Watchdog: NSA’s NDAs don’t comply with whistleblower law

The National Security Agency routinely fails to inform employees of their rights under whistleblower protection laws when they sign non-disclosure agreements, the intelligence agency’s inspector general concluded this week.

Although the NSA is not officially subject to the Whistleblower Protection Enhancement Act, Congress has consistently required most of its provisions—minus those relating to the U.S. Office of Special Counsel, who lacks jurisdiction to review matters involving counterintelligence and foreign intelligence—to apply to the agency via annual appropriations laws since 1988.

But according to a new report from the NSA inspector general, most of the agency’s non-disclosure agreements lack the required reference to federal whistleblower protections, meaning its employees “may not be aware” of their rights to disclose violations of law or instances of waste, fraud and abuse.

“We identified five unique NSA-developed NDAs. One of the five NDAs, NSA’s Security Agreement, did not include the current required whistleblower provisions but did include language related to whistleblower protections and had some statutory references,” the inspector general wrote. “The remaining four NDAs made no mention of whistleblower protections . . . Additionally, the OIG identified another five agreements that were not titled or identified as nondisclosure agreements but implied nondisclosure obligations and did not include the required whistleblower protection provisions.”

The report comes as the Trump administration considers promulgating a standardized NDA for use across government. The proposal has drawn bipartisan criticism for the potential chilling effect it could have on employees who witness misconduct while on the job, including by Sen. Chuck Grassley, R-Iowa, who requested the inspector general’s review of NSA NDAs.

The watchdog also found that the process by which NSA employees obtain access “compartmented information” include more nondisclosure provisions that similarly lack the needed whistleblower protection language.

“The subject matter experts we spoke with explained that individual offices develop their own access agreement brief sheets using a template, and an affiliate’s acknowledgement of one of these electronic brief sheets serves as the nondisclosure agreement,” the report states. “In interviews with SMEs, two opened brief sheets of their own and noted that the required provisions were not present. We reviewed the template and noted that it lacked inclusion of the required whistleblower protection provisions.”

The inspector general recommended creating a process to ensure all nondisclosure policies, forms and agreements include the statutorily mandated whistleblower protection language, as well as assigning the task to an official within the agency.

NSA concurred with the IG’s recommendations and said it planned to assign compliance to the agency’s chief of staff.