How was the law protecting whistleblowers established?

The first whistleblower-protection law was not American, English, or European in any modern sense. It was American in a sense that predates the United States itself, passed by the Continental Congress in July 1778, eleven years before the Constitution came into force, and signed by John Laurens in York, Pennsylvania, the rebel capital while the British still held Philadelphia. Two and a half centuries later, every statute we still call a whistleblower law (Lincoln's False Claims Act, the Lloyd-La Follette Act, the UK's Public Interest Disclosure Act, Sarbanes-Oxley section 806, Dodd-Frank, the EU Directive) repeats and refines the same handful of ideas the founders settled in a single resolution: a duty to report, protection from reprisal, and the public picking up the legal bill when retaliation comes anyway.

The seven statutes that built the modern law of whistleblower protection (a sailor's petition, a Civil War contract scandal, an NHS staffing crisis, an EU directive) are easiest to read in the order they were passed. Each one repeats and tightens the same short answer to the same problem.

A petition from the brig, and a $1,418 legal bill

On 19 February 1777, ten sailors and marines aboard the Continental Navy frigate USS Warren put their signatures to a petition accusing their commander, Commodore Esek Hopkins, of misconduct. The most damning charge was the torture of British prisoners of war, which the sailors described in their own words as conducted "in a very unbecoming and barbarous manner." Two of the signatories, Richard Marven and Samuel Shaw, were arrested when Hopkins answered with a criminal libel suit. They wrote to the Continental Congress from jail, explaining that they had done nothing they did not consider their duty.

Congress responded with a statute. Passed unanimously on 30 July 1778, the resolution did three things in one paragraph: it imposed an affirmative duty to report wrongdoing, it sided publicly with the men in jail, and it agreed to defray their litigation costs. The wording reads as plainly as any modern compliance policy:

"It is the duty of all persons in the service of the United States, as well as all other inhabitants thereof, to give the earliest information to Congress or other proper authority of any misconduct, frauds or misdemeanors committed by any officers or persons in the service of these states, which may come to their knowledge."
Continental Congress, 30 July 1778

The next year, after Marven and Shaw won in court, Congress paid their legal bill, $1,418, out of the public purse. Hopkins was dismissed.

Three things in that paragraph still hold today, and every law in this article repeats them. Retaliation tends to come dressed as a different lawsuit (Hopkins did not defend himself by saying his sailors were lying, he sued them for criminal libel). A duty-to-report clause without an anti-reprisal clause is decoration. Who pays for the legal defence is part of the protection.

Lincoln's Law and the rogue who catches rogues

Eighty-five years later the United States, fighting a different war, ran into a different kind of fraud. The Union Army was being supplied with rotted boots, rifles that misfired, and horses already dead on arrival; contracts were issued faster than any inspector could read them. President Abraham Lincoln signed the False Claims Act on 2 March 1863, a statute now habitually called Lincoln's Law.

Its key innovation was qui tam, a Latin abbreviation meaning "he who brings a case for the king as well as for himself." A private citizen with evidence of fraud against the government could sue the contractor on the government's behalf and collect a share of whatever was recovered. The bill's sponsor, Senator Jacob M. Howard, defended the device on the floor of the Senate without pretending it was elegant:

"I have based the [qui tam provision] upon the old-fashioned idea of holding out a temptation, and 'setting a rogue to catch a rogue.'"
Senator Jacob M. Howard, 1863

The statute went largely dormant for most of the twentieth century and was significantly weakened in 1943. It came back to life in 1986, when amendments authored by Senator Chuck Grassley restored its teeth, raised whistleblower awards to as much as 30 percent of recoveries, and added an explicit anti-retaliation clause for the relator. Between 1987 and 2019 it returned over $62 billion to the federal treasury, and by 2024 more than four-fifths of False Claims Act cases were initiated by whistleblowers rather than by the government itself.

The False Claims Act is the model every later reward programme copies. Dodd-Frank, the IRS programme, the CFTC programme, and the new DOJ Corporate Whistleblower Awards Pilot are all recognisably Lincoln's Law adjusted for a different enforcement target.

Free speech for civil servants

Half a century after Lincoln, civil-service whistleblowing acquired its own statute. Both Theodore Roosevelt (in 1902) and William Taft (in 1909) had issued executive orders forbidding federal employees from speaking with Congress without prior authorisation, with dismissal as the prescribed punishment. The orders were read, accurately, as gag rules. The Post Office bureaucracy was the worst offender: postal employees were fired for having written to a Congressman, for joining a union, or for reporting unsanitary conditions in the building they worked in.

The Lloyd-La Follette Act of 24 August 1912 reversed all of that in a single appropriations rider. The accompanying House Report described the legislation, in a sentence that has aged well, as designed "to protect employees against oppression and in the right of free speech and the right to consult their representatives." Its right-to-petition clause survives today at 5 U.S.C. section 7211: the right of employees "to furnish information to either House of Congress, or to a committee or Member thereof, may not be interfered with or denied."

From the 1972 Water Pollution Control Act through the Clean Air Act, the Energy Reorganization Act, and the Civil Service Reform Act of 1978, the United States built up a patchwork of subject-matter whistleblower clauses (environmental statutes, nuclear-safety statutes, transportation-safety statutes), each protecting employees who reported violations within that sector. The general-purpose Whistleblower Protection Act of 1989 consolidated those clauses for federal employees, and the Whistleblower Protection Enhancement Act of 2012 plugged most of the gaps the courts had read into it.

