Nicholas Tides and Matthew Neumann had a beef with Boeing. As internal auditors in the aircraft manufacturer’s IT Sarbanes-Oxley audit group, their job was to test Boeing’s IT controls as part of a Sarbanes-Oxley Act (SOX) requirement that companies annually assess their internal security and financial reporting processes. In February 2007, Tides and Neumann alerted management that the company’s system had weaknesses that could allow unauthorized users to alter data, including the audit results, thus violating SOX. The two auditors also complained of a hostile work environment in which they felt pressured to report positive audit results. 

Feeling that management was ignoring their grievances, Tides and Neumann shared their concerns about Boeing with  a reporter, to whom they sent several e-mails and copies of internal documents from their work computers. In July 2007, the newspaper published an article about Boeing’s alleged security faults.

After an investigation, Boeing fired Tides and Neumann for violating the company’s policy prohibiting the disclosure of corporate information to the media (see “Proper Protocol”). The two sued Boeing, claiming their media leaks were protected by SOX’s whistleblower provisions, which protect employees of publicly traded companies from discrimination when they report conduct they believe to be a violation of the statute.

A district court awarded summary judgment to Boeing in February 2009. The court clarified that the SOX provisions only protect employees who provide information to the authorities listed in the statute: company supervisors, law enforcement or Congress. The media doesn’t fall into any of those three camps. On May 3, a unanimous three-judge panel for the 9th Circuit affirmed the lower court’s decision in Tides v. The Boeing Co.

Boundless Interpretation

SOX experts weren’t surprised by the outcome of Tides v. The Boeing Co. because the law’s well-defined protections never reference the media.

“The purpose of the SOX whistleblower protections is to remedy the wrongdoings of corporations,” says Steve Pearlman, a partner at Seyfarth Shaw and leader of the firm’s SOX whistleblower team. “The authorities outlined in SOX have the power to do that, whereas the media really doesn’t.”

Jason Schwartz, a partner at Gibson Dunn and member of the firm’s whistle- blower team, agrees that reports should only be made to people who can properly address the problems. “Media leaks could impede an investigation and run counter to the purposes of SOX,” he says.

Tides and Neumann argued that whistleblowing to the media should be protected under SOX because news outlets act as messengers to the authorities listed in the statute. But 9th Circuit Judge Barry Silverman called such an interpretation “boundless.”

“If Congress wanted to protect reports to the media under [the whistleblower provisions] it could have listed the media as one of the entities to which protected reports may be made,” Judge Silverman wrote.

Pearlman says Tides and Neumann’s argument isn’t likely ever to prevail. “The 9th Circuit is arguably the most liberal circuit, and if they didn’t take this interpretation, it’s unlikely that another circuit would.”

Plugging Holes

Experts say a solid media communications policy and crisis plan are the best defenses against damaging leaks.

“Most companies have a policy that says you can’t make any statements to the media without clearing them with the corporate communications group. That’s a pretty simple, bright-line policy that you can enforce,” Schwartz says.

For companies that opt for a more detailed policy, Pearlman suggests describing the types of information to be kept confidential and educating employees about the rules through web-based training or in-person lectures. “The company also should provide channels for employees to lodge their concerns and complaints,” he says.

Martha Zackin, of counsel at Mintz Levin, agrees. “Employees should have multiple avenues through which they can raise their complaints: through management, through an anonymous hotline, to the CEO—whatever they’re comfortable with,” she says.

A company’s crisis plan should aim to contain any damage that a leak causesand include specific individuals’ responsibilities in the investigation phase. “Typically the general counsel’s office is either going to coordinate the investigation or be a key adviser and partner to whoever is conducting it, which would be human resources or corporate security in most companies,” Schwartz says.

Zackin, who was in-house counsel for nearly 14 years at Keane, an IT consulting company, says internal interviews can be the most challenging aspect of an investigation. General counsel must eliminate any preconceptions and remain levelheaded throughout the process. “Rarely does an interview go exactly as you think it’s going to go,” Zackin says. “It helps for in-house counsel to think about all the potential outcomes.”