more transparent governance, empowers citizens
to hold their governments accountable, and reveals violations of human rights.
• States should respect the right to privacy online and not seek to circumvent the
protection of sources and whistleblower anonymity by monitoring electronic
communication or requesting private information from intermediaries.
17 http://www.apc.org/en/node/5677/
18 http://www.oas.org/en/iachr/expression/showarticle.asp?artID=829

10
• States should accede and ratify the UN Convention against Corruption, and seek to
implement Article 33 of said convention into their domestic legal systems.
• Online whistleblowing technologies such as leak platforms and other forms of
secure, anonymous online communications tools remove many of the
technological barriers to ensuring the safety and enables protection of sources
and whistleblowers. As such, states and international bodies have a duty to
protect such technologies and to promote them.
• Journalistic institutions, civil society, and other organisations dealing with
confidential sources need to institute capacity building programs to their staff
regarding secure online communications and establish secure protocols for
sourcing previlegded information.
• Civil society, citizen journalists, and other platforms that handle privileged
information revealing misconduct or abuses need to use the name code of
conduct established by journalistic institutions and pay attention to the privacy
implications of information that they release.

11