From Enron to Brussels

The next big reset came from a familiar pattern: a corporate scandal large enough to embarrass legislators into a response. In the United Kingdom the trigger was incremental. The Graham Pink case (a charge nurse at Stepping Hill Hospital sacked in 1990 after writing to his MP about understaffing on geriatric wards), the Bristol heart scandal, and the King's Cross fire were all cases where someone inside an institution had tried, and failed, to be heard. The Public Interest Disclosure Act of 1998 was the result: the world's first general-purpose private-sector whistleblower statute, slotted into the Employment Rights Act 1996 as new sections 43A through 43L.

Across the Atlantic, the collapse of Enron in late 2001, and the Sherron Watkins memo that had warned the chief executive about its accounting in advance of the implosion, produced the Sarbanes-Oxley Act of 2002. Section 806 of the Act, codified at 18 U.S.C. section 1514A, says no covered company may "discharge, demote, suspend, threaten, harass, or in any other manner discriminate against an employee" for reporting securities fraud. The remedies available include reinstatement with seniority, back pay with interest, and recovery of legal costs.

Eight years later the Dodd-Frank Wall Street Reform Act of 2010 added what Sarbanes-Oxley had left out: money. Tipsters whose information leads to SEC sanctions of more than one million US dollars can collect between 10 and 30 percent of the proceeds. Since the programme launched, the SEC has paid out more than $1.9 billion to whistleblowers and recovered more than $6.3 billion in monetary sanctions across the SEC and CFTC programmes combined.

By October 2019 the European Union had drafted its first general-purpose whistleblower statute. Directive 2019/1937, often called the EU Whistleblower Directive, took effect on 16 December 2019 and gave member states two years to translate it into national law. The European Commission stated the rationale in plain language: "Providing whistleblowers with strong protection against retaliation is essential to encourage reporting and strengthen the effectiveness of EU law." The Directive's substantive content covers the by-now-familiar instruments (internal channels, external channels, prohibition of retaliation, protection of identity) applied uniformly across twenty-seven national legal systems.

Late transposition, real penalties, and a global convergence

The Directive's transposition deadline was 17 December 2021. By that date only three member states had complied. A year later, more than half were still missing. The European Commission referred the laggards to the Court of Justice of the EU, and on 6 March 2025 the Court ruled against five of them. Germany was fined 34 million euros, the largest of the lump sums; the Czech Republic drew 2.3 million, Hungary 1.75 million, Estonia 500,000 with a daily 1,500-euro surcharge until full compliance, and Luxembourg 375,000. The Court was unmoved by domestic-political excuses:

"A Member State cannot plead provisions, practices or situations prevailing in its domestic legal order to justify failure to observe obligations arising under EU law such as failure to transpose a directive within the period prescribed."
Court of Justice of the EU, 6 March 2025

Poland had transposed the Directive eight months earlier. The Polish whistleblower act of 14 June 2024 entered into force on 25 September 2024, with the external-reporting channels following on 25 December; private-sector employers with at least 50 staff and any organisation in the financial-services or anti-money-laundering sectors had to have an internal reporting procedure in place by the September date.

In the United States, two new programmes came online in 2024. The DOJ Corporate Whistleblower Awards Pilot Program, launched on 1 August 2024, offers up to 30 percent of the first $100 million in net forfeited proceeds to tipsters who report financial-institution crime, foreign or domestic corruption, or private-payor health-care fraud. It explicitly fills the gap between the SEC's reach (issuers) and the False Claims Act's reach (federal funds): a corporate-bribery case that touches no public money and no listed company now has a federal home.

The United Kingdom announced its first reward scheme in the November 2025 Budget. HMRC will pay informants between 15 and 30 percent of additional tax actually recovered (not merely assessed) on cases where the recovery exceeds 1.5 million pounds; the scheme takes effect on 6 April 2026, and the Serious Fraud Office and the Financial Conduct Authority have signalled that they intend to follow with their own incentive programmes.

Sitting above all of this, ISO 37002, published on 27 July 2021, is the first international standard for whistleblowing management systems. It is voluntary and not certifiable, but it gives multinational employers a single common reference for the process side of the obligation (receiving, assessing, addressing, and concluding reports) that translates directly into the operational requirements of the EU Directive, the DOJ pilot, the UK PIDA, and Sarbanes-Oxley.

Read the seven statutes in chronological order (1778, 1863, 1912, 1989, 1998, 2002, 2010, 2019) and the architecture is the same every time. There is a duty to report, a prohibition on retaliation, an external channel that the employer cannot foreclose, and, in the more confident versions, a financial reward for the report. What changes is the surface: one statute pays a sailor's lawyer in 1779, another pays a CFTC tipster more than two centuries later. Fraud against the Union Army, fraud against shareholders, fraud against the EU's own budget; the underlying problem (people who see wrongdoing have to weigh it against their job) and the underlying instruments (anti-reprisal protection plus a credible channel plus, often, money) have been re-implemented across two and a half centuries.

The Court of Justice's penalty rulings, the DOJ pilot, and the HMRC reward scheme are the latest restatement of a settlement Marven and Shaw paid for, and that the Continental Congress wrote down on a single sheet of paper in York.